hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 05:05:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: New query for cs/uncontrolled-string-format

Browse Source
This commit is contained in:
calum
2018-11-20 18:05:14 +00:00
parent 201f64ef8e
commit fb09360ad6
4 changed files with 68 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql Normal file
View File

@@ -0,0 +1,36 @@
/**
* @name Uncontrolled format string
* @description
* @kind path-problem
* @problem.severity error
* @precision high
* @id cs/uncontrolled-format-string
* @tags security
* external/cwe/cwe-134
*/
import csharp
import semmle.code.csharp.dataflow.flowsources.Remote
import semmle.code.csharp.dataflow.TaintTracking
import semmle.code.csharp.frameworks.System
import DataFlow::PathGraph
class FormatStringConfiguration extends TaintTracking::Configuration
{
FormatStringConfiguration() { this = "FormatStringConfiguration" }
override predicate isSource(DataFlow::Node source) {
source instanceof RemoteFlowSource
}
override predicate isSink(DataFlow::Node sink) {
exists(MethodCall call | sink.asExpr() = call.getArgumentForName("format") and
call.getTarget() = any(SystemStringClass s).getFormatMethod()
)
}
}
from FormatStringConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink.getNode(), source, sink,
"$@ flows to here and is used to format 'String.Format'.", source.getNode(), source.getNode().toString()

25
csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.cs Normal file
View File

@@ -0,0 +1,25 @@
// semmle-extractor-options: /r:System.Runtime.Extensions.dll /r:System.Collections.Specialized.dll ${testdir}/../../../resources/stubs/System.Web.cs
using System;
using System.IO;
using System.Web;
public class TaintedPathHandler : IHttpHandler
{
public void ProcessRequest(HttpContext ctx)
{
String path = ctx.Request.QueryString["page"];
// BAD: Uncontrolled format string.
String.Format(path, "Do not do this");
// BAD: Using an IFormatProvider.
String.Format((IFormatProvider)null, path, "Do not do this");
// GOOD: Not the format string.
String.Format("Do not do this", path);
// GOOD: Not the format string.
String.Format((IFormatProvider)null, "Do not do this", path);
}
}

6
csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.expected Normal file
View File

@@ -0,0 +1,6 @@
edges
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path |
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path |
#select
| UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | $@ flows to here and is used to format 'String.Format'. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |
| UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | $@ flows to here and is used to format 'String.Format'. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |

1
csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.qlref Normal file
View File

@@ -0,0 +1 @@
Security Features/CWE-134/UncontrolledFormatString.ql