hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Re-factor TaintedWebClient to use the new API.

Browse Source
This commit is contained in:
Michael Nebel
2023-04-13 13:31:46 +02:00
parent a96ad600fc
commit 96f9c40fdb
2 changed files with 22 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
csharp/ql/src/experimental/CWE-099/TaintedWebClient.ql
View File

@@ -16,9 +16,9 @@
import csharp
import TaintedWebClientLib
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
import TaintedWebClient::PathGraph
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
where c.hasFlowPath(source, sink)
from TaintedWebClient::PathNode source, TaintedWebClient::PathNode sink
where TaintedWebClient::flowPath(source, sink)
select sink.getNode(), source, sink, "A method of WebClient depepends on a $@.", source.getNode(),
"user-provided value"

20
csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll
View File

@@ -38,9 +38,11 @@ abstract class Sink extends DataFlow::ExprNode { }
abstract class Sanitizer extends DataFlow::ExprNode { }
/**
* DEPRECATED: Use `TaintedWebClient` instead.
*
* A taint-tracking configuration for uncontrolled data in path expression vulnerabilities.
*/
class TaintTrackingConfiguration extends TaintTracking::Configuration {
deprecated class TaintTrackingConfiguration extends TaintTracking::Configuration {
TaintTrackingConfiguration() { this = "TaintedWebClientLib" }
override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -50,6 +52,22 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
}
/**
* A taint-tracking configuration for uncontrolled data in path expression vulnerabilities.
*/
private module TaintedWebClientConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof Source }
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
}
/**
* A taint-tracking module for uncontrolled data in path expression vulnerabilities.
*/
module TaintedWebClient = TaintTracking::Global<TaintedWebClientConfig>;
/** A source of remote user input. */
class RemoteSource extends Source instanceof RemoteFlowSource { }