hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Update log forging expected test output.

Browse Source
This commit is contained in:
Michael Nebel
2025-04-02 11:19:37 +02:00
parent cf75493fe9
commit d7f5ce2492
2 changed files with 2 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected
View File

@@ -3,8 +3,6 @@
| LogForging.cs:31:50:31:72 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:31:50:31:72 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
| LogForging.cs:35:26:35:33 | access to local variable username | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:35:26:35:33 | access to local variable username | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
| LogForgingAsp.cs:17:21:17:43 | ... + ... | LogForgingAsp.cs:13:32:13:39 | username : String | LogForgingAsp.cs:17:21:17:43 | ... + ... | This log entry depends on a $@. | LogForgingAsp.cs:13:32:13:39 | username | user-provided value |
| LogForgingAsp.cs:86:21:86:50 | $"..." | LogForgingAsp.cs:82:37:82:37 | e : TestEnum | LogForgingAsp.cs:86:21:86:50 | $"..." | This log entry depends on a $@. | LogForgingAsp.cs:82:37:82:37 | e | user-provided value |
| LogForgingAsp.cs:93:21:93:61 | $"..." | LogForgingAsp.cs:89:47:89:48 | dt : DateTimeOffset | LogForgingAsp.cs:93:21:93:61 | $"..." | This log entry depends on a $@. | LogForgingAsp.cs:89:47:89:48 | dt | user-provided value |
edges
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:21:21:21:43 | ... + ... | provenance | |
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:31:50:31:72 | ... + ... | provenance | |
@@ -13,8 +11,6 @@ edges
| LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:18:27:18:61 | access to indexer : String | provenance | MaD:1 |
| LogForging.cs:18:27:18:61 | access to indexer : String | LogForging.cs:18:16:18:23 | access to local variable username : String | provenance | |
| LogForgingAsp.cs:13:32:13:39 | username : String | LogForgingAsp.cs:17:21:17:43 | ... + ... | provenance | |
| LogForgingAsp.cs:82:37:82:37 | e : TestEnum | LogForgingAsp.cs:86:21:86:50 | $"..." | provenance | |
| LogForgingAsp.cs:89:47:89:48 | dt : DateTimeOffset | LogForgingAsp.cs:93:21:93:61 | $"..." | provenance | |
models
| 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
nodes
@@ -26,13 +22,4 @@ nodes
| LogForging.cs:35:26:35:33 | access to local variable username | semmle.label | access to local variable username |
| LogForgingAsp.cs:13:32:13:39 | username : String | semmle.label | username : String |
| LogForgingAsp.cs:17:21:17:43 | ... + ... | semmle.label | ... + ... |
| LogForgingAsp.cs:82:37:82:37 | e : TestEnum | semmle.label | e : TestEnum |
| LogForgingAsp.cs:86:21:86:50 | $"..." | semmle.label | $"..." |
| LogForgingAsp.cs:89:47:89:48 | dt : DateTimeOffset | semmle.label | dt : DateTimeOffset |
| LogForgingAsp.cs:93:21:93:61 | $"..." | semmle.label | $"..." |
subpaths
testFailures
| LogForgingAsp.cs:82:37:82:37 | e : TestEnum | Unexpected result: Source |
| LogForgingAsp.cs:86:21:86:50 | $"..." | Unexpected result: Alert |
| LogForgingAsp.cs:89:47:89:48 | dt : DateTimeOffset | Unexpected result: Source |
| LogForgingAsp.cs:93:21:93:61 | $"..." | Unexpected result: Alert |

4
csharp/ql/test/query-tests/Security Features/CWE-117/LogForgingAsp.cs
View File

@@ -82,14 +82,14 @@ public class AspController : ControllerBase
public void ActionEnum(TestEnum e)
{
var logger = new ILogger();
// GOOD: Enum is a sanitizer. [FALSE POSITIVE]
// GOOD: Enum is a sanitizer.
logger.Warn($"Warning about the enum: {e}");
}
public void ActionDateTime(DateTimeOffset dt)
{
var logger = new ILogger();
// GOOD: DateTimeOffset is a sanitizer. [FALSE POSITIVE]
// GOOD: DateTimeOffset is a sanitizer.
logger.Warn($"Warning about the DateTimeOffset: {dt}");
}
}