Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fb09360

Browse files
calumgrantcalumgrant
committed
C#: New query for cs/uncontrolled-string-format
1 parent 201f64e commit fb09360

4 files changed

Lines changed: 68 additions & 0 deletions

File tree

‎csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* @name Uncontrolled format string
3+
* @description
4+
* @kind path-problem
5+
* @problem.severity error
6+
* @precision high
7+
* @id cs/uncontrolled-format-string
8+
* @tags security
9+
* external/cwe/cwe-134
10+
*/
11+
12+
import csharp
13+
import semmle.code.csharp.dataflow.flowsources.Remote
14+
import semmle.code.csharp.dataflow.TaintTracking
15+
import semmle.code.csharp.frameworks.System
16+
import DataFlow::PathGraph
17+
18+
class FormatStringConfiguration extends TaintTracking::Configuration
19+
{
20+
FormatStringConfiguration() { this = "FormatStringConfiguration" }
21+
22+
override predicate isSource(DataFlow::Node source) {
23+
source instanceof RemoteFlowSource
24+
}
25+
26+
override predicate isSink(DataFlow::Node sink) {
27+
exists(MethodCall call | sink.asExpr() = call.getArgumentForName("format") and
28+
call.getTarget() = any(SystemStringClass s).getFormatMethod()
29+
)
30+
}
31+
}
32+
33+
from FormatStringConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
34+
where config.hasFlowPath(source, sink)
35+
select sink.getNode(), source, sink,
36+
"$@ flows to here and is used to format 'String.Format'.", source.getNode(), source.getNode().toString()

‎csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.cs‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// semmle-extractor-options: /r:System.Runtime.Extensions.dll /r:System.Collections.Specialized.dll ${testdir}/../../../resources/stubs/System.Web.cs
2+
3+
using System;
4+
using System.IO;
5+
using System.Web;
6+
7+
public class TaintedPathHandler : IHttpHandler
8+
{
9+
public void ProcessRequest(HttpContext ctx)
10+
{
11+
String path = ctx.Request.QueryString["page"];
12+
13+
// BAD: Uncontrolled format string.
14+
String.Format(path, "Do not do this");
15+
16+
// BAD: Using an IFormatProvider.
17+
String.Format((IFormatProvider)null, path, "Do not do this");
18+
19+
// GOOD: Not the format string.
20+
String.Format("Do not do this", path);
21+
22+
// GOOD: Not the format string.
23+
String.Format((IFormatProvider)null, "Do not do this", path);
24+
}
25+
}

‎csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
edges
2+
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path |
3+
| UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path |
4+
#select
5+
| UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | $@ flows to here and is used to format 'String.Format'. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |
6+
| UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | $@ flows to here and is used to format 'String.Format'. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |

‎csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security Features/CWE-134/UncontrolledFormatString.ql

0 commit comments

Comments
 (0)