hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Re-factor CodeInjection to use the new API.

Browse Source
This commit is contained in:
Michael Nebel
2023-03-27 14:24:01 +02:00
parent 60c5bbde0f
commit cc4f3f6234
2 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll
View File

@@ -25,6 +25,8 @@ abstract class Sink extends DataFlow::ExprNode { }
abstract class Sanitizer extends DataFlow::ExprNode { }
/**
* DEPRECATED: Use `CodeInjection` instead.
*
* A taint-tracking configuration for user input treated as code vulnerabilities.
*/
class TaintTrackingConfiguration extends TaintTracking::Configuration {
@@ -37,6 +39,22 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
}
/**
* A taint-tracking configuration for user input treated as code vulnerabilities.
*/
private module CodeInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof Source }
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
}
/**
* A taint-tracking module for user input treated as code vulnerabilities.
*/
module CodeInjection = TaintTracking::Global<CodeInjectionConfig>;
/** A source of remote user input. */
class RemoteSource extends Source instanceof RemoteFlowSource { }

6
csharp/ql/src/Security Features/CWE-094/CodeInjection.ql
View File

@@ -15,9 +15,9 @@
import csharp
import semmle.code.csharp.security.dataflow.CodeInjectionQuery
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
import CodeInjection::PathGraph
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
where c.hasFlowPath(source, sink)
from CodeInjection::PathNode source, CodeInjection::PathNode sink
where CodeInjection::flowPath(source, sink)
select sink.getNode(), source, sink, "This code compilation depends on a $@.", source.getNode(),
"user-provided value"