hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Re-factor ProcessNameToHashTaintFlow to use the new API.

Browse Source
This commit is contained in:
Michael Nebel
2023-04-13 13:38:39 +02:00
parent 96f9c40fdb
commit e3cbebae30
1 changed files with 8 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql
View File

@@ -11,23 +11,17 @@
*/
import csharp
import DataFlow::PathGraph
import experimental.code.csharp.Cryptography.NonCryptographicHashes
import DataFlowFromMethodToHash::PathGraph
class DataFlowFromMethodToHash extends TaintTracking::Configuration {
DataFlowFromMethodToHash() { this = "DataFlowFromMethodNameToHashFunction" }
module DataFlowFromMethodToHashConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { isSuspiciousPropertyName(source.asExpr()) }
/**
* Holds if `source` is a relevant data flow source.
*/
override predicate isSource(DataFlow::Node source) { isSuspiciousPropertyName(source.asExpr()) }
/**
* Holds if `sink` is a relevant data flow sink.
*/
override predicate isSink(DataFlow::Node sink) { isGetHash(sink.asExpr()) }
predicate isSink(DataFlow::Node sink) { isGetHash(sink.asExpr()) }
}
module DataFlowFromMethodToHash = TaintTracking::Global<DataFlowFromMethodToHashConfig>;
predicate isGetHash(Expr arg) {
exists(MethodCall mc |
(
@@ -48,8 +42,8 @@ predicate isSuspiciousPropertyName(PropertyRead pr) {
pr.getTarget().hasQualifiedName("System.Diagnostics", "Process", "ProcessName")
}
from DataFlow::PathNode src, DataFlow::PathNode sink, DataFlowFromMethodToHash conf
where conf.hasFlow(src.getNode(), sink.getNode())
from DataFlowFromMethodToHash::PathNode src, DataFlowFromMethodToHash::PathNode sink
where DataFlowFromMethodToHash::flow(src.getNode(), sink.getNode())
select src.getNode(), src, sink,
"The hash is calculated on $@, may be related to a backdoor. Please review the code for possible malicious intent.",
sink.getNode(), "this process name"