Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 327cf44

Browse files
michaelnebelmichaelnebel
committed
C#: Convert Newtonsoft.JSon.Linq.JObject and Newtonsoft.JSon.Linq.JToken flow to CSV format.
1 parent f3c0ead commit 327cf44

4 files changed

Lines changed: 26 additions & 37 deletions

File tree

‎csharp/ql/lib/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ private import semmle.code.csharp.dataflow.internal.DataFlowPublic
2121
private import semmle.code.csharp.dataflow.internal.DelegateDataFlow
2222
// import `LibraryTypeDataFlow` definitions from other files to avoid potential reevaluation
2323
private import semmle.code.csharp.frameworks.EntityFramework
24-
private import semmle.code.csharp.frameworks.JsonNET
2524
private import FlowSummary
2625

2726
private newtype TAccessPath =

‎csharp/ql/lib/semmle/code/csharp/frameworks/JsonNET.qll‎

Lines changed: 26 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
*/
44

55
import csharp
6-
private import semmle.code.csharp.dataflow.LibraryTypeDataFlow
76
private import semmle.code.csharp.dataflow.ExternalFlow
87

98
/** Definitions relating to the `Json.NET` package. */
@@ -224,46 +223,39 @@ module JsonNET {
224223
LinqClass() { this.getDeclaringNamespace() instanceof LinqNamespace }
225224
}
226225

226+
/** Data flow for `Newtonsoft.Json.Linq.JToken`. */
227+
private class JTokenClassFlowModelCsv extends SummaryModelCsv {
228+
override predicate row(string row) {
229+
row =
230+
[
231+
"Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String);;Argument[-1];ReturnValue;taint",
232+
"Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,Newtonsoft.Json.Linq.JsonSelectSettings);;Argument[-1];ReturnValue;taint",
233+
"Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,System.Boolean);;Argument[-1];ReturnValue;taint",
234+
"Newtonsoft.Json.Linq;JToken;false;ToString;();;Argument[-1];ReturnValue;taint",
235+
"Newtonsoft.Json.Linq;JToken;false;ToString;(Newtonsoft.Json.Formatting,Newtonsoft.Json.JsonConverter[]);;Argument[-1];ReturnValue;taint",
236+
]
237+
}
238+
}
239+
227240
/** The `NewtonSoft.Json.Linq.JObject` class. */
228-
class JObjectClass extends LinqClass, LibraryTypeDataFlow {
241+
class JObjectClass extends LinqClass {
229242
JObjectClass() { this.hasName("JObject") }
230243

231-
override predicate callableFlow(
232-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
233-
boolean preservesValue
234-
) {
235-
// ToString method
236-
c = this.getBaseClass().getBaseClass().getAMethod("ToString") and
237-
source instanceof CallableFlowSourceQualifier and
238-
sink instanceof CallableFlowSinkReturn and
239-
preservesValue = false
240-
or
241-
// Parse method
242-
c = this.getParseMethod() and
243-
source = any(CallableFlowSourceArg arg | arg.getArgumentIndex() = 0) and
244-
sink instanceof CallableFlowSinkReturn and
245-
preservesValue = false
246-
or
247-
// operator string
248-
c =
249-
any(Operator op |
250-
op.getDeclaringType() = this.getABaseType*() and op.getReturnType() instanceof StringType
251-
) and
252-
source.(CallableFlowSourceArg).getArgumentIndex() = 0 and
253-
sink instanceof CallableFlowSinkReturn and
254-
preservesValue = false
255-
or
256-
// SelectToken method
257-
c = this.getSelectTokenMethod() and
258-
source instanceof CallableFlowSourceQualifier and
259-
sink instanceof CallableFlowSinkReturn and
260-
preservesValue = false
261-
}
262-
263244
/** Gets the `Parse` method. */
264245
Method getParseMethod() { result = this.getAMethod("Parse") }
265246

266247
/** Gets the `SelectToken` method. */
267248
Method getSelectTokenMethod() { result = this.getABaseType*().getAMethod("SelectToken") }
268249
}
250+
251+
/** Data flow for `NewtonSoft.Json.Linq.JObject`. */
252+
private class JObjectClassFlowModelCsv extends SummaryModelCsv {
253+
override predicate row(string row) {
254+
row =
255+
[
256+
"Newtonsoft.Json.Linq;JObject;false;Parse;(System.String);;Argument[0];ReturnValue;taint",
257+
"Newtonsoft.Json.Linq;JObject;false;Parse;(System.String,Newtonsoft.Json.Linq.JsonLoadSettings);;Argument[0];ReturnValue;taint"
258+
]
259+
}
260+
}
269261
}

‎csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,6 @@
5858
| Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,System.Boolean);;Argument[-1];ReturnValue;taint |
5959
| Newtonsoft.Json.Linq;JToken;false;ToString;();;Argument[-1];ReturnValue;taint |
6060
| Newtonsoft.Json.Linq;JToken;false;ToString;(Newtonsoft.Json.Formatting,Newtonsoft.Json.JsonConverter[]);;Argument[-1];ReturnValue;taint |
61-
| Newtonsoft.Json.Linq;JToken;false;explicit conversion;(Newtonsoft.Json.Linq.JToken);;Argument[0];ReturnValue;taint |
6261
| Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T);;Argument[0];ReturnValue;taint |
6362
| Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint |
6463
| Newtonsoft.Json;JsonConvert;false;DeserializeObject;(System.String);;Argument[0];ReturnValue;taint |

‎csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@
5151
| Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,System.Boolean);;Argument[-1];ReturnValue;taint |
5252
| Newtonsoft.Json.Linq;JToken;false;ToString;();;Argument[-1];ReturnValue;taint |
5353
| Newtonsoft.Json.Linq;JToken;false;ToString;(Newtonsoft.Json.Formatting,Newtonsoft.Json.JsonConverter[]);;Argument[-1];ReturnValue;taint |
54-
| Newtonsoft.Json.Linq;JToken;false;explicit conversion;(Newtonsoft.Json.Linq.JToken);;Argument[0];ReturnValue;taint |
5554
| Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T);;Argument[0];ReturnValue;taint |
5655
| Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint |
5756
| Newtonsoft.Json;JsonConvert;false;DeserializeObject;(System.String);;Argument[0];ReturnValue;taint |

0 commit comments

Comments
 (0)