C#: Add some examples where adapter is used in conjunction with a tainted command.

michaelnebel · michaelnebel · commit 78cfb226a3c9 · 2022-08-10T11:08:27.000+02:00
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.cs
@@ -84,6 +84,17 @@ public void GetDataSetByCategory()
                 var result = new DataSet();
                 adapter.Fill(result);
             }
+
+            // BAD: Text from a local textbox
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var queryString = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
+                  + box1.Text + "' ORDER BY PRICE";
+                var cmd = new SqlCommand(queryString);
+                var adapter = new SqlDataAdapter(cmd);
+                var result = new DataSet();
+                adapter.Fill(result);
+            }
         }
 
         System.Windows.Forms.TextBox box1;
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjectionSqlite.cs b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjectionSqlite.cs
@@ -37,6 +37,11 @@ public void InjectUntrustedData()
             adapter = new SQLiteDataAdapter(untrustedData.Text, connectionString);
             result = new DataSet();
             adapter.Fill(result);
+
+            // BAD: untrusted data is not sanitized.
+            adapter = new SQLiteDataAdapter(cmd);
+            result = new DataSet();
+            adapter.Fill(result);
         }
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,11 @@ public void InjectUntrustedData()`
`37`	`37`	`adapter = new SQLiteDataAdapter(untrustedData.Text, connectionString);`
`38`	`38`	`result = new DataSet();`
`39`	`39`	`adapter.Fill(result);`
	`40`	`+`
	`41`	`+ // BAD: untrusted data is not sanitized.`
	`42`	`+ adapter = new SQLiteDataAdapter(cmd);`
	`43`	`+ result = new DataSet();`
	`44`	`+ adapter.Fill(result);`
`40`	`45`	`}`
`41`	`46`	`}`
`42`	`47`	`}`