C#: Fix XmlReaderSettingsCreation logic

hvitved · hvitved · commit 06a2bcc2448c · 2018-11-08T09:20:21.000+01:00
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Xml.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Xml.qll
@@ -138,6 +138,10 @@ class SystemXmlSchemaXmlSchemaValidationFlags extends EnumConstant {
   }
 }
 
+private Expr getBitwiseOrOperand(Expr e) {
+  result = e.(BitwiseOrExpr).getAnOperand()
+}
+
 /** A creation of an instance of `System.Xml.XmlReaderSettings`. */
 class XmlReaderSettingsCreation extends ObjectCreation {
   XmlReaderSettingsCreation() {
@@ -157,10 +161,11 @@ class XmlReaderSettingsCreation extends ObjectCreation {
   /** Gets a value set for the given property in this local context. */
   private Expr getPropertyValue(Property p) {
     p = this.getType().(RefType).getAProperty() and
-    exists(PropertyCall set |
+    exists(PropertyCall set, Expr arg |
       set.getTarget() = p.getSetter() and
       DataFlow::localFlow(DataFlow::exprNode(this), DataFlow::exprNode(set.getQualifier())) and
-      result = set.getAnArgument()
+      arg = set.getAnArgument() and
+      result = getBitwiseOrOperand*(arg)
     )
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -138,6 +138,10 @@ class SystemXmlSchemaXmlSchemaValidationFlags extends EnumConstant {`
`138`	`138`	`}`
`139`	`139`	`}`
`140`	`140`
	`141`	`+private Expr getBitwiseOrOperand(Expr e) {`
	`142`	`+ result = e.(BitwiseOrExpr).getAnOperand()`
	`143`	`+}`
	`144`	`+`
`141`	`145`	/** A creation of an instance of `System.Xml.XmlReaderSettings`. */
`142`	`146`	`class XmlReaderSettingsCreation extends ObjectCreation {`
`143`	`147`	`XmlReaderSettingsCreation() {`
`@@ -157,10 +161,11 @@ class XmlReaderSettingsCreation extends ObjectCreation {`
`157`	`161`	`/** Gets a value set for the given property in this local context. */`
`158`	`162`	`private Expr getPropertyValue(Property p) {`
`159`	`163`	`p = this.getType().(RefType).getAProperty() and`
`160`		`- exists(PropertyCall set \|`
	`164`	`+ exists(PropertyCall set, Expr arg \|`
`161`	`165`	`set.getTarget() = p.getSetter() and`
`162`	`166`	`DataFlow::localFlow(DataFlow::exprNode(this), DataFlow::exprNode(set.getQualifier())) and`
`163`		`- result = set.getAnArgument()`
	`167`	`+ arg = set.getAnArgument() and`
	`168`	`+ result = getBitwiseOrOperand*(arg)`
`164`	`169`	`)`
`165`	`170`	`}`
`166`	`171`	`}`