Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b4d35b5

Browse files
tamasvajktamasvajk
committed
C#: Add Console.Read* to local flow sources
1 parent acd4cf2 commit b4d35b5

3 files changed

Lines changed: 31 additions & 0 deletions

File tree

‎csharp/ql/src/semmle/code/csharp/security/dataflow/flowsources/Local.qll‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,17 @@ class TextFieldSource extends LocalUserInputSource {
2020

2121
override string getSourceType() { result = "TextBox text" }
2222
}
23+
24+
/** A call to any `System.Console.Read*` method. */
25+
class SystemConsoleReadSource extends LocalUserInputSource {
26+
SystemConsoleReadSource() {
27+
this.asExpr() =
28+
any(MethodCall call |
29+
call.getTarget().hasQualifiedName("System.Console", "ReadLine") or
30+
call.getTarget().hasQualifiedName("System.Console", "Read") or
31+
call.getTarget().hasQualifiedName("System.Console", "ReadKey")
32+
)
33+
}
34+
35+
override string getSourceType() { result = "TextBox text" }
36+
}

‎csharp/ql/test/query-tests/Security Features/CWE-134/ConsoleUncontrolledFormatString.cs‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
using System;
2+
using System;
3+
4+
public class Program
5+
{
6+
public static void Main()
7+
{
8+
var format = Console.ReadLine();
9+
10+
// BAD: Uncontrolled format string.
11+
var x = string.Format(format, 1, 2);
12+
}
13+
}

‎csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,19 @@
11
edges
2+
| ConsoleUncontrolledFormatString.cs:8:22:8:39 | call to method ReadLine : String | ConsoleUncontrolledFormatString.cs:11:31:11:36 | access to local variable format |
23
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path |
34
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path |
45
| UncontrolledFormatStringBad.cs:9:25:9:47 | access to property QueryString : NameValueCollection | UncontrolledFormatStringBad.cs:12:39:12:44 | access to local variable format |
56
nodes
7+
| ConsoleUncontrolledFormatString.cs:8:22:8:39 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
8+
| ConsoleUncontrolledFormatString.cs:11:31:11:36 | access to local variable format | semmle.label | access to local variable format |
69
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
710
| UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | semmle.label | access to local variable path |
811
| UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | semmle.label | access to local variable path |
912
| UncontrolledFormatString.cs:34:23:34:31 | access to property Text | semmle.label | access to property Text |
1013
| UncontrolledFormatStringBad.cs:9:25:9:47 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
1114
| UncontrolledFormatStringBad.cs:12:39:12:44 | access to local variable format | semmle.label | access to local variable format |
1215
#select
16+
| ConsoleUncontrolledFormatString.cs:11:31:11:36 | access to local variable format | ConsoleUncontrolledFormatString.cs:8:22:8:39 | call to method ReadLine : String | ConsoleUncontrolledFormatString.cs:11:31:11:36 | access to local variable format | $@ flows to here and is used as a format string. | ConsoleUncontrolledFormatString.cs:8:22:8:39 | call to method ReadLine | call to method ReadLine |
1317
| UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | $@ flows to here and is used as a format string. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |
1418
| UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | $@ flows to here and is used as a format string. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |
1519
| UncontrolledFormatString.cs:34:23:34:31 | access to property Text | UncontrolledFormatString.cs:34:23:34:31 | access to property Text | UncontrolledFormatString.cs:34:23:34:31 | access to property Text | $@ flows to here and is used as a format string. | UncontrolledFormatString.cs:34:23:34:31 | access to property Text | access to property Text |

0 commit comments

Comments
 (0)