Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2467016

Browse files
tamasvajktamasvajk
committed
Address code review findings
1 parent cd5c1f0 commit 2467016

4 files changed

Lines changed: 14 additions & 9 deletions

File tree

‎csharp/ql/src/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.ql‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010

1111
import csharp
1212
import semmle.code.csharp.security.dataflow.ExternalAPIs
13-
import semmle.code.csharp.dataflow.DataFlow
1413

1514
from ExternalAPIUsedWithUntrustedData externalAPI
1615
select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses,

‎csharp/ql/src/semmle/code/csharp/security/dataflow/ExternalAPIs.qll‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,17 @@ import csharp
77
import semmle.code.csharp.dataflow.flowsources.Remote
88
import semmle.code.csharp.dataflow.TaintTracking
99
import semmle.code.csharp.frameworks.System
10+
import semmle.code.csharp.dataflow.FlowSummary
1011

1112
/**
12-
* A `Callable` that is considered a "safe" external API from a security perspective.
13+
* A callable that is considered a "safe" external API from a security perspective.
1314
*/
1415
abstract class SafeExternalAPICallable extends Callable { }
1516

17+
private class SummarizedCallableSafe extends SafeExternalAPICallable {
18+
SummarizedCallableSafe() { this instanceof SummarizedCallable }
19+
}
20+
1621
/** The default set of "safe" external APIs. */
1722
private class DefaultSafeExternalAPICallable extends SafeExternalAPICallable {
1823
DefaultSafeExternalAPICallable() {
@@ -53,13 +58,11 @@ class ExternalAPIDataNode extends DataFlow::Node {
5358
m.overridesOrImplementsOrEquals(call.getTarget().getSourceDeclaration()) and
5459
m.fromSource()
5560
) and
56-
// Not already modeled as a taint step
57-
not exists(DataFlow::Node next | TaintTracking::localTaintStep(this, next)) and
5861
// Not a call to a known safe external API
5962
not call.getTarget().getSourceDeclaration() instanceof SafeExternalAPICallable
6063
}
6164

62-
/** Gets the called API `Callable`. */
65+
/** Gets the called API callable. */
6366
Callable getCallable() { result = call.getTarget().getSourceDeclaration() }
6467

6568
/** Gets the index which is passed untrusted data (where -1 indicates the qualifier). */
@@ -80,12 +83,12 @@ class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
8083

8184
/** A node representing untrusted data being passed to an external API. */
8285
class UntrustedExternalAPIDataNode extends ExternalAPIDataNode {
83-
UntrustedExternalAPIDataNode() { any(UntrustedDataToExternalAPIConfig c).hasFlow(_, this) }
86+
private UntrustedDataToExternalAPIConfig c;
87+
88+
UntrustedExternalAPIDataNode() { c.hasFlow(_, this) }
8489

8590
/** Gets a source of untrusted data which is passed to this external API data node. */
86-
DataFlow::Node getAnUntrustedSource() {
87-
any(UntrustedDataToExternalAPIConfig c).hasFlow(result, this)
88-
}
91+
DataFlow::Node getAnUntrustedSource() { c.hasFlow(result, this) }
8992
}
9093

9194
private newtype TExternalAPI =

‎csharp/ql/test/query-tests/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
1+
| System.Collections.Specialized.NameValueCollection.get_Item(string) [qualifier] | 1 | 1 |
12
| System.Web.HttpRequest.get_QueryString() [qualifier] | 1 | 1 |
23
| System.Web.HttpResponse.Write(string) [param 0] | 1 | 1 |

‎csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedDataToExternalAPI.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,10 @@ edges
22
| UntrustedData.cs:11:20:11:42 | access to property QueryString : NameValueCollection | UntrustedData.cs:12:28:12:31 | access to local variable name |
33
nodes
44
| UntrustedData.cs:11:20:11:30 | access to property Request | semmle.label | access to property Request |
5+
| UntrustedData.cs:11:20:11:42 | access to property QueryString | semmle.label | access to property QueryString |
56
| UntrustedData.cs:11:20:11:42 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
67
| UntrustedData.cs:12:28:12:31 | access to local variable name | semmle.label | access to local variable name |
78
#select
89
| UntrustedData.cs:11:20:11:30 | access to property Request | UntrustedData.cs:11:20:11:30 | access to property Request | UntrustedData.cs:11:20:11:30 | access to property Request | Call to System.Web.HttpRequest.get_QueryString with untrusted data from $@. | UntrustedData.cs:11:20:11:30 | access to property Request | access to property Request |
10+
| UntrustedData.cs:11:20:11:42 | access to property QueryString | UntrustedData.cs:11:20:11:42 | access to property QueryString | UntrustedData.cs:11:20:11:42 | access to property QueryString | Call to System.Collections.Specialized.NameValueCollection.get_Item with untrusted data from $@. | UntrustedData.cs:11:20:11:42 | access to property QueryString | access to property QueryString |
911
| UntrustedData.cs:12:28:12:31 | access to local variable name | UntrustedData.cs:11:20:11:42 | access to property QueryString : NameValueCollection | UntrustedData.cs:12:28:12:31 | access to local variable name | Call to System.Web.HttpResponse.Write with untrusted data from $@. | UntrustedData.cs:11:20:11:42 | access to property QueryString : NameValueCollection | access to property QueryString : NameValueCollection |

0 commit comments

Comments
 (0)