hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Restrict FormatInvalid.ql and UncontrolledFormatString.ql to calls with insertions

Browse Source
This commit is contained in:
Tom Hvitved
2020-12-18 10:53:11 +01:00
parent 7a132149a2
commit d53faa86dc
9 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
csharp/ql/src/API Abuse/FormatInvalid.ql
View File

@@ -14,5 +14,7 @@ import semmle.code.csharp.frameworks.Format
import FormatFlow
from FormatCall s, InvalidFormatString src, PathNode source, PathNode sink
where hasFlowPath(src, source, s, sink)
where
hasFlowPath(src, source, s, sink) and
s.hasInsertions()
select src, source, sink, "Invalid format string used in $@ formatting call.", s, "this"

2
csharp/ql/src/API Abuse/FormatInvalidBad.cs
View File

@@ -4,6 +4,6 @@ class Bad
{
string GenerateEmptyClass(string c)
{
return string.Format("class {0} { }");
return string.Format("class {0} { }", "C");
}
}