|
| 1 | +/** Provides classes and predicates related to handling APIs from external libraries. */ |
| 2 | + |
| 3 | +private import csharp |
| 4 | +private import semmle.code.csharp.dataflow.DataFlow |
| 5 | +private import semmle.code.csharp.dataflow.ExternalFlow |
| 6 | +private import semmle.code.csharp.dataflow.FlowSummary |
| 7 | +private import semmle.code.csharp.dataflow.internal.DataFlowPrivate |
| 8 | +private import semmle.code.csharp.dataflow.TaintTracking |
| 9 | +private import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate |
| 10 | +private import semmle.code.csharp.security.dataflow.flowsources.Remote |
| 11 | + |
| 12 | +/** |
| 13 | + * An external API from either the C# Standard Library or a 3rd party library. |
| 14 | + */ |
| 15 | +class ExternalAPI extends Callable { |
| 16 | + ExternalAPI() { this.fromLibrary() } |
| 17 | + |
| 18 | + /** Holds if this API is not worth supporting */ |
| 19 | + predicate isUninteresting() { this.isTestLibrary() or this.isParameterlessConstructor() } |
| 20 | + |
| 21 | + /** Holds if this API is is a constructor without parameters */ |
| 22 | + private predicate isParameterlessConstructor() { |
| 23 | + this instanceof Constructor and this.getNumberOfParameters() = 0 |
| 24 | + } |
| 25 | + |
| 26 | + /** Holds if this API is part of a common testing library or framework */ |
| 27 | + private predicate isTestLibrary() { this.getDeclaringType() instanceof TestLibrary } |
| 28 | + |
| 29 | + /** |
| 30 | + * Gets the unbound type, name and parameter types of this API. |
| 31 | + */ |
| 32 | + private string getSignature() { |
| 33 | + result = |
| 34 | + this.getDeclaringType().getUnboundDeclaration() + "." + this.getName() + "(" + |
| 35 | + this.parameterTypesToString() + ")" |
| 36 | + } |
| 37 | + |
| 38 | + /** |
| 39 | + * Gets the namespace of this API. |
| 40 | + */ |
| 41 | + private string getNamespace() { result = this.getDeclaringType().getNamespace().toString() } |
| 42 | + |
| 43 | + /** |
| 44 | + * Gets the assembly file name containing this API. |
| 45 | + */ |
| 46 | + private string getAssembly() { result = this.getFile().getBaseName() } |
| 47 | + |
| 48 | + /** |
| 49 | + * Gets the assembly file name and namespace of this API. |
| 50 | + */ |
| 51 | + string getInfoPrefix() { result = this.getAssembly() + "#" + this.getNamespace() } |
| 52 | + |
| 53 | + /** |
| 54 | + * Gets the assembly file name, namespace and signature of this API. |
| 55 | + */ |
| 56 | + string getInfo() { result = getInfoPrefix() + "#" + getSignature() } |
| 57 | + |
| 58 | + /** Gets a node that is an input to a call to this API. */ |
| 59 | + private DataFlow::Node getAnInput() { |
| 60 | + exists(Call call | call.getTarget().getUnboundDeclaration() = this | |
| 61 | + result.asExpr() = call.getAnArgument() |
| 62 | + ) |
| 63 | + or |
| 64 | + result.(ArgumentNode).getCall().getEnclosingCallable() = this |
| 65 | + } |
| 66 | + |
| 67 | + /** Gets a node that is an output from a call to this API. */ |
| 68 | + private DataFlow::Node getAnOutput() { |
| 69 | + exists(Call call | call.getTarget().getUnboundDeclaration() = this | result.asExpr() = call) |
| 70 | + or |
| 71 | + result.(PostUpdateNode).getPreUpdateNode().(ArgumentNode).getCall().getEnclosingCallable() = |
| 72 | + this |
| 73 | + } |
| 74 | + |
| 75 | + /** Holds if this API has a supported summary. */ |
| 76 | + private predicate hasSummary() { |
| 77 | + this.getUnboundDeclaration() = any(SummarizedCallable sc) or |
| 78 | + defaultAdditionalTaintStep(this.getAnInput(), _) |
| 79 | + } |
| 80 | + |
| 81 | + /** Holds if this API is a known source. */ |
| 82 | + predicate isSource() { |
| 83 | + this.getAnOutput() instanceof RemoteFlowSource or sourceNode(this.getAnOutput(), _) |
| 84 | + } |
| 85 | + |
| 86 | + /** Holds if this API is a known sink. */ |
| 87 | + predicate isSink() { sinkNode(this.getAnInput(), _) } |
| 88 | + |
| 89 | + /** Holds if this API is supported by existing CodeQL libraries, that is, it is either a recognized source or sink or has a flow summary. */ |
| 90 | + predicate isSupported() { this.hasSummary() or this.isSource() or this.isSink() } |
| 91 | +} |
| 92 | + |
| 93 | +private class TestLibrary extends RefType { |
| 94 | + TestLibrary() { |
| 95 | + this.getNamespace() |
| 96 | + .getName() |
| 97 | + .matches(["NUnit.Framework%", "Microsoft.VisualStudio.TestTools.UnitTesting%"]) |
| 98 | + } |
| 99 | +} |
0 commit comments