hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-21 23:14:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Recognize more calls to IHtmlHelper.Raw

Browse Source 
Generalize logic by recognizing not only calls to
`Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw()`, but calls to all `Raw()`
methods that implement `Microsoft.AspNetCore.Mvc.Rendering.IHtmlHelper.Raw()`.
This commit is contained in:
Tom Hvitved
2020-05-19 11:52:06 +02:00
parent 5e021c24c1
commit 8395980fb1
2 changed files with 21 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll
View File

@@ -27,6 +27,14 @@ class MicrosoftAspNetCoreMvcViewFeatures extends Namespace {
}
}
/** The 'Microsoft.AspNetCore.Mvc.Rendering' namespace. */
class MicrosoftAspNetCoreMvcRendering extends Namespace {
MicrosoftAspNetCoreMvcRendering() {
getParentNamespace() instanceof MicrosoftAspNetCoreMvcNamespace and
hasName("Rendering")
}
}
/** An attribute whose type is in the `Microsoft.AspNetCore.Mvc` namespace. */
class MicrosoftAspNetCoreMvcAttribute extends Attribute {
MicrosoftAspNetCoreMvcAttribute() {
@@ -191,11 +199,11 @@ class MicrosoftAspNetCoreMvcController extends Class {
}
}
/** The `Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper` class. */
class MicrosoftAspNetCoreMvcHtmlHelperClass extends Class {
MicrosoftAspNetCoreMvcHtmlHelperClass() {
getNamespace() instanceof MicrosoftAspNetCoreMvcViewFeatures and
hasName("HtmlHelper")
/** The `Microsoft.AspNetCore.Mvc.Rendering.IHtmlHelper` interface. */
class MicrosoftAspNetCoreMvcRenderingHtmlHelperInterface extends Interface {
MicrosoftAspNetCoreMvcRenderingHtmlHelperInterface() {
getNamespace() instanceof MicrosoftAspNetCoreMvcRendering and
hasName("IHtmlHelper")
}
/** Gets the `Raw` method. */

11
csharp/ql/src/semmle/code/csharp/security/dataflow/flowsinks/Html.qll
View File

@@ -176,13 +176,18 @@ class WebPageWriteLiteralToSink extends HtmlSink {
abstract class AspNetCoreHtmlSink extends HtmlSink { }
/**
* An expression that is used as an argument to `HtmlHelper.Raw`, typically in
* An expression that is used as an argument to `IHtmlHelper.Raw`, typically in
* a `.cshtml` file.
*/
class MicrosoftAspNetCoreMvcHtmlHelperRawSink extends AspNetCoreHtmlSink {
MicrosoftAspNetCoreMvcHtmlHelperRawSink() {
this.getExpr() =
any(MicrosoftAspNetCoreMvcHtmlHelperClass h).getRawMethod().getACall().getAnArgument()
exists(Call c, Callable target |
c.getTarget() = target and
target.hasName("Raw") and
target.getDeclaringType().getABaseType*() instanceof
MicrosoftAspNetCoreMvcRenderingHtmlHelperInterface and
this.getExpr() = c.getAnArgument()
)
}
}