Skip to content

C#: Dotnet Runtime models. #8600

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
michaelnebel merged 13 commits into from
May 25, 2022
Merged

C#: Dotnet Runtime models. #8600

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
3b62b45
C#: Add generated framework models to ExternalFlow.
michaelnebel Mar 30, 2022
f8e7290
C#: Add generated Dotnet Runtime summary models that allows to up two…
michaelnebel Mar 30, 2022
d9c7ba4
C#: Update taint steps test as the generated models now include a mod…
michaelnebel Apr 20, 2022
9b8636a
C#: Update test because we now have a flow summary the string indexer…
michaelnebel Apr 20, 2022
e2d6cd2
C#: Update tests due to new summaries for ProcessStartInfo.
michaelnebel Apr 20, 2022
268230e
C#: Add QlDoc to the Generated file.
michaelnebel Apr 21, 2022
ee027f8
C#: Since NameValueCollection now has a flow summary for the indexer …
michaelnebel Apr 21, 2022
4d6d1c8
C#: Since NameValueCollection now has a flow summary for the string i…
michaelnebel Apr 22, 2022
c8ede58
C#: Flow summaries has now been added for Exception stack trace, but …
michaelnebel Apr 22, 2022
7553243
C#: Update flow summaries test (note that the test doesn't correctly …
michaelnebel May 5, 2022
ba7238d
C#: Update XML Injectiont test output after rebase (query has been tu…
michaelnebel May 9, 2022
5b405bb
C#: Update FlowSummaries test with generated printing (needed due to …
michaelnebel May 9, 2022
9cab92b
C#: Update flow summaries test after rebase. The rebase included a fi…
michaelnebel May 25, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ private import internal.FlowSummaryImplSpecific
*/
private module Frameworks {
private import semmle.code.csharp.frameworks.EntityFramework
private import semmle.code.csharp.frameworks.Generated
private import semmle.code.csharp.frameworks.JsonNET
private import semmle.code.csharp.frameworks.microsoft.extensions.Primitives
private import semmle.code.csharp.frameworks.microsoft.VisualBasic
Expand Down
9 changes: 9 additions & 0 deletions csharp/ql/lib/semmle/code/csharp/frameworks/Generated.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
/**
* A module importing all generated Models as Data models.
*/

import csharp

private module GeneratedFrameworks {
private import generated.dotnet.Runtime
}
10,122 changes: 10,122 additions & 0 deletions csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/Runtime.qll
View file
Open in desktop

Large diffs are not rendered by default.

21 changes: 14 additions & 7 deletions csharp/ql/src/Security Features/CWE-209/ExceptionInformationExposure.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,6 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
exists(Expr exceptionExpr |
// Writing an exception directly is bad
source.asExpr() = exceptionExpr
or
// Writing an exception property is bad
source.asExpr().(PropertyAccess).getQualifier() = exceptionExpr
or
// Writing the result of ToString is bad
source.asExpr() =
any(MethodCall mc | mc.getQualifier() = exceptionExpr and mc.getTarget().hasName("ToString"))
|
// Expr has type `System.Exception`.
exceptionExpr.getType().(RefType).getABaseType*() instanceof SystemExceptionClass and
Expand All @@ -47,12 +40,26 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
)
}

override predicate isAdditionalTaintStep(DataFlow::Node source, DataFlow::Node sink) {
sink.asExpr() =
any(MethodCall mc |
source.asExpr() = mc.getQualifier() and
mc.getTarget().hasName("ToString") and
mc.getQualifier().getType().(RefType).getABaseType*() instanceof SystemExceptionClass
)
}

override predicate isSink(DataFlow::Node sink) { sink instanceof RemoteFlowSink }

override predicate isSanitizer(DataFlow::Node sanitizer) {
// Do not flow through Message
sanitizer.asExpr() = any(SystemExceptionClass se).getProperty("Message").getAnAccess()
}

override predicate isSanitizerIn(DataFlow::Node sanitizer) {
// Do not flow through Message
sanitizer.asExpr().getType().(RefType).getABaseType*() instanceof SystemExceptionClass
}
}

from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
Expand Down
2 changes: 2 additions & 0 deletions csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,7 +206,9 @@
| CSharp7.cs:283:13:283:62 | SSA def(list) | CSharp7.cs:285:39:285:42 | access to local variable list |
| CSharp7.cs:283:20:283:62 | call to method Select<KeyValuePair<Int32,String>,(Int32,String)> | CSharp7.cs:283:13:283:62 | SSA def(list) |
| CSharp7.cs:283:32:283:35 | item | CSharp7.cs:283:41:283:44 | access to parameter item |
| CSharp7.cs:283:41:283:44 | access to parameter item | CSharp7.cs:283:41:283:48 | access to property Key |
| CSharp7.cs:283:41:283:44 | access to parameter item | CSharp7.cs:283:51:283:54 | access to parameter item |
| CSharp7.cs:283:51:283:54 | access to parameter item | CSharp7.cs:283:51:283:60 | access to property Value |
| CSharp7.cs:285:39:285:42 | access to local variable list | CSharp7.cs:287:36:287:39 | access to local variable list |
| CSharp7.cs:287:36:287:39 | access to local variable list | CSharp7.cs:289:32:289:35 | access to local variable list |
| CSharp7.cs:297:18:297:22 | SSA def(x) | CSharp7.cs:297:25:297:25 | SSA phi(x) |
Expand Down
7,173 changes: 7,173 additions & 0 deletions csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
View file
Open in desktop

Large diffs are not rendered by default.

6,871 changes: 6,871 additions & 0 deletions csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 0 additions & 1 deletion .../ql/test/query-tests/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,2 @@
| System.Collections.Specialized.NameValueCollection.get_Item(string) [qualifier] | 1 | 1 |
| System.Web.HttpRequest.get_QueryString() [qualifier] | 1 | 1 |
| System.Web.HttpResponse.Write(string) [param 0] | 1 | 1 |
5 changes: 3 additions & 2 deletions csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedDataToExternalAPI.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
edges
| UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | UntrustedData.cs:9:20:9:50 | access to indexer : String |
| UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | UntrustedData.cs:13:28:13:31 | access to local variable name |
| UntrustedData.cs:9:20:9:50 | access to indexer : String | UntrustedData.cs:13:28:13:31 | access to local variable name |
nodes
| UntrustedData.cs:9:20:9:30 | access to property Request | semmle.label | access to property Request |
| UntrustedData.cs:9:20:9:42 | access to property QueryString | semmle.label | access to property QueryString |
| UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
| UntrustedData.cs:9:20:9:50 | access to indexer : String | semmle.label | access to indexer : String |
| UntrustedData.cs:13:28:13:31 | access to local variable name | semmle.label | access to local variable name |
subpaths
#select
| UntrustedData.cs:9:20:9:30 | access to property Request | UntrustedData.cs:9:20:9:30 | access to property Request | UntrustedData.cs:9:20:9:30 | access to property Request | Call to System.Web.HttpRequest.get_QueryString with untrusted data from $@. | UntrustedData.cs:9:20:9:30 | access to property Request | access to property Request |
| UntrustedData.cs:9:20:9:42 | access to property QueryString | UntrustedData.cs:9:20:9:42 | access to property QueryString | UntrustedData.cs:9:20:9:42 | access to property QueryString | Call to System.Collections.Specialized.NameValueCollection.get_Item with untrusted data from $@. | UntrustedData.cs:9:20:9:42 | access to property QueryString | access to property QueryString |
| UntrustedData.cs:13:28:13:31 | access to local variable name | UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | UntrustedData.cs:13:28:13:31 | access to local variable name | Call to System.Web.HttpResponse.Write with untrusted data from $@. | UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | access to property QueryString : NameValueCollection |
9 changes: 9 additions & 0 deletions csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,22 @@
edges
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:10:23:10:53 | access to indexer : String |
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:12:50:12:53 | access to local variable path |
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:17:51:17:54 | access to local variable path |
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:25:30:25:33 | access to local variable path |
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:31:30:31:33 | access to local variable path |
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:36:25:36:31 | access to local variable badPath |
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:38:49:38:55 | access to local variable badPath |
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:51:26:51:29 | access to local variable path |
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:12:50:12:53 | access to local variable path |
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:17:51:17:54 | access to local variable path |
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:25:30:25:33 | access to local variable path |
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:31:30:31:33 | access to local variable path |
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:36:25:36:31 | access to local variable badPath |
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:38:49:38:55 | access to local variable badPath |
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:51:26:51:29 | access to local variable path |
nodes
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
| TaintedPath.cs:10:23:10:53 | access to indexer : String | semmle.label | access to indexer : String |
| TaintedPath.cs:12:50:12:53 | access to local variable path | semmle.label | access to local variable path |
| TaintedPath.cs:17:51:17:54 | access to local variable path | semmle.label | access to local variable path |
| TaintedPath.cs:25:30:25:33 | access to local variable path | semmle.label | access to local variable path |
Expand Down
27 changes: 27 additions & 0 deletions csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,26 +3,53 @@ edges
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:26:27:26:47 | ... + ... |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:26:50:26:66 | ... + ... |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:28:63:28:71 | access to local variable userInput |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:28:63:28:71 | access to local variable userInput : String |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:28:74:28:82 | access to local variable userInput |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:28:74:28:82 | access to local variable userInput : String |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:32:39:32:47 | access to local variable userInput |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:32:39:32:47 | access to local variable userInput : String |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:33:40:33:48 | access to local variable userInput |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:33:40:33:48 | access to local variable userInput : String |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:34:47:34:55 | access to local variable userInput |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:34:47:34:55 | access to local variable userInput : String |
| CommandInjection.cs:28:42:28:83 | object creation of type ProcessStartInfo : ProcessStartInfo | CommandInjection.cs:29:27:29:35 | access to local variable startInfo |
| CommandInjection.cs:28:63:28:71 | access to local variable userInput : String | CommandInjection.cs:28:42:28:83 | object creation of type ProcessStartInfo : ProcessStartInfo |
| CommandInjection.cs:28:74:28:82 | access to local variable userInput : String | CommandInjection.cs:28:42:28:83 | object creation of type ProcessStartInfo : ProcessStartInfo |
| CommandInjection.cs:32:13:32:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps |
| CommandInjection.cs:32:39:32:47 | access to local variable userInput : String | CommandInjection.cs:32:13:32:26 | [post] access to local variable startInfoProps : ProcessStartInfo |
| CommandInjection.cs:33:13:33:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps |
| CommandInjection.cs:33:40:33:48 | access to local variable userInput : String | CommandInjection.cs:33:13:33:26 | [post] access to local variable startInfoProps : ProcessStartInfo |
| CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps |
| CommandInjection.cs:34:47:34:55 | access to local variable userInput : String | CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo |
nodes
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | semmle.label | access to property Text : String |
| CommandInjection.cs:26:27:26:47 | ... + ... | semmle.label | ... + ... |
| CommandInjection.cs:26:50:26:66 | ... + ... | semmle.label | ... + ... |
| CommandInjection.cs:28:42:28:83 | object creation of type ProcessStartInfo : ProcessStartInfo | semmle.label | object creation of type ProcessStartInfo : ProcessStartInfo |
| CommandInjection.cs:28:63:28:71 | access to local variable userInput | semmle.label | access to local variable userInput |
| CommandInjection.cs:28:63:28:71 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
| CommandInjection.cs:28:74:28:82 | access to local variable userInput | semmle.label | access to local variable userInput |
| CommandInjection.cs:28:74:28:82 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
| CommandInjection.cs:29:27:29:35 | access to local variable startInfo | semmle.label | access to local variable startInfo |
| CommandInjection.cs:32:13:32:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
| CommandInjection.cs:32:39:32:47 | access to local variable userInput | semmle.label | access to local variable userInput |
| CommandInjection.cs:32:39:32:47 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
| CommandInjection.cs:33:13:33:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
| CommandInjection.cs:33:40:33:48 | access to local variable userInput | semmle.label | access to local variable userInput |
| CommandInjection.cs:33:40:33:48 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
| CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
| CommandInjection.cs:34:47:34:55 | access to local variable userInput | semmle.label | access to local variable userInput |
| CommandInjection.cs:34:47:34:55 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
| CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | semmle.label | access to local variable startInfoProps |
subpaths
#select
| CommandInjection.cs:26:27:26:47 | ... + ... | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:27:26:47 | ... + ... | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
| CommandInjection.cs:26:50:26:66 | ... + ... | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:50:26:66 | ... + ... | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
| CommandInjection.cs:28:63:28:71 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:63:28:71 | access to local variable userInput | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
| CommandInjection.cs:28:74:28:82 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:74:28:82 | access to local variable userInput | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
| CommandInjection.cs:29:27:29:35 | access to local variable startInfo | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:29:27:29:35 | access to local variable startInfo | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
| CommandInjection.cs:32:39:32:47 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:32:39:32:47 | access to local variable userInput | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
| CommandInjection.cs:33:40:33:48 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:33:40:33:48 | access to local variable userInput | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
| CommandInjection.cs:34:47:34:55 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:34:47:34:55 | access to local variable userInput | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
| CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
Loading