Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6749bbd

Browse files
hvitvedhvitved
committed
C#: Make use of extra data flow copies
1 parent 081ee99 commit 6749bbd

10 files changed

Lines changed: 16 additions & 66 deletions

File tree

‎csharp/ql/src/semmle/code/csharp/frameworks/Format.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
import csharp
66
private import semmle.code.csharp.frameworks.System
77
private import semmle.code.csharp.frameworks.system.Text
8+
private import semmle.code.csharp.dataflow.DataFlow2
89

910
/** A method that formats a string, for example `string.Format()`. */
1011
class FormatMethod extends Method {
@@ -175,7 +176,7 @@ class InvalidFormatString extends StringLiteral {
175176
private module FormatFlow {
176177
private import semmle.code.csharp.dataflow.DataFlow
177178

178-
private class FormatConfiguration extends DataFlow::Configuration {
179+
private class FormatConfiguration extends DataFlow2::Configuration {
179180
FormatConfiguration() { this = "format" }
180181

181182
override predicate isSource(DataFlow::Node n) { n.asExpr() instanceof StringLiteral }

‎csharp/ql/src/semmle/code/csharp/frameworks/system/Xml.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import csharp
44
private import semmle.code.csharp.frameworks.System
5+
private import semmle.code.csharp.dataflow.DataFlow2
56

67
/** The `System.Xml` namespace. */
78
class SystemXmlNamespace extends Namespace {
@@ -162,7 +163,7 @@ class XmlReaderSettingsCreation extends ObjectCreation {
162163
}
163164
}
164165

165-
private class SettingsDataFlowConfig extends DataFlow::Configuration {
166+
private class SettingsDataFlowConfig extends DataFlow2::Configuration {
166167
SettingsDataFlowConfig() { this = "SettingsDataFlowConfig" }
167168

168169
override predicate isSource(DataFlow::Node source) {

‎csharp/ql/src/semmle/code/csharp/security/dataflow/ReDoS.qll‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import csharp
77

88
module ReDoS {
9+
private import semmle.code.csharp.dataflow.DataFlow2
910
import semmle.code.csharp.dataflow.flowsources.Remote
1011
import semmle.code.csharp.frameworks.system.text.RegularExpressions
1112
import semmle.code.csharp.security.Sanitizers
@@ -33,23 +34,9 @@ module ReDoS {
3334

3435
override predicate isSource(DataFlow::Node source) { source instanceof Source }
3536

36-
override predicate isSink(DataFlow::Node sink) {
37-
sink instanceof Sink
38-
or
39-
// Unfortunately, we cannot add `ExponentialRegexSink` as
40-
// a sub class of `Sink`, as that results in bad aggregate
41-
// recursion. Therefore, we overestimate the sinks here
42-
// and make the restriction later by overriding
43-
// `hasFlowPath()` below.
44-
sink.asExpr() = any(RegexOperation ro).getInput()
45-
}
37+
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
4638

4739
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
48-
49-
override predicate hasFlowPath(DataFlow::PathNode source, DataFlow::PathNode sink) {
50-
super.hasFlowPath(source, sink) and
51-
(sink.getNode() instanceof Sink or sink.getNode() instanceof ExponentialRegexSink)
52-
}
5340
}
5441

5542
/** A source of remote user input. */
@@ -81,7 +68,7 @@ module ReDoS {
8168
* A data flow configuration for tracking exponential worst case time regular expression string
8269
* literals to the pattern argument of a regex.
8370
*/
84-
class ExponentialRegexDataflow extends DataFlow::Configuration {
71+
class ExponentialRegexDataflow extends DataFlow2::Configuration {
8572
ExponentialRegexDataflow() { this = "ExponentialRegex" }
8673

8774
override predicate isSource(DataFlow::Node s) { isExponentialRegex(s.asExpr()) }
@@ -93,7 +80,7 @@ module ReDoS {
9380
* An expression passed as the `input` to a call to a `Regex` method, where the regex appears to
9481
* have exponential behaviour.
9582
*/
96-
class ExponentialRegexSink extends DataFlow::ExprNode {
83+
class ExponentialRegexSink extends DataFlow::ExprNode, Sink {
9784
ExponentialRegexSink() {
9885
exists(ExponentialRegexDataflow regexDataflow, RegexOperation regexOperation |
9986
// Exponential regex flows to the pattern argument

‎csharp/ql/src/semmle/code/csharp/security/dataflow/XMLEntityInjection.qll‎

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -31,31 +31,15 @@ module XMLEntityInjection {
3131
}
3232

3333
class InsecureXMLSink extends Sink {
34-
InsecureXMLSink() {
35-
// Unfortunately, we cannot use
36-
// ```
37-
// exists(InsecureXML::InsecureXmlProcessing r | r.isUnsafe(reason) | this = r.getAnArgument())
38-
// ```
39-
// in the charpred, as that results in bad aggregate
40-
// recursion. Therefore, we overestimate the sinks here
41-
// and make the restriction later by overriding
42-
// `hasFlowPath()` below.
43-
this.getExpr() = any(MethodCall mc |
44-
mc.getTarget().hasQualifiedName("System.Xml.XmlReader.Create") or
45-
mc.getTarget().hasQualifiedName("System.Xml.XmlDocument.Load") or
46-
mc.getTarget().hasQualifiedName("System.Xml.XmlDocument.LoadXml")
47-
).getAnArgument()
48-
or
49-
this.getExpr() = any(ObjectCreation oc |
50-
oc.getObjectType().(ValueOrRefType).hasQualifiedName("System.Xml.XmlTextReader")
51-
).getAnArgument()
52-
}
34+
private string reason;
5335

54-
override string getReason() {
55-
exists(InsecureXML::InsecureXmlProcessing r | r.isUnsafe(result) |
36+
InsecureXMLSink() {
37+
exists(InsecureXML::InsecureXmlProcessing r | r.isUnsafe(reason) |
5638
this.getExpr() = r.getAnArgument()
5739
)
5840
}
41+
42+
override string getReason() { result = reason }
5943
}
6044

6145
/**

‎csharp/ql/src/semmle/code/csharp/security/xml/InsecureXML.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,8 @@ module InsecureXML {
146146
}
147147

148148
module XmlReader {
149+
private import semmle.code.csharp.dataflow.DataFlow2
150+
149151
class InsecureXmlReaderCreate extends InsecureXmlProcessing, MethodCall {
150152
InsecureXmlReaderCreate() { this.getTarget().hasQualifiedName("System.Xml.XmlReader.Create") }
151153

@@ -188,7 +190,7 @@ module InsecureXML {
188190
}
189191
}
190192

191-
private class SettingsDataFlowConfig extends DataFlow::Configuration {
193+
private class SettingsDataFlowConfig extends DataFlow2::Configuration {
192194
SettingsDataFlowConfig() { this = "SettingsDataFlowConfig" }
193195

194196
override predicate isSource(DataFlow::Node source) {

‎csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.expected‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,6 @@ edges
44
| MissingXMLValidation.cs:14:34:14:56 | access to property QueryString | MissingXMLValidation.cs:29:26:29:58 | object creation of type StringReader |
55
| MissingXMLValidation.cs:14:34:14:56 | access to property QueryString | MissingXMLValidation.cs:37:26:37:58 | object creation of type StringReader |
66
| MissingXMLValidation.cs:14:34:14:56 | access to property QueryString | MissingXMLValidation.cs:47:26:47:58 | object creation of type StringReader |
7-
| MissingXMLValidation.cs:22:42:22:64 | object creation of type XmlReaderSettings | MissingXMLValidation.cs:23:61:23:72 | access to local variable badSettings1 |
8-
| MissingXMLValidation.cs:27:42:27:64 | object creation of type XmlReaderSettings | MissingXMLValidation.cs:29:61:29:72 | access to local variable badSettings2 |
9-
| MissingXMLValidation.cs:32:42:32:64 | object creation of type XmlReaderSettings | MissingXMLValidation.cs:37:61:37:72 | access to local variable goodSettings |
10-
| MissingXMLValidation.cs:40:42:40:64 | object creation of type XmlReaderSettings | MissingXMLValidation.cs:47:61:47:72 | access to local variable badSettings3 |
117
#select
128
| MissingXMLValidation.cs:18:26:18:58 | object creation of type StringReader | MissingXMLValidation.cs:14:34:14:56 | access to property QueryString | MissingXMLValidation.cs:18:26:18:58 | object creation of type StringReader | $@ flows to here and is processed as XML without validation because there is no 'XmlReaderSettings' instance specifying schema validation. | MissingXMLValidation.cs:14:34:14:56 | access to property QueryString | User-provided value |
139
| MissingXMLValidation.cs:23:26:23:58 | object creation of type StringReader | MissingXMLValidation.cs:14:34:14:56 | access to property QueryString | MissingXMLValidation.cs:23:26:23:58 | object creation of type StringReader | $@ flows to here and is processed as XML without validation because the 'XmlReaderSettings' instance does not specify the 'ValidationType' as 'Schema'. | MissingXMLValidation.cs:14:34:14:56 | access to property QueryString | User-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
edges
22
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path |
33
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path |
4-
| UncontrolledFormatString.cs:20:23:20:38 | "Do not do this" | UncontrolledFormatString.cs:20:23:20:38 | "Do not do this" |
5-
| UncontrolledFormatString.cs:23:46:23:61 | "Do not do this" | UncontrolledFormatString.cs:23:46:23:61 | "Do not do this" |
64
| UncontrolledFormatString.cs:31:23:31:31 | access to property Text | UncontrolledFormatString.cs:31:23:31:31 | access to property Text |
75
| UncontrolledFormatStringBad.cs:9:25:9:47 | access to property QueryString | UncontrolledFormatStringBad.cs:12:39:12:44 | access to local variable format |
86
#select

‎csharp/ql/test/query-tests/Security Features/CWE-611/UntrustedDataInsecureXml.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
edges
22
| Test.cs:13:50:13:72 | access to property QueryString | Test.cs:13:50:13:84 | access to indexer |
3-
| Test.cs:18:38:18:60 | object creation of type XmlReaderSettings | Test.cs:23:55:23:62 | access to local variable settings |
43
#select
54
| Test.cs:13:50:13:84 | access to indexer | Test.cs:13:50:13:72 | access to property QueryString | Test.cs:13:50:13:84 | access to indexer | $@ flows to here and is loaded insecurely as XML (DTD processing is enabled with an insecure resolver). | Test.cs:13:50:13:72 | access to property QueryString | User-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-730/ReDoS/ReDoS.expected‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,9 @@
11
edges
2-
| ExponentialRegex.cs:9:55:9:83 | "^(([a-z])+.)+[A-Z]([a-z])+$" | ExponentialRegex.cs:24:19:24:34 | access to field JAVA_CLASS_REGEX |
3-
| ExponentialRegex.cs:9:55:9:83 | "^(([a-z])+.)+[A-Z]([a-z])+$" | ExponentialRegex.cs:24:19:24:34 | access to field JAVA_CLASS_REGEX |
4-
| ExponentialRegex.cs:9:55:9:83 | "^(([a-z])+.)+[A-Z]([a-z])+$" | ExponentialRegex.cs:26:32:26:47 | access to field JAVA_CLASS_REGEX |
5-
| ExponentialRegex.cs:9:55:9:83 | "^(([a-z])+.)+[A-Z]([a-z])+$" | ExponentialRegex.cs:26:32:26:47 | access to field JAVA_CLASS_REGEX |
6-
| ExponentialRegex.cs:9:55:9:83 | "^(([a-z])+.)+[A-Z]([a-z])+$" | ExponentialRegex.cs:30:32:30:47 | access to field JAVA_CLASS_REGEX |
72
| ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:17:40:17:48 | access to local variable userInput |
83
| ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:18:42:18:50 | access to local variable userInput |
94
| ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:21:139:21:147 | access to local variable userInput |
105
| ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:24:43:24:51 | access to local variable userInput |
116
| ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:26:21:26:29 | access to local variable userInput |
12-
| ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:28:47:28:55 | access to local variable userInput |
13-
| ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:29:90:29:98 | access to local variable userInput |
14-
| ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:30:21:30:29 | access to local variable userInput |
15-
| ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:32:57:32:65 | access to local variable userInput |
16-
| ExponentialRegex.cs:17:19:17:31 | "^([a-z]+)+$" | ExponentialRegex.cs:17:19:17:31 | "^([a-z]+)+$" |
17-
| ExponentialRegex.cs:18:19:18:31 | "^([a-z]*)*$" | ExponentialRegex.cs:18:19:18:31 | "^([a-z]*)*$" |
18-
| ExponentialRegex.cs:21:19:21:130 | "^([a-zA-Z0-9])(([\\-.]\|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})\|([a-z]{2,3}[.]{1}[a-z]{2,3}))$" | ExponentialRegex.cs:21:19:21:130 | "^([a-zA-Z0-9])(([\\-.]\|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})\|([a-z]{2,3}[.]{1}[a-z]{2,3}))$" |
19-
| ExponentialRegex.cs:24:19:24:34 | access to field JAVA_CLASS_REGEX | ExponentialRegex.cs:26:32:26:47 | access to field JAVA_CLASS_REGEX |
20-
| ExponentialRegex.cs:24:19:24:34 | access to field JAVA_CLASS_REGEX | ExponentialRegex.cs:26:32:26:47 | access to field JAVA_CLASS_REGEX |
21-
| ExponentialRegex.cs:24:19:24:34 | access to field JAVA_CLASS_REGEX | ExponentialRegex.cs:30:32:30:47 | access to field JAVA_CLASS_REGEX |
22-
| ExponentialRegex.cs:26:32:26:47 | access to field JAVA_CLASS_REGEX | ExponentialRegex.cs:30:32:30:47 | access to field JAVA_CLASS_REGEX |
23-
| ExponentialRegex.cs:29:19:29:31 | "^([a-z]+)+$" | ExponentialRegex.cs:29:19:29:31 | "^([a-z]+)+$" |
247
#select
258
| ExponentialRegex.cs:17:40:17:48 | access to local variable userInput | ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:17:40:17:48 | access to local variable userInput | $@ flows to regular expression operation with dangerous regex. | ExponentialRegex.cs:13:28:13:50 | access to property QueryString | User-provided value |
269
| ExponentialRegex.cs:18:42:18:50 | access to local variable userInput | ExponentialRegex.cs:13:28:13:50 | access to property QueryString | ExponentialRegex.cs:18:42:18:50 | access to local variable userInput | $@ flows to regular expression operation with dangerous regex. | ExponentialRegex.cs:13:28:13:50 | access to property QueryString | User-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-730/ReDoSGlobalTimeout/ReDoS.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
11
edges
22
| ExponentialRegex.cs:15:28:15:50 | access to property QueryString | ExponentialRegex.cs:18:40:18:48 | access to local variable userInput |
3-
| ExponentialRegex.cs:18:19:18:31 | "^([a-z]+)+$" | ExponentialRegex.cs:18:19:18:31 | "^([a-z]+)+$" |
43
#select

0 commit comments

Comments
 (0)