hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Take more sources and sinks into account when reporting in the telemetry queries.

Browse Source
This commit is contained in:
Michael Nebel
2024-04-15 16:16:29 +02:00
parent 543032a3de
commit e7bfd7df62
3 changed files with 165 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/AllSinks.qll Normal file
View File

@@ -0,0 +1,84 @@
/** Provides classes representing various flow sinks for data flow / taint tracking. */
private import semmle.code.csharp.dataflow.internal.ExternalFlow
/**
* Module that adds all sinks to `SinkNode`, excluding sinks for cryptography based
* queries, and queries where sinks are not succifiently explicit.
*/
private module AllSinks {
private import ParallelSink as ParallelSink
private import Remote as Remote
private import semmle.code.csharp.security.dataflow.CodeInjectionQuery as CodeInjectionQuery
private import semmle.code.csharp.security.dataflow.ConditionalBypassQuery as ConditionalBypassQuery
private import semmle.code.csharp.security.dataflow.ExposureOfPrivateInformationQuery as ExposureOfPrivateInformationQuery
private import semmle.code.csharp.security.dataflow.HardcodedCredentialsQuery as HardcodedCredentialsQuery
private import semmle.code.csharp.security.dataflow.LDAPInjectionQuery as LdapInjectionQuery
private import semmle.code.csharp.security.dataflow.LogForgingQuery as LogForgingQuery
private import semmle.code.csharp.security.dataflow.MissingXMLValidationQuery as MissingXmlValidationQuery
private import semmle.code.csharp.security.dataflow.ReDoSQuery as ReDosQuery
private import semmle.code.csharp.security.dataflow.RegexInjectionQuery as RegexInjectionQuery
private import semmle.code.csharp.security.dataflow.ResourceInjectionQuery as ResourceInjectionQuery
private import semmle.code.csharp.security.dataflow.SqlInjectionQuery as SqlInjectionQuery
private import semmle.code.csharp.security.dataflow.TaintedPathQuery as TaintedPathQuery
private import semmle.code.csharp.security.dataflow.UnsafeDeserializationQuery as UnsafeDeserializationQuery
private import semmle.code.csharp.security.dataflow.UrlRedirectQuery as UrlRedirectQuery
private import semmle.code.csharp.security.dataflow.XMLEntityInjectionQuery as XmlEntityInjectionQuery
private import semmle.code.csharp.security.dataflow.XPathInjectionQuery as XpathInjectionQuery
private import semmle.code.csharp.security.dataflow.XSSSinks as XssSinks
private import semmle.code.csharp.security.dataflow.ZipSlipQuery as ZipSlipQuery
private class ParallelSink extends SinkNode instanceof ParallelSink::ParallelSink { }
private class RemoteSinkFlowSinks extends SinkNode instanceof Remote::RemoteFlowSink { }
private class CodeInjectionSink extends SinkNode instanceof CodeInjectionQuery::Sink { }
private class ConditionalBypassSink extends SinkNode instanceof ConditionalBypassQuery::Sink { }
private class ExposureOfPrivateInformationSink extends SinkNode instanceof ExposureOfPrivateInformationQuery::Sink
{ }
private class HardcodedCredentialsSink extends SinkNode instanceof HardcodedCredentialsQuery::Sink
{ }
private class LdapInjectionSink extends SinkNode instanceof LdapInjectionQuery::Sink { }
private class LogForgingSink extends SinkNode instanceof LogForgingQuery::Sink { }
private class MissingXmlValidationSink extends SinkNode instanceof MissingXmlValidationQuery::Sink
{ }
private class ReDosSink extends SinkNode instanceof ReDosQuery::Sink { }
private class RegexInjectionSink extends SinkNode instanceof RegexInjectionQuery::Sink { }
private class ResourceInjectionSink extends SinkNode instanceof ResourceInjectionQuery::Sink { }
private class SqlInjectionSink extends SinkNode instanceof SqlInjectionQuery::Sink { }
private class TaintedPathSink extends SinkNode instanceof TaintedPathQuery::Sink { }
private class UnsafeDeserializationSink extends SinkNode instanceof UnsafeDeserializationQuery::Sink
{ }
private class UrlRedirectSink extends SinkNode instanceof UrlRedirectQuery::Sink { }
private class XmlEntityInjectionSink extends SinkNode instanceof XmlEntityInjectionQuery::Sink { }
private class XpathInjectionSink extends SinkNode instanceof XpathInjectionQuery::Sink { }
private class XssSink extends SinkNode instanceof XssSinks::Sink { }
/**
* Add all models as data sinks.
*/
private class SinkNodeExternal extends SinkNode {
SinkNodeExternal() { sinkNode(this, _) }
}
}
/**
* A data flow sink node.
*/
abstract class SinkNode extends DataFlow::Node { }

77
csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/AllSources.qll Normal file
View File

@@ -0,0 +1,77 @@
/** Provides classes representing various flow sources for data flow / taint tracking. */
private import semmle.code.csharp.dataflow.internal.ExternalFlow
/**
* Module that adds all sources to `SourceNode`, excluding source for cryptography based
* queries, and queries where sources are not succifiently explicit or mainly hardcoded constants.
*/
private module AllSources {
private import FlowSources as FlowSources
private import semmle.code.csharp.security.cryptography.HardcodedSymmetricEncryptionKey
private import semmle.code.csharp.security.dataflow.CleartextStorageQuery as CleartextStorageQuery
private import semmle.code.csharp.security.dataflow.CodeInjectionQuery as CodeInjectionQuery
private import semmle.code.csharp.security.dataflow.ConditionalBypassQuery as ConditionalBypassQuery
private import semmle.code.csharp.security.dataflow.ExposureOfPrivateInformationQuery as ExposureOfPrivateInformationQuery
private import semmle.code.csharp.security.dataflow.HardcodedCredentialsQuery as HardcodedCredentialsQuery
private import semmle.code.csharp.security.dataflow.LDAPInjectionQuery as LdapInjectionQuery
private import semmle.code.csharp.security.dataflow.LogForgingQuery as LogForgingQuery
private import semmle.code.csharp.security.dataflow.MissingXMLValidationQuery as MissingXmlValidationQuery
private import semmle.code.csharp.security.dataflow.ReDoSQuery as ReDosQuery
private import semmle.code.csharp.security.dataflow.RegexInjectionQuery as RegexInjectionQuery
private import semmle.code.csharp.security.dataflow.ResourceInjectionQuery as ResourceInjectionQuery
private import semmle.code.csharp.security.dataflow.SqlInjectionQuery as SqlInjectionQuery
private import semmle.code.csharp.security.dataflow.TaintedPathQuery as TaintedPathQuery
private import semmle.code.csharp.security.dataflow.UnsafeDeserializationQuery as UnsafeDeserializationQuery
private import semmle.code.csharp.security.dataflow.UrlRedirectQuery as UrlRedirectQuery
private import semmle.code.csharp.security.dataflow.XMLEntityInjectionQuery as XmlEntityInjectionQuery
private import semmle.code.csharp.security.dataflow.XPathInjectionQuery as XpathInjectionQuery
private import semmle.code.csharp.security.dataflow.ZipSlipQuery as ZipSlipQuery
private class FlowSourcesSources extends SourceNode instanceof FlowSources::SourceNode { }
private class CodeInjectionSource extends SourceNode instanceof CodeInjectionQuery::Source { }
private class ConditionalBypassSource extends SourceNode instanceof ConditionalBypassQuery::Source
{ }
private class LdapInjectionSource extends SourceNode instanceof LdapInjectionQuery::Source { }
private class LogForgingSource extends SourceNode instanceof LogForgingQuery::Source { }
private class MissingXmlValidationSource extends SourceNode instanceof MissingXmlValidationQuery::Source
{ }
private class ReDosSource extends SourceNode instanceof ReDosQuery::Source { }
private class RegexInjectionSource extends SourceNode instanceof RegexInjectionQuery::Source { }
private class ResourceInjectionSource extends SourceNode instanceof ResourceInjectionQuery::Source
{ }
private class SqlInjectionSource extends SourceNode instanceof SqlInjectionQuery::Source { }
private class TaintedPathSource extends SourceNode instanceof TaintedPathQuery::Source { }
private class UnsafeDeserializationSource extends SourceNode instanceof UnsafeDeserializationQuery::Source
{ }
private class UrlRedirectSource extends SourceNode instanceof UrlRedirectQuery::Source { }
private class XmlEntityInjectionSource extends SourceNode instanceof XmlEntityInjectionQuery::Source
{ }
private class XpathInjectionSource extends SourceNode instanceof XpathInjectionQuery::Source { }
/**
* Add all models as data sources.
*/
private class SourceNodeExternal extends SourceNode {
SourceNodeExternal() { sourceNode(this, _) }
}
}
/**
* A data flow source node.
*/
abstract class SourceNode extends DataFlow::Node { }

9
csharp/ql/src/Telemetry/ExternalApi.qll
View File

@@ -8,7 +8,8 @@ private import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
private import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate
private import semmle.code.csharp.security.dataflow.flowsources.Remote
private import semmle.code.csharp.security.dataflow.flowsources.AllSources
private import semmle.code.csharp.security.dataflow.flowsinks.AllSinks
private import TestLibrary
/** Holds if the given callable is not worth supporting. */
@@ -84,13 +85,11 @@ class ExternalApi extends Callable {
/** Holds if this API is a known source. */
pragma[nomagic]
predicate isSource() {
this.getAnOutput() instanceof RemoteFlowSource or sourceNode(this.getAnOutput(), _)
}
predicate isSource() { this.getAnOutput() instanceof SourceNode }
/** Holds if this API is a known sink. */
pragma[nomagic]
predicate isSink() { sinkNode(this.getAnInput(), _) }
predicate isSink() { this.getAnInput() instanceof SinkNode }
/** Holds if this API is a known neutral. */
pragma[nomagic]