Apply changes from code review

edvraa · edvraa · commit 40e8a900de19 · 2021-07-12T02:08:23.000+03:00
diff --git a/csharp/ql/src/experimental/dataflow/flowsources/AuthCookie.qll b/csharp/ql/src/experimental/dataflow/flowsources/AuthCookie.qll
@@ -104,23 +104,9 @@ Expr getAValueForProp(ObjectCreation create, Assignment a, string prop) {
 }
 
 /**
- * Similar to getAValueForProp, checks if the given property was explicitly set to a value.
+ * Checks if the given property was explicitly set to a value.
  */
-predicate isPropertySet(ObjectCreation oc, string prop) {
-  exists(Assignment a, PropertyAccess pa |
-    a.getLValue() = pa and
-    pa.getTarget().hasName(prop) and
-    DataFlow::localExprFlow(oc, pa.getQualifier())
-  )
-  or
-  exists(Assignment a, PropertyAccess pa, Expr src |
-    a.getLValue() = pa and
-    pa.getTarget().hasName(prop) and
-    a.getRValue() = src and
-    DataFlow::localExprFlow(src,
-      oc.getInitializer().(ObjectInitializer).getAMemberInitializer().getRValue())
-  )
-}
+predicate isPropertySet(ObjectCreation oc, string prop) { exists(getAValueForProp(oc, _, prop)) }
 
 /**
  * Tracks if a callback used in `OnAppendCookie` sets `Secure` to `true`.
@@ -143,7 +129,7 @@ class OnAppendCookieHttpOnlyTrackingConfig extends OnAppendCookieTrackingConfig
 /**
  * Tracks if a callback used in `OnAppendCookie` sets a cookie property to `true`.
  */
-private abstract class OnAppendCookieTrackingConfig extends DataFlow::Configuration {
+abstract private class OnAppendCookieTrackingConfig extends DataFlow::Configuration {
   bindingset[this]
   OnAppendCookieTrackingConfig() { any() }
 
@@ -186,6 +172,10 @@ private abstract class OnAppendCookieTrackingConfig extends DataFlow::Configurat
   }
 
   override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    node2.asExpr() = any(PropertyRead other | other.getQualifier() = node1.asExpr())
+    node2.asExpr() =
+      any(PropertyRead pr |
+        pr.getQualifier() = node1.asExpr() and
+        pr.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreCookiePolicyAppendCookieContext
+      )
   }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll b/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll
@@ -319,6 +319,13 @@ class MicrosoftAspNetCoreBuilderCookiePolicyOptions extends RefType {
   }
 }
 
+/** The `Microsoft.AspNetCore.CookiePolicy.AppendCookieContext` class. */
+class MicrosoftAspNetCoreCookiePolicyAppendCookieContext extends RefType {
+  MicrosoftAspNetCoreCookiePolicyAppendCookieContext() {
+    this.hasQualifiedName("Microsoft.AspNetCore.CookiePolicy", "AppendCookieContext")
+  }
+}
+
 /** The `Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions` class. */
 class MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions extends RefType {
   MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions() {

Original file line number	Diff line number	Diff line change
`@@ -319,6 +319,13 @@ class MicrosoftAspNetCoreBuilderCookiePolicyOptions extends RefType {`
`319`	`319`	`}`
`320`	`320`	`}`
`321`	`321`
	`322`	+/** The `Microsoft.AspNetCore.CookiePolicy.AppendCookieContext` class. */
	`323`	`+class MicrosoftAspNetCoreCookiePolicyAppendCookieContext extends RefType {`
	`324`	`+ MicrosoftAspNetCoreCookiePolicyAppendCookieContext() {`
	`325`	`+ this.hasQualifiedName("Microsoft.AspNetCore.CookiePolicy", "AppendCookieContext")`
	`326`	`+ }`
	`327`	`+}`
	`328`	`+`
`322`	`329`	/** The `Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions` class. */
`323`	`330`	`class MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions extends RefType {`
`324`	`331`	`MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions() {`