Luke Cartey 43d7e598a5 C#: Treat GetFileName method call as sanitizer ...

Use the GetFileName call as a sanitizer, rather than an argument to that
call. It is the _result_ of the GetFileName call which should be
considered sanitized. By using the argument, we can spuriously suppress
use-use flow. Consider:
```
var path = Path.Combine(destDir, entry.GetFullName());
var fileName = Path.GetFileName(path);
log("Extracting " + fileName);
entry.ExtractToFile(path);
```
Previously, the `ExtractToFile(path)` call would not have been flagged,
because the `path` argument to `GetFileName` was considered sanitized,
and that argument formed a use-use pair with the `path` argument to
`ExtractToFile`. Now, this result would be flagged because only the
result of the `GetFileName` call is considered sanitized.

2018-08-24 12:08:57 +01:00

..

src

C#: Treat GetFileName method call as sanitizer

2018-08-24 12:08:57 +01:00

test

Merge pull request #81 from lukecartey/csharp/zipslip-reformat

2018-08-24 09:40:20 +02:00