From b6cf13510c70fcf21a9a6789c833123d81ba284c Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Thu, 27 Jun 2019 10:03:03 +0200 Subject: [PATCH] C#: Update `@name` for two queries --- change-notes/1.21/analysis-csharp.md | 4 ++-- csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql | 2 +- .../ql/src/Likely Bugs/ThreadUnsafeICryptoTransformLambda.ql | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/change-notes/1.21/analysis-csharp.md b/change-notes/1.21/analysis-csharp.md index a43d5110788..dc53e1f8fc8 100644 --- a/change-notes/1.21/analysis-csharp.md +++ b/change-notes/1.21/analysis-csharp.md @@ -8,8 +8,8 @@ C# analysis now supports the extraction and analysis of many C# 8 features. For | **Query** | **Tags** | **Purpose** | |-----------------------------------------------|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Class defines a field that uses an ICryptoTransform class in a way that would be unsafe for concurrent threads (`cs/thread-unsafe-icryptotransform-field-in-class`) | concurrency, security, external/cwe/cwe-362 | Highlights classes with fields that make use of a static `System.Security.Cryptography.ICryptoTransform` object. Using these classes in concurrent threads is dangerous. It may result in an error and may also give incorrect results. Results are not shown on [LGTM](https://lgtm.com/rules/1507931833866/) by default. | -| Potential usage of an object implementing ICryptoTransform class in a way that would be unsafe for concurrent threads (`cs/thread-unsafe-icryptotransform-captured-in-lambda`) | concurrency, security, external/cwe/cwe-362 | Highlights instances of classes where a field of type `System.Security.Cryptography.ICryptoTransform` is captured by a lambda, and appears to be used in a thread initialization method. Results are not shown on [LGTM](https://lgtm.com/rules/1508141845995/) by default. | +| Thread-unsafe use of a static ICryptoTransform field (`cs/thread-unsafe-icryptotransform-field-in-class`) | concurrency, security, external/cwe/cwe-362 | Highlights classes with fields that make use of a static `System.Security.Cryptography.ICryptoTransform` object. Using these classes in concurrent threads is dangerous. It may result in an error and may also give incorrect results. Results are not shown on [LGTM](https://lgtm.com/rules/1507931833866/) by default. | +| Thread-unsafe capturing of an ICryptoTransform object (`cs/thread-unsafe-icryptotransform-captured-in-lambda`) | concurrency, security, external/cwe/cwe-362 | Highlights instances of classes where a field of type `System.Security.Cryptography.ICryptoTransform` is captured by a lambda, and appears to be used in a thread initialization method. Results are not shown on [LGTM](https://lgtm.com/rules/1508141845995/) by default. | ## Changes to existing queries diff --git a/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql b/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql index 7ce6e557a54..4f7e83b8be0 100644 --- a/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql +++ b/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql @@ -1,5 +1,5 @@ /** - * @name Class defines a field that uses an ICryptoTransform class in a way that would be unsafe for concurrent threads + * @name Thread-unsafe use of a static ICryptoTransform field * @description The class has a field that directly or indirectly make use of a static System.Security.Cryptography.ICryptoTransform object. * Using this an instance of this class in concurrent threads is dangerous as it may not only result in an error, * but under some circumstances may also result in incorrect results. diff --git a/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransformLambda.ql b/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransformLambda.ql index 5f283238f77..4f549163595 100644 --- a/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransformLambda.ql +++ b/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransformLambda.ql @@ -1,5 +1,5 @@ /** - * @name Potential usage of an object implementing ICryptoTransform class in a way that would be unsafe for concurrent threads. + * @name Thread-unsafe capturing of an ICryptoTransform object * @description An instance of a class that either implements or has a field of type System.Security.Cryptography.ICryptoTransform is being captured by a lambda, * and used in what seems to be a thread initialization method. * Using an instance of this class in concurrent threads is dangerous as it may not only result in an error,