Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 49e7add

Browse files
geoffw0geoffw0
committed
C#: Autoformat.
1 parent 31dd3ca commit 49e7add

5 files changed

Lines changed: 78 additions & 71 deletions

File tree

‎csharp/ql/src/Security Features/CWE-020/RuntimeChecksBypass.ql‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,25 @@
88
* @tags security
99
* external/cwe/cwe-20
1010
*/
11+
1112
import semmle.code.csharp.security.serialization.Serialization
1213

13-
/** The result is a write to the field `f`, assigning it the value
14+
/**
15+
* The result is a write to the field `f`, assigning it the value
1416
* of variable `v` which was checked by the condition `check`.
1517
*/
1618
Expr checkedWrite(Field f, Variable v, IfStmt check) {
17-
result = v.getAnAccess() and
18-
result = f.getAnAssignedValue() and
19-
check.getCondition() = v.getAnAccess().getParent*() and
20-
result.getAControlFlowNode() = check.getAControlFlowNode().getASuccessor*()
19+
result = v.getAnAccess() and
20+
result = f.getAnAssignedValue() and
21+
check.getCondition() = v.getAnAccess().getParent*() and
22+
result.getAControlFlowNode() = check.getAControlFlowNode().getASuccessor*()
2123
}
24+
2225
from BinarySerializableType t, Field f, IfStmt check, Expr write, Expr unsafeWrite
23-
where f = t.getASerializedField()
24-
and write = checkedWrite(f, t.getAConstructor().getAParameter(), check)
25-
and unsafeWrite = f.getAnAssignedValue()
26-
and t.getADeserializationCallback() = unsafeWrite.getEnclosingCallable()
27-
and not t.getADeserializationCallback().calls*(checkedWrite(f, _, _).getEnclosingCallable())
28-
select unsafeWrite, "This write to $@ may be circumventing a $@.",
29-
f, f.toString(),
30-
check, "check"
26+
where
27+
f = t.getASerializedField() and
28+
write = checkedWrite(f, t.getAConstructor().getAParameter(), check) and
29+
unsafeWrite = f.getAnAssignedValue() and
30+
t.getADeserializationCallback() = unsafeWrite.getEnclosingCallable() and
31+
not t.getADeserializationCallback().calls*(checkedWrite(f, _, _).getEnclosingCallable())
32+
select unsafeWrite, "This write to $@ may be circumventing a $@.", f, f.toString(), check, "check"

‎csharp/ql/src/Security Features/CWE-091/XMLInjection.ql‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
* @tags security
1010
* external/cwe/cwe-091
1111
*/
12+
1213
import csharp
1314
import semmle.code.csharp.dataflow.flowsources.Remote
1415
import semmle.code.csharp.frameworks.system.Xml
@@ -17,34 +18,33 @@ import semmle.code.csharp.frameworks.system.Xml
1718
* A taint-tracking configuration for untrusted user input used in XML.
1819
*/
1920
class TaintTrackingConfiguration extends TaintTracking::Configuration {
20-
TaintTrackingConfiguration() {
21-
this = "XMLInjection"
22-
}
21+
TaintTrackingConfiguration() { this = "XMLInjection" }
2322

24-
override
25-
predicate isSource(DataFlow::Node source) {
26-
source instanceof RemoteFlowSource
27-
}
23+
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
2824

29-
override
30-
predicate isSink(DataFlow::Node sink) {
25+
override predicate isSink(DataFlow::Node sink) {
3126
exists(MethodCall mc |
3227
mc.getTarget().hasName("WriteRaw") and
33-
mc.getTarget().getDeclaringType().getABaseType*().hasQualifiedName("System.Xml.XmlWriter") |
28+
mc.getTarget().getDeclaringType().getABaseType*().hasQualifiedName("System.Xml.XmlWriter")
29+
|
3430
mc.getArgument(0) = sink.asExpr()
3531
)
3632
}
3733

38-
override
39-
predicate isSanitizer(DataFlow::Node node) {
34+
override predicate isSanitizer(DataFlow::Node node) {
4035
exists(MethodCall mc |
4136
mc.getTarget().hasName("Escape") and
42-
mc.getTarget().getDeclaringType().getABaseType*().hasQualifiedName("System.Security.SecurityElement") |
37+
mc
38+
.getTarget()
39+
.getDeclaringType()
40+
.getABaseType*()
41+
.hasQualifiedName("System.Security.SecurityElement")
42+
|
4343
mc = node.asExpr()
4444
)
4545
}
4646
}
4747

4848
from TaintTrackingConfiguration c, DataFlow::Node source, DataFlow::Node sink
4949
where c.hasFlow(source, sink)
50-
select sink, "$@ flows to here and is inserted as XML.", source, "User-provided value"
50+
select sink, "$@ flows to here and is inserted as XML.", source, "User-provided value"

‎csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
* @tags security
1111
* external/cwe/cwe-114
1212
*/
13+
1314
import csharp
1415
import semmle.code.csharp.dataflow.flowsources.Remote
1516

@@ -18,41 +19,45 @@ class MainMethod extends Method {
1819
this.hasName("Main") and
1920
this.isStatic() and
2021
(this.getReturnType() instanceof VoidType or this.getReturnType() instanceof IntType) and
21-
if this.getNumberOfParameters() = 1 then
22-
this.getParameter(0).getType().(ArrayType).getElementType() instanceof StringType
23-
else
24-
this.getNumberOfParameters() = 0
22+
if this.getNumberOfParameters() = 1
23+
then this.getParameter(0).getType().(ArrayType).getElementType() instanceof StringType
24+
else this.getNumberOfParameters() = 0
2525
}
2626
}
2727

2828
/**
2929
* A taint-tracking configuration for untrusted user input used to load a DLL.
3030
*/
3131
class TaintTrackingConfiguration extends TaintTracking::Configuration {
32-
TaintTrackingConfiguration() {
33-
this = "DLLInjection"
34-
}
32+
TaintTrackingConfiguration() { this = "DLLInjection" }
3533

36-
override
37-
predicate isSource(DataFlow::Node source) {
34+
override predicate isSource(DataFlow::Node source) {
3835
source instanceof RemoteFlowSource or
3936
source.asExpr() = any(MainMethod main).getParameter(0).getAnAccess()
4037
}
4138

42-
override
43-
predicate isSink(DataFlow::Node sink) {
39+
override predicate isSink(DataFlow::Node sink) {
4440
exists(MethodCall mc, string name, int arg |
4541
mc.getTarget().getName().matches(name) and
46-
mc.getTarget().getDeclaringType().getABaseType*().hasQualifiedName("System.Reflection.Assembly") and
47-
mc.getArgument(arg) = sink.asExpr() |
48-
name = "LoadFrom" and arg = 0 and mc.getNumberOfArguments() = [1..2] or
49-
name = "LoadFile" and arg = 0 or
50-
name = "LoadWithPartialName" and arg = 0 or
42+
mc
43+
.getTarget()
44+
.getDeclaringType()
45+
.getABaseType*()
46+
.hasQualifiedName("System.Reflection.Assembly") and
47+
mc.getArgument(arg) = sink.asExpr()
48+
|
49+
name = "LoadFrom" and arg = 0 and mc.getNumberOfArguments() = [1 .. 2]
50+
or
51+
name = "LoadFile" and arg = 0
52+
or
53+
name = "LoadWithPartialName" and arg = 0
54+
or
5155
name = "UnsafeLoadFrom" and arg = 0
5256
)
5357
}
5458
}
5559

5660
from TaintTrackingConfiguration c, DataFlow::Node source, DataFlow::Node sink
5761
where c.hasFlow(source, sink)
58-
select sink, "$@ flows to here and is used as the path to dynamically load an assembly.", source, "User-provided value"
62+
select sink, "$@ flows to here and is used as the path to dynamically load an assembly.", source,
63+
"User-provided value"

‎csharp/ql/src/Security Features/CWE-321/HardcodedEncryptionKey.ql‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,22 @@ import semmle.code.csharp.security.cryptography.EncryptionKeyDataFlow::Encryptio
1515
* The creation of a literal byte array.
1616
*/
1717
class ByteArrayLiteralSource extends KeySource {
18-
ByteArrayLiteralSource() {
18+
ByteArrayLiteralSource() {
1919
this.asExpr() = any(ArrayCreation ac |
20-
ac.getArrayType().getElementType() instanceof ByteType and
21-
ac.hasInitializer())
20+
ac.getArrayType().getElementType() instanceof ByteType and
21+
ac.hasInitializer()
22+
)
2223
}
2324
}
2425

2526
/**
2627
* Any string literal as a source
2728
*/
2829
class StringLiteralSource extends KeySource {
29-
StringLiteralSource() {
30-
this.asExpr() instanceof StringLiteral
31-
}
30+
StringLiteralSource() { this.asExpr() instanceof StringLiteral }
3231
}
3332

3433
from SymmetricKeyTaintTrackingConfiguration keyFlow, KeySource src, SymmetricEncryptionKeySink sink
3534
where keyFlow.hasFlow(src, sink)
36-
select sink, "Hard-coded symmetric $@ is used in symmetric algorithm in " + sink.getDescription(), src, "key"
37-
35+
select sink, "Hard-coded symmetric $@ is used in symmetric algorithm in " + sink.getDescription(),
36+
src, "key"

‎csharp/ql/src/semmle/code/csharp/serialization/Serialization.qll‎

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ abstract class SerializableType extends ValueOrRefType {
1818
* deserialization mechanism.
1919
*/
2020
abstract Callable getADeserializationCallback();
21-
21+
2222
/**
2323
* A field whose value is restored during a deserialization, rendering it
2424
* potentially untrusted.
2525
*/
2626
abstract Field getASerializedField();
27-
27+
2828
/**
2929
* Get a callback that is automatically executed (without user code
3030
* interaction) when an object instance is deserialized. This includes
@@ -33,12 +33,15 @@ abstract class SerializableType extends ValueOrRefType {
3333
Callable getAnAutomaticCallback() {
3434
result = this.getADeserializationCallback() or
3535
result.(Destructor).getDeclaringType() = this or
36-
result = any(Method m | m.getDeclaringType() = this and
37-
m.hasName("Dispose") and (
38-
m.getNumberOfParameters() = 0 or
39-
m.getNumberOfParameters() = 1 and m.getParameter(0).getType() instanceof BoolType
36+
result = any(Method m |
37+
m.getDeclaringType() = this and
38+
m.hasName("Dispose") and
39+
(
40+
m.getNumberOfParameters() = 0
41+
or
42+
m.getNumberOfParameters() = 1 and m.getParameter(0).getType() instanceof BoolType
43+
)
4044
)
41-
)
4245
}
4346
}
4447

@@ -47,24 +50,24 @@ abstract class SerializableType extends ValueOrRefType {
4750
* attribute.
4851
*/
4952
class BinarySerializableType extends SerializableType {
50-
BinarySerializableType() {
51-
this.getAnAttribute().getType().hasName("SerializableAttribute")
52-
}
53-
53+
BinarySerializableType() { this.getAnAttribute().getType().hasName("SerializableAttribute") }
54+
5455
/**
5556
* In addition to the defaults, a `BinarySerializer` will call any method annotated
5657
* with an `OnDeserialized` or `OnDeserializing` attribute, as well as an
5758
* `OnDeserialization` method.
5859
*/
5960
override Callable getADeserializationCallback() {
60-
result.(SerializationConstructor).getDeclaringType() = this or
61-
result = this.getAMethod() and (
61+
result.(SerializationConstructor).getDeclaringType() = this
62+
or
63+
result = this.getAMethod() and
64+
(
6265
result.(Attributable).getAnAttribute().getType().hasName("OnDeserializedAttribute") or
6366
result.(Attributable).getAnAttribute().getType().hasName("OnDeserializingAttribute") or
6467
result.hasName("OnDeserialization")
6568
)
6669
}
67-
70+
6871
override Field getASerializedField() {
6972
result.getDeclaringType() = this and
7073
not result.getAnAttribute().getType().hasName("NonSerializedAttribute") and
@@ -77,10 +80,8 @@ class BinarySerializableType extends SerializableType {
7780
* then it is serialized and deserialized in a special way.
7881
*/
7982
class CustomBinarySerializableType extends BinarySerializableType {
80-
CustomBinarySerializableType() {
81-
this.getABaseType*().hasName("ISerializable")
82-
}
83-
83+
CustomBinarySerializableType() { this.getABaseType*().hasName("ISerializable") }
84+
8485
/**
8586
* For custom deserialization, the `BinarySerializer` will call the serialization constructor.
8687
*/
@@ -101,4 +102,4 @@ class DangerousCallable extends Callable {
101102
//assembly
102103
this.(Method).getQualifiedName().matches("System.Reflection.Assembly.%Load%")
103104
}
104-
}
105+
}

0 commit comments

Comments
 (0)