mirror of
https://github.com/github/codeql.git
synced 2026-05-02 12:15:17 +02:00
C#: Autoformat follow-up changes
This commit is contained in:
@@ -19,8 +19,8 @@ predicate hasSubtypeStar(RefType t, RefType u) {
|
||||
}
|
||||
|
||||
/**
|
||||
* for each class, get all methods from this class or its
|
||||
* superclasses, with their names in lowercase
|
||||
* For each class, get all methods from this class or its
|
||||
* superclasses, with their names in lowercase
|
||||
*/
|
||||
predicate methodNames(RefType t, Method m, string lowercase) {
|
||||
exists(RefType t2 |
|
||||
@@ -33,7 +33,7 @@ predicate methodNames(RefType t, Method m, string lowercase) {
|
||||
|
||||
/**
|
||||
* For each class, find the pairs of methods that
|
||||
* are candidates for being confusing in this class
|
||||
* are candidates for being confusing in this class
|
||||
*/
|
||||
predicate confusing(Method m1, Method m2) {
|
||||
exists(RefType t, string lower |
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* @name Windows controls with generated names
|
||||
* @description Replacing the generated names in windows forms with meaningful names
|
||||
* makes it easier for other developers to understand the code.
|
||||
* makes it easier for other developers to understand the code.
|
||||
* @kind problem
|
||||
* @problem.severity recommendation
|
||||
* @precision medium
|
||||
|
||||
@@ -16,12 +16,10 @@ import csharp
|
||||
|
||||
class ComplexStmt extends Stmt {
|
||||
ComplexStmt() {
|
||||
(
|
||||
this instanceof ForStmt or
|
||||
this instanceof WhileStmt or
|
||||
this instanceof DoStmt or
|
||||
this instanceof SwitchStmt
|
||||
)
|
||||
this instanceof ForStmt or
|
||||
this instanceof WhileStmt or
|
||||
this instanceof DoStmt or
|
||||
this instanceof SwitchStmt
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -25,10 +25,10 @@ where
|
||||
not isDefinitelyPositive(lhs.getLeftOperand().stripCasts()) and
|
||||
lhs.getRightOperand().(IntegerLiteral).getValue() = "2" and
|
||||
(
|
||||
(t instanceof EQExpr and rhs.getValue() = "1" and parity = "oddness")
|
||||
t instanceof EQExpr and rhs.getValue() = "1" and parity = "oddness"
|
||||
or
|
||||
(t instanceof NEExpr and rhs.getValue() = "1" and parity = "evenness")
|
||||
t instanceof NEExpr and rhs.getValue() = "1" and parity = "evenness"
|
||||
or
|
||||
(t instanceof GTExpr and rhs.getValue() = "0" and parity = "oddness")
|
||||
t instanceof GTExpr and rhs.getValue() = "0" and parity = "oddness"
|
||||
)
|
||||
select t, "Possibly invalid test for " + parity + ". This will fail for negative numbers."
|
||||
|
||||
@@ -18,7 +18,7 @@ import semmle.code.csharp.frameworks.System
|
||||
*/
|
||||
predicate whitelist(MethodCall mc) {
|
||||
// Allow tests to verify that equals methods return false
|
||||
(mc.getParent*().(MethodCall)).getTarget().hasName("IsFalse")
|
||||
mc.getParent*().(MethodCall).getTarget().hasName("IsFalse")
|
||||
}
|
||||
|
||||
from EqualsMethod equals, MethodCall ma, Type i, Type j
|
||||
|
||||
@@ -16,6 +16,6 @@ where
|
||||
c.isSourceDeclaration() and
|
||||
n = count(Stmt s |
|
||||
s.getEnclosingCallable() = c and
|
||||
s != c.getAChild()
|
||||
) // we do not count the top-level block
|
||||
s != c.getAChild() // we do not count the top-level block
|
||||
)
|
||||
select c, n order by n desc
|
||||
|
||||
@@ -14,8 +14,8 @@ import csharp
|
||||
|
||||
/**
|
||||
* The parent of a statement, excluding some common cases that don't really make
|
||||
* sense for nesting depth. An example is: "if (...) { } else if (...) { }: we don't
|
||||
* consider the second if nested. Blocks are also skipped
|
||||
* sense for nesting depth. An example is: "if (...) { } else if (...) { }: we don't
|
||||
* consider the second if nested. Blocks are also skipped
|
||||
*/
|
||||
predicate realParent(Stmt inner, Stmt outer) {
|
||||
if skipParent(inner) then realParent(inner.getParent(), outer) else outer = inner.getParent()
|
||||
@@ -23,7 +23,7 @@ predicate realParent(Stmt inner, Stmt outer) {
|
||||
|
||||
predicate skipParent(Stmt s) {
|
||||
exists(Stmt parent | parent = s.getParent() |
|
||||
(s instanceof IfStmt and (parent.(IfStmt)).getElse() = s)
|
||||
s instanceof IfStmt and parent.(IfStmt).getElse() = s
|
||||
or
|
||||
parent instanceof BlockStmt
|
||||
)
|
||||
|
||||
@@ -14,12 +14,11 @@ import csharp
|
||||
// any use of + that has string type
|
||||
class StringCat extends AddExpr { StringCat() { this.getType() instanceof StringType } }
|
||||
|
||||
/*
|
||||
* an assignment of the form
|
||||
* v = ... + ... v ...
|
||||
* where v is a simple variable (and not, for example, a property)
|
||||
/**
|
||||
* Holds if `e` is an assignment of the form
|
||||
* `v = ... + ... v ...`
|
||||
* where `v` is a simple variable (and not, for example, a property).
|
||||
*/
|
||||
|
||||
predicate isSelfConcatAssignExpr(AssignExpr e, Variable v) {
|
||||
not e = any(AssignAddExpr a).getExpandedAssignment() and
|
||||
exists(VariableAccess use |
|
||||
@@ -34,12 +33,11 @@ predicate stringCatContains(StringCat expr, Expr child) {
|
||||
stringCatContains(expr, child.getParent())
|
||||
}
|
||||
|
||||
/*
|
||||
* an assignment of the form
|
||||
* v += ...
|
||||
* where v is a simple variable (and not, for example, a property)
|
||||
/**
|
||||
* Holds if `e` is an assignment of the form
|
||||
* `v += ...`
|
||||
* where `v` is a simple variable (and not, for example, a property).
|
||||
*/
|
||||
|
||||
predicate isConcatExpr(AssignAddExpr e, Variable v) {
|
||||
e.getLValue().getType() instanceof StringType and
|
||||
v = e.getTargetVariable()
|
||||
|
||||
@@ -24,8 +24,8 @@ class Application_Error extends Method {
|
||||
}
|
||||
|
||||
from CustomErrorsXMLElement customError
|
||||
// `<customErrors>` must be set to "off" to be dangerous
|
||||
where
|
||||
// `<customErrors>` must be set to "off" to be dangerous
|
||||
customError.getAttributeValue("mode").toLowerCase() = "off" and
|
||||
// There must not be an error handler in global.asax
|
||||
not exists(Application_Error ae)
|
||||
|
||||
@@ -48,12 +48,9 @@ where
|
||||
// The method is not protected by a validate anti forgery token attribute
|
||||
not postMethod.getAnAttribute() instanceof ValidateAntiForgeryTokenAttribute and
|
||||
not c.getAnAttribute() instanceof ValidateAntiForgeryTokenAttribute and
|
||||
/*
|
||||
* Verify that validate anti forgery token attributes are used somewhere within this project, to
|
||||
* avoid reporting false positives on projects that use an alternative approach to mitigate CSRF
|
||||
* issues.
|
||||
*/
|
||||
|
||||
// Verify that validate anti forgery token attributes are used somewhere within this project, to
|
||||
// avoid reporting false positives on projects that use an alternative approach to mitigate CSRF
|
||||
// issues.
|
||||
exists(ValidateAntiForgeryTokenAttribute a, Element e | e = a.getTarget()) and
|
||||
// Also ignore cases where a global anti forgery filter is in use.
|
||||
not hasGlobalAntiForgeryFilter()
|
||||
|
||||
Reference in New Issue
Block a user