Files
codeql/csharp/ql/test/library-tests/security/dataflow/flowsources/StoredFlowSources.expected
Tom Hvitved 5ce9b25ec9 C#: Improve CFG for assignments
Write accesses in assignments, such as the access to `x` in `x = 0` are not
evaluated, so they should not have entries in the control flow graph. However,
qualifiers (and indexer arguments) should still be evaluated, for example in

```
x.Foo.Bar = 0;
```

the CFG should be `x --> x.Foo --> 0 --> x.Foo.Bar = 0` (as opposed to
`x --> x.Foo --> x.Foo.Bar --> 0 --> x.Foo.Bar = 0`, prior to this change).

A special case is assignments via acessors (properties, indexers, and event
adders), where we do want to include the access in the control flow graph,
as it represents the accessor call:

```
x.Prop = 0;
```

But instead of `x --> x.set_Prop --> 0 --> x.Prop = 0` the CFG should be
`x --> 0 --> x.set_Prop --> x.Prop = 0`, as the setter is called *after* the
assigned value has been evaluated.

An even more special case is tuple assignments via accessors:

```
(x.Prop1, y.Prop2) = (0, 1);
```

Here the CFG should be
`x --> y --> 0 --> 1 --> x.set_Prop1 --> y.set_Prop2 --> (x.Prop1, y.Prop2) = (0, 1)`.
2019-02-16 19:19:24 +01:00

22 lines
1.1 KiB
Plaintext

| data.cs:22:29:22:76 | OleDbDataReader customerReader = ... |
| data.cs:22:46:22:76 | call to method ExecuteReader |
| data.cs:25:20:25:33 | access to local variable customerReader |
| data.cs:25:20:25:40 | call to method Read |
| data.cs:28:35:28:77 | ... + ... |
| data.cs:28:51:28:64 | access to local variable customerReader |
| data.cs:28:51:28:77 | call to method GetString |
| data.cs:29:35:29:71 | ... + ... |
| data.cs:29:51:29:64 | access to local variable customerReader |
| data.cs:29:51:29:71 | access to indexer |
| data.cs:31:13:31:26 | access to local variable customerReader |
| data.cs:31:13:31:34 | call to method Close |
| entity.cs:32:29:32:82 | DbRawSqlQuery<Blog> blogs = ... |
| entity.cs:32:37:32:82 | call to method SqlQuery |
| entity.cs:33:30:33:34 | access to local variable blogs |
| entity.cs:36:31:36:34 | access to local variable blog |
| entity.cs:36:31:36:39 | access to property Name |
| entity.cs:39:31:39:93 | DbRawSqlQuery<String> blogNames = ... |
| entity.cs:39:43:39:93 | call to method SqlQuery |
| entity.cs:40:34:40:42 | access to local variable blogNames |
| entity.cs:43:31:43:38 | access to local variable blogName |