Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 1bfa4d5

Browse files
calumgrantcalumgrant
committed
C#: Documentation for cs/uncontrolled-format-string
1 parent fb09360 commit 1bfa4d5

5 files changed

Lines changed: 76 additions & 1 deletion

File tree

‎csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.qhelp‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>
7+
Passing untrusted format strings to <code>String.Format</code> can throw exceptions
8+
and cause a denial of service. For example, if the format string references a missing argument,
9+
or an argument of the wrong type, then <code>System.FormatException</code> is thrown.
10+
</p>
11+
12+
</overview>
13+
<recommendation>
14+
15+
<p>Use a string literal for the format string, to prevent the possibility of data-flow from
16+
an untrusted source. This also helps to prevent errors where the arguments to
17+
<code>String.Format</code> do not match the format string.</p>
18+
19+
<p>If the format string cannot be fixed, then ensure that it comes from a secure
20+
data source or is compiled into the source code.</p>
21+
22+
</recommendation>
23+
<example>
24+
25+
<p>In this example, the format string is read from an HTTP request, which could cause
26+
the application to crash.</p>
27+
28+
<sample src="UncontrolledFormatStringBad.cs" />
29+
30+
</example>
31+
<references>
32+
33+
<li>
34+
OWASP:
35+
<a href="https://www.owasp.org/index.php/Format_string_attack">format string attack</a>.
36+
</li>
37+
38+
<li>
39+
Microsoft docs:
40+
<a href="https://docs.microsoft.com/en-us/dotnet/api/system.string.format">String.Format Method</a>
41+
</li>
42+
43+
</references>
44+
</qhelp>

‎csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
/**
22
* @name Uncontrolled format string
3-
* @description
3+
* @description Passing untrusted format strings from remote data sources can throw exceptions
4+
* and cause a denial of service.
45
* @kind path-problem
56
* @problem.severity error
67
* @precision high

‎csharp/ql/src/Security Features/CWE-134/UncontrolledFormatStringBad.cs‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
using System.Web;
2+
3+
public class HttpHandler : IHttpHandler
4+
{
5+
string Surname, Forenames, FormattedName;
6+
7+
public void ProcessRequest(HttpContext ctx)
8+
{
9+
string format = ctx.Request.QueryString["nameformat"];
10+
11+
// BAD: Uncontrolled format string.
12+
FormattedName = string.Format(format, Surname, Forenames);
13+
}
14+
}

‎csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
edges
22
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path |
33
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path |
4+
| UncontrolledFormatStringBad.cs:9:25:9:47 | access to property QueryString | UncontrolledFormatStringBad.cs:12:39:12:44 | access to local variable format |
45
#select
56
| UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | $@ flows to here and is used to format 'String.Format'. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |
67
| UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | $@ flows to here and is used to format 'String.Format'. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |
8+
| UncontrolledFormatStringBad.cs:12:39:12:44 | access to local variable format | UncontrolledFormatStringBad.cs:9:25:9:47 | access to property QueryString | UncontrolledFormatStringBad.cs:12:39:12:44 | access to local variable format | $@ flows to here and is used to format 'String.Format'. | UncontrolledFormatStringBad.cs:9:25:9:47 | access to property QueryString | access to property QueryString |

‎csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatStringBad.cs‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
using System.Web;
2+
3+
public class HttpHandler : IHttpHandler
4+
{
5+
string Surname, Forenames, FormattedName;
6+
7+
public void ProcessRequest(HttpContext ctx)
8+
{
9+
string format = ctx.Request.QueryString["nameformat"];
10+
11+
// BAD: Uncontrolled format string.
12+
FormattedName = string.Format(format, Surname, Forenames);
13+
}
14+
}

0 commit comments

Comments
 (0)