hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Autoformat QL queries

Browse Source
This commit is contained in:
Tom Hvitved
2019-01-02 12:59:07 +01:00
parent 4348de3120
commit daa45322b1
277 changed files with 2462 additions and 2301 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
csharp/ql/src/Security Features/InsecureRandomness.ql
View File

@@ -10,6 +10,7 @@
* @tags security
* external/cwe/cwe-338
*/
import csharp
import semmle.code.csharp.frameworks.Test
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
@@ -37,21 +38,13 @@ module Random {
* A taint-tracking configuration for insecure randomness in security sensitive context.
*/
class TaintTrackingConfiguration extends TaintTracking::Configuration {
TaintTrackingConfiguration() {
this = "RandomDataFlowConfiguration"
}
TaintTrackingConfiguration() { this = "RandomDataFlowConfiguration" }
override predicate isSource(DataFlow::Node source) {
source instanceof Source
}
override predicate isSource(DataFlow::Node source) { source instanceof Source }
override predicate isSink(DataFlow::Node sink) {
sink instanceof Sink
}
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
override predicate isSanitizer(DataFlow::Node node) {
node instanceof Sanitizer
}
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
// succ = array_or_indexer[pred] - use of random numbers in an index
@@ -62,7 +55,9 @@ module Random {
/** A source of cryptographically insecure random numbers. */
class RandomSource extends Source {
RandomSource() {
this.getExpr() = any(MethodCall mc | mc.getQualifier().getType().(RefType).hasQualifiedName("System", "Random"))
this.getExpr() = any(MethodCall mc |
mc.getQualifier().getType().(RefType).hasQualifiedName("System", "Random")
)
}
}
@@ -71,15 +66,20 @@ module Random {
SensitiveSink() {
exists(Expr e |
// Simple assignment
e = this.getExpr() |
e = any(SensitiveVariable v).getAnAssignedValue() or
e = any(SensitiveProperty v).getAnAssignedValue() or
e = any(SensitiveLibraryParameter v).getAnAssignedArgument() or
e = this.getExpr()
|
e = any(SensitiveVariable v).getAnAssignedValue()
or
e = any(SensitiveProperty v).getAnAssignedValue()
or
e = any(SensitiveLibraryParameter v).getAnAssignedArgument()
or
// Assignment operation, e.g. += or similar
exists(AssignOperation ao |
ao.getRValue() = e and
// "expanded" assignments will be covered by simple assignment
not ao.hasExpandedAssignment() |
not ao.hasExpandedAssignment()
|
ao.getLValue() = any(SensitiveVariable v).getAnAccess() or
ao.getLValue() = any(SensitiveProperty v).getAnAccess() or
ao.getLValue() = any(SensitiveLibraryParameter v).getAnAccess()
@@ -94,8 +94,7 @@ module Random {
*/
class AlreadyTrackedSanitizer extends Sanitizer {
AlreadyTrackedSanitizer() {
exists(Expr e |
e = this.getExpr() |
exists(Expr e | e = this.getExpr() |
e = any(SensitiveVariable v).getAnAccess() or
e = any(SensitiveProperty v).getAnAccess() or
e = any(SensitiveLibraryParameter v).getAnAccess()
@@ -104,7 +103,10 @@ module Random {
}
}
from Random::TaintTrackingConfiguration randomTracking, DataFlow::PathNode source, DataFlow::PathNode sink
from
Random::TaintTrackingConfiguration randomTracking, DataFlow::PathNode source,
DataFlow::PathNode sink
where randomTracking.hasFlowPath(source, sink)
select sink.getNode(), source, sink,
"Cryptographically insecure random number is generated at $@ and used here in a security context.", source.getNode(), source.getNode().toString()
"Cryptographically insecure random number is generated at $@ and used here in a security context.",
source.getNode(), source.getNode().toString()