hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Migrate System.Int32 flow summaries to CSV

Browse Source
This commit is contained in:
Tamas Vajk
2021-06-24 15:10:23 +02:00
parent a9ccd65fa9
commit b7a43dccd3
3 changed files with 18 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
csharp/ql/src/semmle/code/csharp/dataflow/ExternalFlow.qll
View File

@@ -86,6 +86,7 @@ private import internal.FlowSummaryImplSpecific
private module Frameworks {
private import semmle.code.csharp.security.dataflow.flowsources.Local
private import semmle.code.csharp.security.dataflow.flowsinks.Html
private import semmle.code.csharp.dataflow.LibraryTypeDataFlow
}
/**

35
csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
View File

@@ -23,6 +23,7 @@ private import semmle.code.csharp.dataflow.internal.DelegateDataFlow
private import semmle.code.csharp.frameworks.EntityFramework
private import semmle.code.csharp.frameworks.JsonNET
private import FlowSummary
private import semmle.code.csharp.dataflow.ExternalFlow
private newtype TAccessPath =
TNilAccessPath() or
@@ -500,29 +501,17 @@ private module FrameworkDataFlowAdaptor {
}
/** Data flow for `System.Int32`. */
class SystemInt32Flow extends LibraryTypeDataFlow, SystemInt32Struct {
override predicate callableFlow(
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
boolean preservesValue
) {
methodFlow(source, sink, c) and
preservesValue = false
}
private predicate methodFlow(
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationMethod m
) {
m = getParseMethod() and
source = TCallableFlowSourceArg(0) and
sink = TCallableFlowSinkReturn()
or
m = getTryParseMethod() and
source = TCallableFlowSourceArg(0) and
(
sink = TCallableFlowSinkReturn()
or
sink = TCallableFlowSinkArg(any(int i | m.getParameter(i).isOutOrRef()))
)
private class SystemInt32FlowModelCsv extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"System;Int32;false;Parse;;;Argument[0];ReturnValue;taint",
"System;Int32;false;TryParse;;;Argument[0];ReturnValue;taint",
"System;Int32;false;TryParse;(System.String,System.Int32);;Argument[0];Argument[1];taint",
"System;Int32;false;TryParse;(System.ReadOnlySpan<System.Char>,System.Int32);;Argument[0];Argument[1];taint",
"System;Int32;false;TryParse;(System.String,System.Globalization.NumberStyles,System.IFormatProvider,System.Int32);;Argument[0];Argument[3];taint",
"System;Int32;false;TryParse;(System.ReadOnlySpan<System.Char>,System.Globalization.NumberStyles,System.IFormatProvider,System.Int32);;Argument[0];Argument[3];taint"
]
}
}

5
csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
View File

@@ -1217,10 +1217,15 @@
| System.IO.UnmanagedMemoryStreamWrapper.ToArray() | argument -1 -> return (normal) | false |
| System.IO.UnmanagedMemoryStreamWrapper.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
| System.IO.UnmanagedMemoryStreamWrapper.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
| System.Int32.Parse(ReadOnlySpan<Char>, NumberStyles, IFormatProvider) | argument 0 -> return (normal) | false |
| System.Int32.Parse(string) | argument 0 -> return (normal) | false |
| System.Int32.Parse(string, IFormatProvider) | argument 0 -> return (normal) | false |
| System.Int32.Parse(string, NumberStyles) | argument 0 -> return (normal) | false |
| System.Int32.Parse(string, NumberStyles, IFormatProvider) | argument 0 -> return (normal) | false |
| System.Int32.TryParse(ReadOnlySpan<Char>, NumberStyles, IFormatProvider, out int) | argument 0 -> argument 3 | false |
| System.Int32.TryParse(ReadOnlySpan<Char>, NumberStyles, IFormatProvider, out int) | argument 0 -> return (normal) | false |
| System.Int32.TryParse(ReadOnlySpan<Char>, out int) | argument 0 -> argument 1 | false |
| System.Int32.TryParse(ReadOnlySpan<Char>, out int) | argument 0 -> return (normal) | false |
| System.Int32.TryParse(string, NumberStyles, IFormatProvider, out int) | argument 0 -> argument 3 | false |
| System.Int32.TryParse(string, NumberStyles, IFormatProvider, out int) | argument 0 -> return (normal) | false |
| System.Int32.TryParse(string, out int) | argument 0 -> argument 1 | false |