From bd0137a721c99c0d5de1f828d1e99ad540585e34 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Wed, 17 Jan 2024 17:10:18 -0500 Subject: [PATCH 01/19] Deprecated direct use of `RemoteFlowSource` and use `ThreatModelFlowSource` instead --- .../security/dataflow/CodeInjectionQuery.qll | 22 ++++++++++++++----- .../dataflow/CommandInjectionQuery.qll | 13 ++++++++--- .../dataflow/ConditionalBypassQuery.qll | 11 ++++++++-- .../ExposureOfPrivateInformationQuery.qll | 2 +- .../security/dataflow/ExternalAPIsQuery.qll | 2 +- .../security/dataflow/LDAPInjectionQuery.qll | 13 ++++++++--- .../security/dataflow/LogForgingQuery.qll | 4 ++-- .../dataflow/MissingXMLValidationQuery.qll | 15 ++++++++++--- .../csharp/security/dataflow/ReDoSQuery.qll | 13 ++++++++--- .../security/dataflow/RegexInjectionQuery.qll | 13 ++++++++--- .../dataflow/ResourceInjectionQuery.qll | 22 ++++++++++++++----- .../security/dataflow/SqlInjectionQuery.qll | 22 ++++++++++++++----- .../security/dataflow/TaintedPathQuery.qll | 13 ++++++++--- .../dataflow/UnsafeDeserializationQuery.qll | 4 ++-- .../security/dataflow/UrlRedirectQuery.qll | 13 ++++++++--- .../dataflow/XMLEntityInjectionQuery.qll | 4 ++-- .../security/dataflow/XPathInjectionQuery.qll | 13 ++++++++--- .../csharp/security/dataflow/XSSQuery.qll | 6 ++--- 18 files changed, 150 insertions(+), 55 deletions(-) diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll index d41c6b8f811..22f52fbfede 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll @@ -3,8 +3,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote -private import semmle.code.csharp.security.dataflow.flowsources.Local +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.codedom.Compiler private import semmle.code.csharp.security.Sanitizers private import semmle.code.csharp.dataflow.internal.ExternalFlow @@ -55,11 +54,22 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig { */ module CodeInjection = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } -/** A source of local user input. */ -class LocalSource extends Source instanceof LocalFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of local user input. + */ +deprecated class LocalSource extends Source instanceof LocalFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll index b174405443f..00862a2f29f 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll @@ -3,7 +3,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.Diagnostics private import semmle.code.csharp.security.Sanitizers private import semmle.code.csharp.dataflow.internal.ExternalFlow @@ -64,8 +64,15 @@ module CommandInjectionConfig implements DataFlow::ConfigSig { */ module CommandInjection = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** Command Injection sinks defined through Models as Data. */ private class ExternalCommandInjectionExprSink extends Sink { diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll index e919684d751..71260be4e9a 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll @@ -6,7 +6,7 @@ import csharp private import semmle.code.csharp.controlflow.Guards private import semmle.code.csharp.controlflow.BasicBlocks -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.System private import semmle.code.csharp.frameworks.system.Net private import semmle.code.csharp.security.SensitiveActions @@ -60,9 +60,16 @@ private module ConditionalBypassConfig implements DataFlow::ConfigSig { */ module ConditionalBypass = TaintTracking::Global; -/** A source of remote user input. */ +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ class RemoteSource extends Source instanceof RemoteFlowSource { } +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } + /** The result of a reverse dns may be user-controlled. */ class ReverseDnsSource extends Source { ReverseDnsSource() { diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll index 0b53d9d1ca6..03db7fadf81 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll @@ -3,7 +3,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.security.dataflow.flowsinks.ExternalLocationSink private import semmle.code.csharp.security.PrivateData diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll index e1630503da5..cb60cc0f12d 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll @@ -5,7 +5,7 @@ import csharp private import semmle.code.csharp.commons.QualifiedName -private import semmle.code.csharp.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.System private import semmle.code.csharp.dataflow.FlowSummary diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll index 25134fbcb12..e3781f35cf0 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll @@ -4,7 +4,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.DirectoryServices private import semmle.code.csharp.frameworks.system.directoryservices.Protocols private import semmle.code.csharp.security.Sanitizers @@ -66,8 +66,15 @@ module LdapInjectionConfig implements DataFlow::ConfigSig { */ module LdapInjection = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreadModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** LDAP sinks defined through Models as Data. */ private class ExternalLdapExprSink extends Sink { diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll index 800e86457b4..ed6e69f0709 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll @@ -3,7 +3,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.System private import semmle.code.csharp.frameworks.system.text.RegularExpressions private import semmle.code.csharp.security.Sanitizers @@ -57,7 +57,7 @@ private module LogForgingConfig implements DataFlow::ConfigSig { module LogForging = TaintTracking::Global; /** A source of remote user input. */ -private class RemoteSource extends Source instanceof RemoteFlowSource { } +private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } private class HtmlSanitizer extends Sanitizer { HtmlSanitizer() { this.asExpr() instanceof HtmlSanitizedExpr } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll index 676b77b8446..1da33e2c22a 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll @@ -4,7 +4,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.Xml private import semmle.code.csharp.security.Sanitizers @@ -62,8 +62,17 @@ private module MissingXmlValidationConfig implements DataFlow::ConfigSig { */ module MissingXmlValidation = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelFlowSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } + +/** + * A source supported by the current threat model. + */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** * The input argument to a call to `XmlReader.Create` where the input will not be validated against diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll index 27f70a0d4e4..71923f3e00b 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll @@ -5,7 +5,7 @@ import csharp private import semmle.code.csharp.dataflow.DataFlow2 -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.text.RegularExpressions private import semmle.code.csharp.security.Sanitizers @@ -55,8 +55,15 @@ private module ReDoSConfig implements DataFlow::ConfigSig { */ module ReDoS = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** * An expression that represents a regular expression with potential exponential behavior. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll index 89baeda92b6..5fb2d6d2605 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll @@ -4,7 +4,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.text.RegularExpressions private import semmle.code.csharp.security.Sanitizers @@ -54,8 +54,15 @@ private module RegexInjectionConfig implements DataFlow::ConfigSig { */ module RegexInjection = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** * A `pattern` argument to a construction of a `Regex`. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll index 336ca17ca75..010bdc9798c 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll @@ -3,8 +3,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote -private import semmle.code.csharp.security.dataflow.flowsources.Local +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.Data private import semmle.code.csharp.security.Sanitizers @@ -54,11 +53,22 @@ private module ResourceInjectionConfig implements DataFlow::ConfigSig { */ module ResourceInjection = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } -/** A source of local user input. */ -class LocalSource extends Source instanceof LocalFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of local user input. + */ +deprecated class LocalSource extends Source instanceof LocalFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** An argument to the `ConnectionString` property on a data connection class. */ class SqlConnectionStringSink extends Sink { diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll index 7500ac7a994..95d85cd7482 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll @@ -3,8 +3,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote -private import semmle.code.csharp.security.dataflow.flowsources.Local +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.Sql private import semmle.code.csharp.security.Sanitizers private import semmle.code.csharp.dataflow.internal.ExternalFlow @@ -65,11 +64,22 @@ module SqlInjectionConfig implements DataFlow::ConfigSig { */ module SqlInjection = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } -/** A source of local user input. */ -class LocalSource extends Source instanceof LocalFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of local user input. + */ +deprecated class LocalSource extends Source instanceof LocalFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** An SQL expression passed to an API call that executes SQL. */ class SqlInjectionExprSink extends Sink { diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll index 005a9e96bfa..df3256a2f55 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll @@ -5,7 +5,7 @@ import csharp private import semmle.code.csharp.controlflow.Guards -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.IO private import semmle.code.csharp.frameworks.system.Web private import semmle.code.csharp.security.Sanitizers @@ -56,8 +56,15 @@ private module TaintedPathConfig implements DataFlow::ConfigSig { */ module TaintedPath = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** * A path argument to a `File` method call. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll index cf558b62c43..6de1305a11d 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll @@ -6,7 +6,7 @@ import csharp private import semmle.code.csharp.serialization.Deserializers private import semmle.code.csharp.dataflow.TaintTracking2 -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources /** * A data flow source for unsafe deserialization vulnerabilities. @@ -48,7 +48,7 @@ abstract private class ConstructorOrStaticMethodSink extends Sink { } */ abstract class Sanitizer extends DataFlow::Node { } -private class RemoteSource extends Source instanceof RemoteFlowSource { } +private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** * DEPRECATED: Use `TaintToObjectMethodTracking` instead. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll index 53b4cceb960..ef488dbf7e5 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll @@ -3,7 +3,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.controlflow.Guards private import semmle.code.csharp.frameworks.Format private import semmle.code.csharp.frameworks.system.Web @@ -58,8 +58,15 @@ private module UrlRedirectConfig implements DataFlow::ConfigSig { */ module UrlRedirect = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** URL Redirection sinks defined through Models as Data. */ private class ExternalUrlRedirectExprSink extends Sink { diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll index e2d347a2268..7e7fd61fb1c 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll @@ -3,7 +3,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.System private import semmle.code.csharp.frameworks.system.text.RegularExpressions private import semmle.code.csharp.security.xml.InsecureXMLQuery as InsecureXml @@ -14,7 +14,7 @@ private import semmle.code.csharp.security.Sanitizers */ abstract class Source extends DataFlow::Node { } -private class RemoteSource extends Source instanceof RemoteFlowSource { } +private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** * A data flow sink for untrusted user input used in XML processing. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll index 57a0d6e9b50..cec80f45298 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll @@ -3,7 +3,7 @@ */ import csharp -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.xml.XPath private import semmle.code.csharp.frameworks.system.Xml private import semmle.code.csharp.security.Sanitizers @@ -64,8 +64,15 @@ module XpathInjectionConfig implements DataFlow::ConfigSig { */ module XpathInjection = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** The `xpath` argument to an `XPathExpression.Compile(..)` call. */ class XPathExpressionCompileSink extends Sink { diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSQuery.qll index 1dea41c8a7c..b9fd47689f9 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSQuery.qll @@ -6,7 +6,7 @@ import csharp private import XSSSinks private import semmle.code.csharp.security.Sanitizers -private import semmle.code.csharp.security.dataflow.flowsources.Remote +private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.dataflow.DataFlow2 private import semmle.code.csharp.dataflow.TaintTracking2 @@ -179,8 +179,8 @@ module XssTrackingConfig implements DataFlow::ConfigSig { module XssTracking = TaintTracking::Global; -/** A source of remote user input. */ -private class RemoteSource extends Source instanceof RemoteFlowSource { } +/** A source supported by the current threat model. */ +private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { } From f388a0f10c58563a11214f66111608290de98ded Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Tue, 23 Jan 2024 21:45:14 -0500 Subject: [PATCH 02/19] Deprecate direct uses of `RemoteFlowSource` and replace with `ThreatModelFlowSource` --- .../security/dataflow/ConditionalBypassQuery.qll | 2 +- .../CWE-114/AssemblyPathInjection.ql | 4 ++-- .../src/experimental/CWE-099/TaintedWebClientLib.qll | 12 ++++++++++-- .../ql/src/experimental/CWE-918/RequestForgery.qll | 6 +++--- 4 files changed, 16 insertions(+), 8 deletions(-) diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll index 71260be4e9a..d92a0aa34e0 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll @@ -65,7 +65,7 @@ module ConditionalBypass = TaintTracking::Global; * * A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql b/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql index daaaba7517d..a6150b53798 100644 --- a/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql +++ b/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql @@ -13,7 +13,7 @@ */ import csharp -import semmle.code.csharp.security.dataflow.flowsources.Remote +import semmle.code.csharp.security.dataflow.flowsources.FlowSources import semmle.code.csharp.commons.Util import AssemblyPathInjection::PathGraph @@ -22,7 +22,7 @@ import AssemblyPathInjection::PathGraph */ module AssemblyPathInjectionConfig implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { - source instanceof RemoteFlowSource or + source instanceof ThreatModelFlowSource or source.asExpr() = any(MainMethod main).getParameter(0).getAnAccess() } diff --git a/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll b/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll index 3810ff6f76a..54dc3a77fbd 100644 --- a/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll +++ b/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll @@ -2,6 +2,7 @@ import csharp import semmle.code.csharp.frameworks.system.Net import semmle.code.csharp.frameworks.System import semmle.code.csharp.security.dataflow.flowsources.Remote +import semmle.code.csharp.security.dataflow.flowsources.FlowSources import semmle.code.csharp.security.Sanitizers //If this leaves experimental this should probably go in semmle.code.csharp.frameworks.system.Net @@ -68,8 +69,15 @@ private module TaintedWebClientConfig implements DataFlow::ConfigSig { */ module TaintedWebClient = TaintTracking::Global; -/** A source of remote user input. */ -class RemoteSource extends Source instanceof RemoteFlowSource { } +/** + * DEPRECATED: Use `ThreatModelSource` instead. + * + * A source of remote user input. + */ +deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } + +/** A source supported by the current threat model. */ +class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** * A path argument to a `WebClient` method call that has an address argument. diff --git a/csharp/ql/src/experimental/CWE-918/RequestForgery.qll b/csharp/ql/src/experimental/CWE-918/RequestForgery.qll index 29d4fa9094b..84a9b844bf6 100644 --- a/csharp/ql/src/experimental/CWE-918/RequestForgery.qll +++ b/csharp/ql/src/experimental/CWE-918/RequestForgery.qll @@ -6,6 +6,7 @@ module RequestForgery { import semmle.code.csharp.frameworks.system.Web import semmle.code.csharp.frameworks.Format import semmle.code.csharp.security.dataflow.flowsources.Remote + import semmle.code.csharp.security.dataflow.flowsources.FlowSources /** * A data flow source for server side request forgery vulnerabilities. @@ -91,10 +92,9 @@ module RequestForgery { module RequestForgeryFlow = DataFlow::Global; /** - * A remote data flow source taken as a source - * for Server Side Request Forgery(SSRF) Vulnerabilities. + * A dataflow source for Server Side Request Forgery(SSRF) Vulnerabilities. */ - private class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource { } + private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } /** * An url argument to a `HttpRequestMessage` constructor call From 75772664f2148f84545e0a8616ee8cc8302a6954 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Tue, 23 Jan 2024 22:27:35 -0500 Subject: [PATCH 03/19] Change note --- csharp/ql/src/change-notes/2024-01-23-threat-models.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 csharp/ql/src/change-notes/2024-01-23-threat-models.md diff --git a/csharp/ql/src/change-notes/2024-01-23-threat-models.md b/csharp/ql/src/change-notes/2024-01-23-threat-models.md new file mode 100644 index 00000000000..b46ec263dca --- /dev/null +++ b/csharp/ql/src/change-notes/2024-01-23-threat-models.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. From 31d4d0ca57011a8ec41ba3ec08995b4d22a26b7a Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Tue, 30 Jan 2024 22:00:52 -0500 Subject: [PATCH 04/19] Move `getSourceType` to `SourceNode` --- .../ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll | 2 ++ csharp/ql/lib/semmle/code/csharp/frameworks/NHibernate.qll | 2 ++ .../csharp/security/dataflow/flowsources/FlowSources.qll | 3 +++ .../code/csharp/security/dataflow/flowsources/Local.qll | 3 +-- .../code/csharp/security/dataflow/flowsources/Remote.qll | 3 +-- .../code/csharp/security/dataflow/flowsources/Stored.qll | 5 +++++ 6 files changed, 14 insertions(+), 4 deletions(-) diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll index b634aa7d1a5..739546dde46 100644 --- a/csharp/ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll +++ b/csharp/ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll @@ -49,6 +49,8 @@ module EntityFramework { StoredFlowSource() { this.asExpr() = any(PropertyRead read | read.getTarget() instanceof MappedProperty) } + + override string getSourceType() { result = "ORM mapped property" } } private class EFClass extends Class { diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/NHibernate.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/NHibernate.qll index a13c84250c5..74796ccedd1 100644 --- a/csharp/ql/lib/semmle/code/csharp/frameworks/NHibernate.qll +++ b/csharp/ql/lib/semmle/code/csharp/frameworks/NHibernate.qll @@ -91,6 +91,8 @@ module NHibernate { StoredFlowSource() { this.asExpr() = any(PropertyRead read | read.getTarget() instanceof MappedProperty) } + + override string getSourceType() { result = "ORM mapped property" } } /** diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/FlowSources.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/FlowSources.qll index 6da08298fb9..a5ada1cbaf8 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/FlowSources.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/FlowSources.qll @@ -14,6 +14,9 @@ abstract class SourceNode extends DataFlow::Node { * Gets a string that represents the source kind with respect to threat modeling. */ abstract string getThreatModel(); + + /** Gets a string that describes the type of this flow source. */ + abstract string getSourceType(); } /** diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll index 7ee1d4b744c..121f53c4929 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll @@ -9,8 +9,7 @@ private import semmle.code.csharp.security.dataflow.flowsources.FlowSources /** A data flow source of local data. */ abstract class LocalFlowSource extends SourceNode { - /** Gets a string that describes the type of this local flow source. */ - abstract string getSourceType(); + override string getSourceType() { result = "local flow source" } override string getThreatModel() { result = "local" } } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll index 07c230c19c2..dc2fb36c47a 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll @@ -17,8 +17,7 @@ private import semmle.code.csharp.security.dataflow.flowsources.FlowSources /** A data flow source of remote user input. */ abstract class RemoteFlowSource extends SourceNode { - /** Gets a string that describes the type of this remote flow source. */ - abstract string getSourceType(); + override string getSourceType() { result = "remote flow source" } override string getThreatModel() { result = "remote" } } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll index 95df5284b1d..bb704c2f80c 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll @@ -13,6 +13,7 @@ private import semmle.code.csharp.security.dataflow.flowsources.FlowSources /** A data flow source of stored user input. */ abstract class StoredFlowSource extends SourceNode { + // override string getSourceType() { result = "stored flow source" } override string getThreatModel() { result = "local" } } @@ -21,6 +22,8 @@ abstract class StoredFlowSource extends SourceNode { */ abstract class DatabaseInputSource extends StoredFlowSource { override string getThreatModel() { result = "database" } + + override string getSourceType() { result = "database input" } } /** @@ -76,4 +79,6 @@ class FileStreamStoredFlowSource extends StoredFlowSource { FileStreamStoredFlowSource() { sourceNode(this, "file") } override string getThreatModel() { result = "file" } + + override string getSourceType() { result = "file stream" } } From fd3738b10e1dd15e064b3705a6af8fcd4d958f00 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Tue, 30 Jan 2024 22:11:37 -0500 Subject: [PATCH 05/19] Refactor to using `SourceNode::getSourceType` --- csharp/ql/src/Security Features/CWE-089/SqlInjection.ql | 9 ++------- .../CWE-134/UncontrolledFormatString.ql | 9 ++------- 2 files changed, 4 insertions(+), 14 deletions(-) diff --git a/csharp/ql/src/Security Features/CWE-089/SqlInjection.ql b/csharp/ql/src/Security Features/CWE-089/SqlInjection.ql index e3fa7f80bd7..d4d1287561f 100644 --- a/csharp/ql/src/Security Features/CWE-089/SqlInjection.ql +++ b/csharp/ql/src/Security Features/CWE-089/SqlInjection.ql @@ -14,14 +14,9 @@ import csharp import semmle.code.csharp.security.dataflow.SqlInjectionQuery import SqlInjection::PathGraph -import semmle.code.csharp.security.dataflow.flowsources.Remote -import semmle.code.csharp.security.dataflow.flowsources.Local +import semmle.code.csharp.security.dataflow.flowsources.FlowSources -string getSourceType(DataFlow::Node node) { - result = node.(RemoteFlowSource).getSourceType() - or - result = node.(LocalFlowSource).getSourceType() -} +string getSourceType(DataFlow::Node node) { result = node.(SourceNode).getSourceType() } from SqlInjection::PathNode source, SqlInjection::PathNode sink where SqlInjection::flowPath(source, sink) diff --git a/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql b/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql index e8b9aa0a53f..5353b4b1402 100644 --- a/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql +++ b/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql @@ -12,8 +12,7 @@ */ import csharp -import semmle.code.csharp.security.dataflow.flowsources.Remote -import semmle.code.csharp.security.dataflow.flowsources.Local +import semmle.code.csharp.security.dataflow.flowsources.FlowSources import semmle.code.csharp.frameworks.Format import FormatString::PathGraph @@ -31,11 +30,7 @@ module FormatStringConfig implements DataFlow::ConfigSig { module FormatString = TaintTracking::Global; -string getSourceType(DataFlow::Node node) { - result = node.(RemoteFlowSource).getSourceType() - or - result = node.(LocalFlowSource).getSourceType() -} +string getSourceType(DataFlow::Node node) { result = node.(SourceNode).getSourceType() } from FormatString::PathNode source, FormatString::PathNode sink where FormatString::flowPath(source, sink) From b76795fd285284b6f06d71f2349a8c01b50ad683 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Tue, 30 Jan 2024 22:12:24 -0500 Subject: [PATCH 06/19] Refactor to using ThreatModelFlowSource --- .../Security Features/CWE-134/UncontrolledFormatString.ql | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql b/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql index 5353b4b1402..7eec0bb90c6 100644 --- a/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql +++ b/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql @@ -17,11 +17,7 @@ import semmle.code.csharp.frameworks.Format import FormatString::PathGraph module FormatStringConfig implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { - source instanceof RemoteFlowSource - or - source instanceof LocalFlowSource - } + predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource } predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(FormatCall call | call.hasInsertions()).getFormatExpr() From 1086abca63d72b3f375af9b980ae4d79db07b6f5 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Tue, 30 Jan 2024 22:15:28 -0500 Subject: [PATCH 07/19] Refactor to using `ThreatModelFlowSource` --- .../security/auth/InsecureDirectObjectReferenceQuery.qll | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/csharp/ql/lib/semmle/code/csharp/security/auth/InsecureDirectObjectReferenceQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/auth/InsecureDirectObjectReferenceQuery.qll index d4fa6401650..858adcc2268 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/auth/InsecureDirectObjectReferenceQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/auth/InsecureDirectObjectReferenceQuery.qll @@ -1,7 +1,8 @@ /** Definitions for the Insecure Direct Object Reference query */ import csharp -import semmle.code.csharp.dataflow.flowsources.Remote +import semmle.code.csharp.security.dataflow.flowsources.FlowSources +deprecated import semmle.code.csharp.dataflow.flowsources.Remote import ActionMethods /** @@ -17,7 +18,7 @@ private predicate needsChecks(ActionMethod m) { m.isEdit() and not m.isAdmin() } * that may indicate that it's used as the ID for some resource */ private predicate hasIdParameter(ActionMethod m) { - exists(RemoteFlowSource src | src.getEnclosingCallable() = m | + exists(ThreatModelFlowSource src | src.getEnclosingCallable() = m | src.asParameter().getName().toLowerCase().matches(["%id", "%idx"]) or // handle cases like `Request.QueryString["Id"]` From 434fa20646ada196e595adbcd0b1704cbab4bacb Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Tue, 30 Jan 2024 22:31:25 -0500 Subject: [PATCH 08/19] Refactor to using `ThreatModelFlowSource` --- .../code/csharp/security/dataflow/ExternalAPIsQuery.qll | 6 +++--- csharp/ql/src/Security Features/CWE-091/XMLInjection.ql | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll index cb60cc0f12d..4910d7ff733 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll @@ -97,14 +97,14 @@ deprecated class UntrustedDataToExternalApiConfig extends TaintTracking::Configu override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode } } -/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */ +/** A configuration for tracking flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s. */ private module RemoteSourceToExternalApiConfig implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } + predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource } predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode } } -/** A module for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */ +/** A module for tracking flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s. */ module RemoteSourceToExternalApi = TaintTracking::Global; /** A node representing untrusted data being passed to an external API. */ diff --git a/csharp/ql/src/Security Features/CWE-091/XMLInjection.ql b/csharp/ql/src/Security Features/CWE-091/XMLInjection.ql index 7402a45edde..042e2aa9f17 100644 --- a/csharp/ql/src/Security Features/CWE-091/XMLInjection.ql +++ b/csharp/ql/src/Security Features/CWE-091/XMLInjection.ql @@ -12,7 +12,7 @@ */ import csharp -import semmle.code.csharp.security.dataflow.flowsources.Remote +import semmle.code.csharp.security.dataflow.flowsources.FlowSources import semmle.code.csharp.frameworks.system.Xml import XmlInjection::PathGraph @@ -20,7 +20,7 @@ import XmlInjection::PathGraph * A taint-tracking configuration for untrusted user input used in XML. */ module XmlInjectionConfig implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } + predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource } predicate isSink(DataFlow::Node sink) { exists(MethodCall mc | From b4dabee770c9c798531cdb32dc85fa0526dd0f23 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Tue, 30 Jan 2024 22:32:33 -0500 Subject: [PATCH 09/19] Remove unnecessary `flowsources.Remote` imports Since `FlowSources` now re-exports `Remote`, these can be safely removed. --- csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll | 1 - csharp/ql/src/experimental/CWE-918/RequestForgery.qll | 1 - 2 files changed, 2 deletions(-) diff --git a/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll b/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll index 54dc3a77fbd..5687d3befcf 100644 --- a/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll +++ b/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll @@ -1,7 +1,6 @@ import csharp import semmle.code.csharp.frameworks.system.Net import semmle.code.csharp.frameworks.System -import semmle.code.csharp.security.dataflow.flowsources.Remote import semmle.code.csharp.security.dataflow.flowsources.FlowSources import semmle.code.csharp.security.Sanitizers diff --git a/csharp/ql/src/experimental/CWE-918/RequestForgery.qll b/csharp/ql/src/experimental/CWE-918/RequestForgery.qll index 84a9b844bf6..e1c6875d952 100644 --- a/csharp/ql/src/experimental/CWE-918/RequestForgery.qll +++ b/csharp/ql/src/experimental/CWE-918/RequestForgery.qll @@ -5,7 +5,6 @@ module RequestForgery { import semmle.code.csharp.frameworks.System import semmle.code.csharp.frameworks.system.Web import semmle.code.csharp.frameworks.Format - import semmle.code.csharp.security.dataflow.flowsources.Remote import semmle.code.csharp.security.dataflow.flowsources.FlowSources /** From eb81946adc7f4d3293896322fb1543f08e9b153f Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Tue, 30 Jan 2024 22:38:03 -0500 Subject: [PATCH 10/19] Change note changes to mention `local` sources as well --- csharp/ql/src/change-notes/2024-01-23-threat-models.md | 1 + 1 file changed, 1 insertion(+) diff --git a/csharp/ql/src/change-notes/2024-01-23-threat-models.md b/csharp/ql/src/change-notes/2024-01-23-threat-models.md index b46ec263dca..d3fced2a9db 100644 --- a/csharp/ql/src/change-notes/2024-01-23-threat-models.md +++ b/csharp/ql/src/change-notes/2024-01-23-threat-models.md @@ -2,3 +2,4 @@ category: minorAnalysis --- * Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. +* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. From 22e8da29280b09f7388adca893cb7b309a4a0091 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Sun, 4 Feb 2024 22:52:53 -0500 Subject: [PATCH 11/19] Update change note date --- .../{2024-01-23-threat-models.md => 2024-02-06-threat-models.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename csharp/ql/src/change-notes/{2024-01-23-threat-models.md => 2024-02-06-threat-models.md} (100%) diff --git a/csharp/ql/src/change-notes/2024-01-23-threat-models.md b/csharp/ql/src/change-notes/2024-02-06-threat-models.md similarity index 100% rename from csharp/ql/src/change-notes/2024-01-23-threat-models.md rename to csharp/ql/src/change-notes/2024-02-06-threat-models.md From 5198f52351b5145ee75be257767d06dda8615ec0 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Sun, 4 Feb 2024 23:19:06 -0500 Subject: [PATCH 12/19] Add references to changed queries in change note --- csharp/ql/src/change-notes/2024-02-06-threat-models.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/csharp/ql/src/change-notes/2024-02-06-threat-models.md b/csharp/ql/src/change-notes/2024-02-06-threat-models.md index d3fced2a9db..39d83268405 100644 --- a/csharp/ql/src/change-notes/2024-02-06-threat-models.md +++ b/csharp/ql/src/change-notes/2024-02-06-threat-models.md @@ -1,5 +1,5 @@ --- category: minorAnalysis --- -* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. -* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. +* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`. +* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. The changed queries are `cs/code-injection`, `cs/resource-injection`, `cs/sql-injection`, and `cs/uncontrolled-format-string`. \ No newline at end of file From f237d2aeda4e062c731d6e5012c14d0ea864477e Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Sun, 4 Feb 2024 23:19:48 -0500 Subject: [PATCH 13/19] Refactor to use `ThreatModelFlowSource` --- .../semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll index 4910d7ff733..3075fe53a87 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll @@ -92,7 +92,7 @@ class ExternalApiDataNode extends DataFlow::Node { deprecated class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration { UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfig" } - override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } + override predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource } override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode } } From af749e221b68c959290e0b05c5124dacc1ed324e Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Sun, 4 Feb 2024 23:20:04 -0500 Subject: [PATCH 14/19] Remove commented out code --- .../semmle/code/csharp/security/dataflow/flowsources/Stored.qll | 1 - 1 file changed, 1 deletion(-) diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll index bb704c2f80c..2d2ecd0bccb 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll @@ -13,7 +13,6 @@ private import semmle.code.csharp.security.dataflow.flowsources.FlowSources /** A data flow source of stored user input. */ abstract class StoredFlowSource extends SourceNode { - // override string getSourceType() { result = "stored flow source" } override string getThreatModel() { result = "local" } } From e64826db1b01a60c469c3780f96542d7a8607fb0 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Sun, 4 Feb 2024 23:25:33 -0500 Subject: [PATCH 15/19] Add threat-model configuration for `UncontrolledFormatString` test --- .../CWE-134/UncontrolledFormatString.ext.yml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.ext.yml diff --git a/csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.ext.yml b/csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.ext.yml new file mode 100644 index 00000000000..82f107ae1d7 --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.ext.yml @@ -0,0 +1,7 @@ +extensions: + + - addsTo: + pack: codeql/threat-models + extensible: threatModelConfiguration + data: + - ["local", true, 0] \ No newline at end of file From 3563c7ef03a2f70e895a77c616f0f97297d4e8ee Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Wed, 28 Feb 2024 12:44:25 -0500 Subject: [PATCH 16/19] Modify deprecated `RemoteSource` classes to extend `DataFlow::Node` directly. Since `ThreatModelFlowSource` contains `RemoteFlowSource` by default, we can safely remove the `RemoteSource` from the default of the queries. --- .../semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll | 2 +- .../code/csharp/security/dataflow/CommandInjectionQuery.qll | 2 +- .../code/csharp/security/dataflow/ConditionalBypassQuery.qll | 2 +- .../semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll | 2 +- .../code/csharp/security/dataflow/MissingXMLValidationQuery.qll | 2 +- .../ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll | 2 +- .../code/csharp/security/dataflow/RegexInjectionQuery.qll | 2 +- .../code/csharp/security/dataflow/ResourceInjectionQuery.qll | 2 +- .../semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll | 2 +- .../semmle/code/csharp/security/dataflow/TaintedPathQuery.qll | 2 +- .../semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll | 2 +- .../code/csharp/security/dataflow/XPathInjectionQuery.qll | 2 +- csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll index 22f52fbfede..e0d57024876 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll @@ -59,7 +59,7 @@ module CodeInjection = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** * DEPRECATED: Use `ThreatModelSource` instead. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll index 00862a2f29f..d0b24125ba9 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll @@ -69,7 +69,7 @@ module CommandInjection = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll index d92a0aa34e0..a8938ecc6c9 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll @@ -65,7 +65,7 @@ module ConditionalBypass = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll index e3781f35cf0..58a34f7604b 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll @@ -71,7 +71,7 @@ module LdapInjection = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll index 1da33e2c22a..914239bf7d5 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll @@ -67,7 +67,7 @@ module MissingXmlValidation = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** * A source supported by the current threat model. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll index 71923f3e00b..84d12fca0cc 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll @@ -60,7 +60,7 @@ module ReDoS = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll index 5fb2d6d2605..501ede13f29 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll @@ -59,7 +59,7 @@ module RegexInjection = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll index 010bdc9798c..e75c8c3b410 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll @@ -58,7 +58,7 @@ module ResourceInjection = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** * DEPRECATED: Use `ThreatModelSource` instead. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll index 95d85cd7482..d03662728cb 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll @@ -69,7 +69,7 @@ module SqlInjection = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** * DEPRECATED: Use `ThreatModelSource` instead. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll index df3256a2f55..bbd32b58353 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll @@ -61,7 +61,7 @@ module TaintedPath = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll index ef488dbf7e5..9a5ec46cb37 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll @@ -63,7 +63,7 @@ module UrlRedirect = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll index cec80f45298..1edddf45f56 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll @@ -69,7 +69,7 @@ module XpathInjection = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll b/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll index 5687d3befcf..e3459dfb1ac 100644 --- a/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll +++ b/csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll @@ -73,7 +73,7 @@ module TaintedWebClient = TaintTracking::Global; * * A source of remote user input. */ -deprecated class RemoteSource extends Source instanceof RemoteFlowSource { } +deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } From 86ceeebd89e92fa65abacea5850a0b0e8968117d Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Wed, 28 Feb 2024 12:55:12 -0500 Subject: [PATCH 17/19] Change handling of `LocalSource` in queries 1. Change `LocalSource` to extend `DataFlow::Node`, thus removed from the definiton of `Source` 2. Add a private class `AddLocalSource` which extends `Source`. This allows us to currently preserve the inclusion of local sources, while making it easier to remove it in the future. --- .../code/csharp/security/dataflow/CodeInjectionQuery.qll | 4 +++- .../code/csharp/security/dataflow/ResourceInjectionQuery.qll | 4 +++- .../code/csharp/security/dataflow/SqlInjectionQuery.qll | 4 +++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll index e0d57024876..fdfd422c47b 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll @@ -66,7 +66,9 @@ deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource * * A source of local user input. */ -deprecated class LocalSource extends Source instanceof LocalFlowSource { } +deprecated class LocalSource extends DataFlow::Node instanceof LocalFlowSource { } + +private class AddLocalSource extends Source instanceof LocalFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll index e75c8c3b410..56cb59001cd 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll @@ -65,7 +65,9 @@ deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource * * A source of local user input. */ -deprecated class LocalSource extends Source instanceof LocalFlowSource { } +deprecated class LocalSource extends DataFlow::Node instanceof LocalFlowSource { } + +private class AddLocalSource extends Source instanceof LocalFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll index d03662728cb..12c580381b9 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll @@ -76,7 +76,9 @@ deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource * * A source of local user input. */ -deprecated class LocalSource extends Source instanceof LocalFlowSource { } +deprecated class LocalSource extends DataFlow::Node instanceof LocalFlowSource { } + +private class AddLocalSource extends Source instanceof LocalFlowSource { } /** A source supported by the current threat model. */ class ThreatModelSource extends Source instanceof ThreatModelFlowSource { } From 89bdb7f437f60450cff48af56cc3d0c6afe6afff Mon Sep 17 00:00:00 2001 From: Edward Minnix III Date: Thu, 29 Feb 2024 11:48:24 -0500 Subject: [PATCH 18/19] Remove discussion of local flow in change note Co-authored-by: Michael Nebel --- csharp/ql/src/change-notes/2024-02-06-threat-models.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/csharp/ql/src/change-notes/2024-02-06-threat-models.md b/csharp/ql/src/change-notes/2024-02-06-threat-models.md index 39d83268405..69ac4e4dc17 100644 --- a/csharp/ql/src/change-notes/2024-02-06-threat-models.md +++ b/csharp/ql/src/change-notes/2024-02-06-threat-models.md @@ -1,5 +1,4 @@ --- category: minorAnalysis --- -* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`. -* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. The changed queries are `cs/code-injection`, `cs/resource-injection`, `cs/sql-injection`, and `cs/uncontrolled-format-string`. \ No newline at end of file +* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`. \ No newline at end of file From f488f23a48db82b3a4c9d9f26f430328180d7e8c Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Thu, 29 Feb 2024 12:06:59 -0500 Subject: [PATCH 19/19] Add `LocalFlowSource` back to `UncontrolledFormatString` --- .../src/Security Features/CWE-134/UncontrolledFormatString.ql | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql b/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql index 7eec0bb90c6..657fdd0e183 100644 --- a/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql +++ b/csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql @@ -17,7 +17,9 @@ import semmle.code.csharp.frameworks.Format import FormatString::PathGraph module FormatStringConfig implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource } + predicate isSource(DataFlow::Node source) { + source instanceof ThreatModelFlowSource or source instanceof LocalFlowSource + } predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(FormatCall call | call.hasInsertions()).getFormatExpr()