Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 751985d

Browse files
hvitvedhvitved
committed
C#: Address review comments
1 parent ae5fb7f commit 751985d

7 files changed

Lines changed: 34 additions & 32 deletions

File tree

‎csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ private predicate dereferenceAt(BasicBlock bb, int i, Ssa::Definition def, Deref
127127
private predicate exprImpliesSsaDef(
128128
Expr e, G::AbstractValue vExpr, Ssa::Definition def, G::AbstractValue vDef
129129
) {
130-
exists(G::Internal::Guard g | G::Internal::impliesSteps(e, vExpr, g, vDef) |
130+
exists(G::Guard g | G::Internal::impliesSteps(e, vExpr, g, vDef) |
131131
g = def.getARead()
132132
or
133133
g = def.(Ssa::ExplicitDefinition).getADefinition().getTargetAccess()

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -192,11 +192,13 @@ class BarrierGuard extends Guard {
192192
}
193193

194194
module BarrierGuards {
195+
import AbstractValues
196+
195197
/** A simple guard that checks that this expression has an abstract value. */
196-
class ValueBarrierGuard extends BarrierGuard {
197-
private AbstractValue v0;
198+
abstract class ValueBarrierGuard extends BarrierGuard {
199+
AbstractValue val;
198200

199-
ValueBarrierGuard() { this.controlsNode(_, this, v0) }
201+
ValueBarrierGuard() { this.controlsNode(_, this, val) }
200202

201203
/**
202204
* Gets the abstract value that this expression is checked against.
@@ -211,18 +213,8 @@ module BarrierGuards {
211213
* `x == null` is checked against an abstract Boolean value (`BooleanValue`),
212214
* and `x` is checked against an abstract nullness value (`NullValue`).
213215
*/
214-
AbstractValue getCheckedValue() { result = v0 }
215-
216-
final override predicate checks(Expr e, AbstractValue v) { e = this and v = v0 }
217-
}
218-
219-
/** A guard that checks if this expression is non-`null`. */
220-
class NullGuard extends DataFlow::BarrierGuards::ValueBarrierGuard {
221-
NullGuard() { this.getCheckedValue() = any(AbstractValues::NullValue nv | not nv.isNull()) }
222-
}
216+
AbstractValue getCheckedValue() { result = val }
223217

224-
/** A guard that checks if this expression is `null`. */
225-
class AntiNullGuard extends DataFlow::BarrierGuards::ValueBarrierGuard {
226-
AntiNullGuard() { this.getCheckedValue().(AbstractValues::NullValue).isNull() }
218+
final override predicate checks(Expr e, AbstractValue v) { e = this and v = val }
227219
}
228220
}

‎csharp/ql/src/semmle/code/csharp/security/dataflow/TaintedPath.qll‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ module TaintedPath {
3030
/**
3131
* A guard for uncontrolled data in path expression vulnerabilities.
3232
*/
33-
abstract class BarrierGuard extends DataFlow::BarrierGuard { }
33+
abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
3434

3535
/**
3636
* A taint-tracking configuration for uncontrolled data in path expression vulnerabilities.
@@ -45,7 +45,7 @@ module TaintedPath {
4545
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
4646

4747
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
48-
guard instanceof BarrierGuard
48+
guard instanceof SanitizerGuard
4949
}
5050
}
5151

@@ -102,12 +102,16 @@ module TaintedPath {
102102
}
103103
}
104104

105+
class NullBarrierGuard extends DataFlow::BarrierGuards::ValueBarrierGuard {
106+
NullBarrierGuard() { val instanceof DataFlow::BarrierGuards::NullValue }
107+
}
108+
105109
/**
106110
* A conditional involving the path, that is not considered to be a weak check.
107111
*
108112
* A weak check is one that is insufficient to prevent path tampering.
109113
*/
110-
class PathCheck extends BarrierGuard {
114+
class PathCheck extends SanitizerGuard {
111115
PathCheck() {
112116
// None of these are sufficient to guarantee that a string is safe.
113117
not this.(MethodCall).getTarget() = any(Method m |
@@ -119,8 +123,7 @@ module TaintedPath {
119123
m = any(SystemIODirectoryClass f).getAMethod("Exists")
120124
) and
121125
// Checking against `null` has no bearing on path traversal.
122-
not this instanceof DataFlow::BarrierGuards::NullGuard and
123-
not this instanceof DataFlow::BarrierGuards::AntiNullGuard
126+
not this instanceof NullBarrierGuard
124127
}
125128

126129
override predicate checks(Expr e, AbstractValue v) { this.controlsNode(_, e, v) }

‎csharp/ql/src/semmle/code/csharp/security/dataflow/UrlRedirect.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ module UrlRedirect {
3030
/**
3131
* A guard for unvalidated URL redirect vulnerabilities.
3232
*/
33-
abstract class BarrierGuard extends DataFlow::BarrierGuard { }
33+
abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
3434

3535
/**
3636
* A taint-tracking configuration for reasoning about unvalidated URL redirect vulnerabilities.
@@ -45,7 +45,7 @@ module UrlRedirect {
4545
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
4646

4747
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
48-
guard instanceof BarrierGuard
48+
guard instanceof SanitizerGuard
4949
}
5050
}
5151

@@ -107,7 +107,7 @@ module UrlRedirect {
107107
/**
108108
* A URL argument to a call to `UrlHelper.isLocalUrl()` that is a sanitizer for URL redirects.
109109
*/
110-
class IsLocalUrlSanitizer extends BarrierGuard, MethodCall {
110+
class IsLocalUrlSanitizer extends SanitizerGuard, MethodCall {
111111
IsLocalUrlSanitizer() { this.getTarget().hasName("IsLocalUrl") }
112112

113113
override predicate checks(Expr e, AbstractValue v) {

‎csharp/ql/src/semmle/code/csharp/security/dataflow/ZipSlip.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ module ZipSlip {
2525
/**
2626
* A guard for unsafe zip extraction.
2727
*/
28-
abstract class BarrierGuard extends DataFlow::BarrierGuard { }
28+
abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
2929

3030
/** A taint tracking configuration for Zip Slip */
3131
class TaintTrackingConfiguration extends TaintTracking::Configuration {
@@ -38,7 +38,7 @@ module ZipSlip {
3838
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
3939

4040
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
41-
guard instanceof BarrierGuard
41+
guard instanceof SanitizerGuard
4242
}
4343
}
4444

@@ -132,7 +132,7 @@ module ZipSlip {
132132
* A call to `String.StartsWith()` that indicates that the tainted path value is being
133133
* validated to ensure that it occurs within a permitted output path.
134134
*/
135-
class StringCheckGuard extends BarrierGuard, MethodCall {
135+
class StringCheckGuard extends SanitizerGuard, MethodCall {
136136
private Expr q;
137137

138138
StringCheckGuard() {

‎csharp/ql/test/library-tests/dataflow/callablereturnsarg/Common.qll‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
import csharp
2-
import semmle.code.csharp.controlflow.Guards
2+
private import DataFlow::BarrierGuards
3+
4+
private class AntiNullBarrierGuard extends ValueBarrierGuard {
5+
AntiNullBarrierGuard() { val.(NullValue).isNull() }
6+
}
37

48
class Configuration extends DataFlow::Configuration {
59
Configuration() { this = "Configuration" }
@@ -9,7 +13,7 @@ class Configuration extends DataFlow::Configuration {
913
override predicate isSink(DataFlow::Node sink) { any() }
1014

1115
override predicate isBarrierGuard(DataFlow::BarrierGuard guard) {
12-
guard instanceof DataFlow::BarrierGuards::AntiNullGuard
16+
guard instanceof AntiNullBarrierGuard
1317
}
1418
}
1519

‎csharp/ql/test/library-tests/dataflow/local/Common.qll‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
import csharp
22
private import semmle.code.csharp.dataflow.internal.DataFlowPrivate
3+
private import DataFlow::BarrierGuards
4+
5+
private class NullBarrierGuard extends ValueBarrierGuard {
6+
NullBarrierGuard() { val = any(NullValue nv | not nv.isNull()) }
7+
}
38

49
class MyFlowSource extends DataFlow::Node {
510
MyFlowSource() {
@@ -20,7 +25,5 @@ class MyFlowSource extends DataFlow::Node {
2025
}
2126

2227
class MyNullGuardedDataFlowNode extends DataFlow::Node {
23-
MyNullGuardedDataFlowNode() {
24-
this = any(DataFlow::BarrierGuards::NullGuard ng).getAGuardedNode()
25-
}
28+
MyNullGuardedDataFlowNode() { this = any(NullBarrierGuard ng).getAGuardedNode() }
2629
}

0 commit comments

Comments
 (0)