Add TCP and UDP socket client taint sources #9415

JarLob · 2022-06-02T10:55:26Z

In order to support scenarios as:

            using (var tcpConn = new TcpClient("host.example.org", 39544))
            {
                /* read input from socket */
                using (StreamReader sr = new StreamReader(tcpConn.GetStream()))
                {
                    Sink(sr.ReadLine());
                }
            }

Also added StreamReader summary until MaD generator is fixed

github-actions · 2022-06-02T10:58:07Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",3,12038,28,5
+    System,"``System.*``, ``System``",7,12050,28,5
-    Totals,,3,12599,359,5
+    Totals,,7,12611,359,5

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:html,sink:remote,sink:sql,sink:xss,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:html,sink:remote,sink:sql,sink:xss,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,55,,,,
+ Dapper,55,,,,,,55,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,28,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,28,,,,,
- Microsoft.CSharp,,,24,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,6,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,6,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,15,,,,,,,15,
+ Microsoft.Extensions.FileProviders,,,15,,,,,,,,15,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,4,
- Microsoft.VisualBasic,,,9,,,,,,,5,4
+ Microsoft.VisualBasic,,,9,,,,,,,,5,4
- Microsoft.Win32,,,8,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,48,,,,
+ MySql.Data.MySqlClient,48,,,,,,48,,,,,
- Newtonsoft.Json,,,91,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,73,18
- ServiceStack,194,,7,27,,75,92,,,7,
+ ServiceStack,194,,7,27,,75,92,,,,7,
- System,28,3,12038,,4,,23,1,3,10096,1942
+ System,28,7,12050,,4,,23,1,3,4,10108,1942

JarLob · 2022-06-02T10:58:15Z

Question, since GetStream is a source of taint by itself are any changes to "System.Net.Sockets;TcpClient;false;GetStream;();;Argument[Qualifier];ReturnValue;generated:taint", in runtime.qll needed?

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll

github-actions · 2022-06-02T11:01:00Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",3,12038,28,5
+    System,"``System.*``, ``System``",7,12050,28,5
-    Totals,,3,12599,359,5
+    Totals,,7,12611,359,5

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:html,sink:remote,sink:sql,sink:xss,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:html,sink:remote,sink:sql,sink:xss,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,55,,,,
+ Dapper,55,,,,,,55,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,28,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,28,,,,,
- Microsoft.CSharp,,,24,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,6,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,6,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,15,,,,,,,15,
+ Microsoft.Extensions.FileProviders,,,15,,,,,,,,15,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,4,
- Microsoft.VisualBasic,,,9,,,,,,,5,4
+ Microsoft.VisualBasic,,,9,,,,,,,,5,4
- Microsoft.Win32,,,8,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,48,,,,
+ MySql.Data.MySqlClient,48,,,,,,48,,,,,
- Newtonsoft.Json,,,91,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,73,18
- ServiceStack,194,,7,27,,75,92,,,7,
+ ServiceStack,194,,7,27,,75,92,,,,7,
- System,28,3,12038,,4,,23,1,3,10096,1942
+ System,28,7,12050,,4,,23,1,3,4,10108,1942

michaelnebel · 2022-06-02T12:07:40Z

Question, since GetStream is a source of taint by itself are any changes to "System.Net.Sockets;TcpClient;false;GetStream;();;Argument[Qualifier];ReturnValue;generated:taint", in runtime.qll needed?

I don't think so.
Maybe also create small testcase for this to make sure that source models and taint steps are applied correctly during taint tracking.

michaelnebel · 2022-06-02T12:15:17Z

The new models looks plausible to me.
Unit test failures needs to be inspected.

csharp/ql/lib/semmle/code/csharp/frameworks/system/io/StreamReader.qll

github-actions · 2022-07-13T20:50:19Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",3,12038,28,5
+    System,"``System.*``, ``System``",3,12050,28,5
-    Totals,,3,12599,359,5
+    Totals,,3,12611,359,5

Changes to framework-coverage-csharp.csv:

- System,28,3,12038,,4,,23,1,3,10096,1942
+ System,28,3,12050,,4,,23,1,3,10108,1942

JarLob · 2022-07-13T20:54:19Z

Since I have added only source and summary it is quite different form the usual add new query test. There are no tests for Compression.qll for an instance. I'm looking for an example of source and summary tests I could add. Do you have and idea?

michaelnebel · 2022-07-22T13:03:06Z

Since I have added only source and summary it is quite different form the usual add new query test. There are no tests for Compression.qll for an instance. I'm looking for an example of source and summary tests I could add. Do you have and idea?

If there doesn't already exist a test then maybe it is fine to run the query against a database with a known vulnerability that should now be discovered by the addition of these models (@hvitved : Or is there another policy on what to do?).

The existing failing unit tests should be updated to reflect the new model changes (let me know, if you need any help with that.)

github-actions · 2022-08-24T09:53:53Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,11809,43,7
+    System,"``System.*``, ``System``",4,11821,43,7
-    Totals,,4,12370,375,7
+    Totals,,4,12382,375,7

Changes to framework-coverage-csharp.csv:

- System,43,4,11809,,1,1,1,,4,,33,3,1,3,9867,1942
+ System,43,4,11821,,1,1,1,,4,,33,3,1,3,9879,1942

github-actions · 2022-08-24T09:59:59Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,11809,43,7
+    System,"``System.*``, ``System``",4,11821,43,7
-    Totals,,4,12370,375,7
+    Totals,,4,12382,375,7

Changes to framework-coverage-csharp.csv:

- System,43,4,11809,,1,1,1,,4,,33,3,1,3,9867,1942
+ System,43,4,11821,,1,1,1,,4,,33,3,1,3,9879,1942

csharp/ql/lib/semmle/code/csharp/frameworks/system/io/StreamReader.qll

github-actions · 2022-11-01T18:23:52Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12131,65,7
+    System,"``System.*``, ``System``",4,12143,65,7
-    Totals,,4,12694,397,7
+    Totals,,4,12706,397,7

Changes to framework-coverage-csharp.csv:

- System,65,4,12131,,8,8,9,,4,,33,3,1,3,10139,1992
+ System,65,4,12143,,8,8,9,,4,,33,3,1,3,10151,1992

github-actions · 2022-11-01T18:33:08Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12131,65,7
+    System,"``System.*``, ``System``",4,12143,65,7
-    Totals,,4,12694,397,7
+    Totals,,4,12706,397,7

Changes to framework-coverage-csharp.csv:

- System,65,4,12131,,8,8,9,,4,,33,3,1,3,10139,1992
+ System,65,4,12143,,8,8,9,,4,,33,3,1,3,10151,1992

github-actions · 2022-11-01T18:34:00Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12131,65,7
+    System,"``System.*``, ``System``",4,12143,65,7
-    Totals,,4,12694,397,7
+    Totals,,4,12706,397,7

Changes to framework-coverage-csharp.csv:

- System,65,4,12131,,8,8,9,,4,,33,3,1,3,10139,1992
+ System,65,4,12143,,8,8,9,,4,,33,3,1,3,10151,1992

github-actions · 2022-11-01T21:38:07Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12131,65,7
+    System,"``System.*``, ``System``",8,12143,65,7
-    Totals,,4,12694,397,7
+    Totals,,8,12706,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12131,,8,8,9,,4,,33,3,1,3,10139,1992
+ System,65,8,12143,,8,8,9,,4,,33,3,1,3,4,10151,1992
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll

JarLob · 2022-11-01T23:26:50Z

@michaelnebel I was getting Wrong number of columns in source model row, expected 9, got 8 in System.Net.Sockets;TcpClient;false;GetStream;;;ReturnValue;remote. | so I have added ;manual in attempt to fix that, now it still complains | Invalid kind "remote" in source model. |. Any advise what is wrong?

michaelnebel · 2022-11-02T07:57:55Z

@michaelnebel I was getting Wrong number of columns in source model row, expected 9, got 8 in System.Net.Sockets;TcpClient;false;GetStream;;;ReturnValue;remote. | so I have added ;manual in attempt to fix that, now it still complains | Invalid kind "remote" in source model. |. Any advise what is wrong?

Yes, there is a validation of the allowed kinds used in all types of models. The only allowed kinds for source models are local and file, but you are welcome to introduce a new kind for source models.
If you want to allow new source kinds, you need to change the validation here:

codeql/csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

Line 373 in 28b7ab7

not kind = ["local", "file"] and

github-actions · 2022-11-02T08:47:57Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12131,65,7
+    System,"``System.*``, ``System``",8,12143,65,7
-    Totals,,4,12694,397,7
+    Totals,,8,12706,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12131,,8,8,9,,4,,33,3,1,3,10139,1992
+ System,65,8,12143,,8,8,9,,4,,33,3,1,3,4,10151,1992
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

github-actions · 2022-11-02T10:40:25Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12131,65,7
+    System,"``System.*``, ``System``",8,12143,65,7
-    Totals,,4,12694,397,7
+    Totals,,8,12706,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12131,,8,8,9,,4,,33,3,1,3,10139,1992
+ System,65,8,12143,,8,8,9,,4,,33,3,1,3,4,10151,1992
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll

JarLob · 2022-11-02T11:59:13Z

Finally, everything is green.

hvitved · 2022-11-02T12:31:53Z

Finally, everything is green.

I'll start a performance/results comparison job.

github-actions · 2022-11-29T13:40:46Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12142,65,7
+    System,"``System.*``, ``System``",8,12142,65,7
-    Totals,,4,12705,397,7
+    Totals,,8,12705,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12142,,8,8,9,,4,,33,3,1,3,10151,1991
+ System,65,8,12142,,8,8,9,,4,,33,3,1,3,4,10151,1991
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

JarLob · 2022-11-29T13:43:55Z

New merge conflicts appeared. I have revolved that. However I'm not sure about 6462423#diff-0bf160019833ad6f9c40ea33257e19a1945f2287468b4871f1064f2d0bc58ec1R114 I see that the imports were deleted in 582cfb9 by @michaelnebel Hopefully it still works without the StreamReader import. Can we get it merged now if tests pass?

JarLob · 2022-11-29T13:47:44Z

It fails... @michaelnebel could you please suggest what is wrong?

michaelnebel · 2022-11-30T10:35:26Z

It fails... @michaelnebel could you please suggest what is wrong?

Yes, we have migrated all models as data models to be defined in data extensions instead of inlined in the code.
That is, they need to written in YAML format instead and put in the lib/ext folder.
There is a a file pr. namespace (named <namespace>.model.yml.

github-actions · 2022-11-30T10:54:12Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12142,65,7
+    System,"``System.*``, ``System``",8,12142,65,7
-    Totals,,4,12705,397,7
+    Totals,,8,12705,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12142,,8,8,9,,4,,33,3,1,3,10151,1991
+ System,65,8,12142,,8,8,9,,4,,33,3,1,3,4,10151,1991
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

github-actions · 2022-11-30T11:44:55Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12142,65,7
+    System,"``System.*``, ``System``",8,12154,65,7
-    Totals,,4,12705,397,7
+    Totals,,8,12717,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12142,,8,8,9,,4,,33,3,1,3,10151,1991
+ System,65,8,12154,,8,8,9,,4,,33,3,1,3,4,10163,1991
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

github-actions · 2022-11-30T12:18:37Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12142,65,7
+    System,"``System.*``, ``System``",8,12154,65,7
-    Totals,,4,12705,397,7
+    Totals,,8,12717,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12142,,8,8,9,,4,,33,3,1,3,10151,1991
+ System,65,8,12154,,8,8,9,,4,,33,3,1,3,4,10163,1991
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

JarLob · 2022-11-30T12:54:42Z

All checks pass. Please review and merge as soon as it looks good. From the other pull request it seems there was a misunderstanding who should merge the PR as long as it is approved.

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll

csharp/ql/lib/ext/System.IO.StreamReader.model.yml

github-actions · 2022-12-09T00:29:46Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12142,65,7
+    System,"``System.*``, ``System``",8,12154,65,7
-    Totals,,4,12705,397,7
+    Totals,,8,12717,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12142,,8,8,9,,4,,33,3,1,3,10151,1991
+ System,65,8,12154,,8,8,9,,4,,33,3,1,3,4,10163,1991
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

github-actions · 2022-12-09T00:30:32Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12142,65,7
+    System,"``System.*``, ``System``",8,12154,65,7
-    Totals,,4,12705,397,7
+    Totals,,8,12717,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12142,,8,8,9,,4,,33,3,1,3,10151,1991
+ System,65,8,12154,,8,8,9,,4,,33,3,1,3,4,10163,1991
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

github-actions · 2022-12-12T12:25:04Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",4,12142,65,7
+    System,"``System.*``, ``System``",8,12154,65,7
-    Totals,,4,12705,397,7
+    Totals,,8,12717,397,7

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,summary:taint,summary:value
+ package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,
+ Dapper,55,,,,,,,,,,55,,,,,,
- JsonToItemsTaskFactory,,,7,,,,,,,,,,,,7,
+ JsonToItemsTaskFactory,,,7,,,,,,,,,,,,,7,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,
- Microsoft.CSharp,,,24,,,,,,,,,,,,24,
+ Microsoft.CSharp,,,24,,,,,,,,,,,,,24,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,
- Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,15,
+ Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,,,,,,,15,
- Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
+ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,,45,1
- Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
+ Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,,80,3
- Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
+ Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,,62,
- Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
+ Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,,12,
- Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
+ Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,,16,
- Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
+ Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,,13,2
- Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
+ Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,,16,1
- Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
+ Microsoft.Extensions.Http,,,10,,,,,,,,,,,,,10,
- Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,37,
+ Microsoft.Extensions.Logging,,,37,,,,,,,,,,,,,37,
- Microsoft.Extensions.Options,,,8,,,,,,,,,,,,8,
+ Microsoft.Extensions.Options,,,8,,,,,,,,,,,,,8,
- Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
+ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,,63,
- Microsoft.Interop,,,27,,,,,,,,,,,,27,
+ Microsoft.Interop,,,27,,,,,,,,,,,,,27,
- Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
+ Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,,1,
- Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
+ Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,,4,
- Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
+ Microsoft.VisualBasic,,,10,,,,,,,,,,,,,5,5
- Microsoft.Win32,,,8,,,,,,,,,,,,8,
+ Microsoft.Win32,,,8,,,,,,,,,,,,,8,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,
- Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
+ Newtonsoft.Json,,,91,,,,,,,,,,,,,73,18
- ServiceStack,194,,7,27,,,,,,75,92,,,,7,
+ ServiceStack,194,,7,27,,,,,,75,92,,,,,7,
- System,65,4,12142,,8,8,9,,4,,33,3,1,3,10151,1991
+ System,65,8,12154,,8,8,9,,4,,33,3,1,3,4,10163,1991
- Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
+ Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,

michaelnebel · 2022-12-13T09:39:25Z

DCA shows
(1) No performance regressions.
(2) A single new alert in mono/mono where the newly added GetStream is a remote source. Assuming we trust the query the alerts seems plausible.
Merging now.

JarLob requested a review from a team as a code owner June 2, 2022 10:55

github-actions bot added the C# label Jun 2, 2022

github-advanced-security bot found potential problems Jun 2, 2022

View reviewed changes

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll Fixed Show fixed Hide fixed

michaelnebel reviewed Jun 22, 2022

View reviewed changes

csharp/ql/lib/semmle/code/csharp/frameworks/system/io/StreamReader.qll Outdated Show resolved Hide resolved

github-actions bot added the documentation label Aug 24, 2022

hvitved requested changes Aug 30, 2022

View reviewed changes

csharp/ql/lib/semmle/code/csharp/frameworks/system/io/StreamReader.qll Outdated Show resolved Hide resolved

github-advanced-security bot found potential problems Nov 1, 2022

View reviewed changes

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Nov 2, 2022

View reviewed changes

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll Fixed Show fixed Hide fixed

hvitved previously approved these changes Nov 3, 2022

View reviewed changes

JarLob dismissed hvitved’s stale review via c8bfd70 November 29, 2022 13:37

michaelnebel reviewed Dec 1, 2022

View reviewed changes

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll Outdated Show resolved Hide resolved

csharp/ql/lib/ext/System.IO.StreamReader.model.yml Outdated Show resolved Hide resolved

JarLob and others added 4 commits December 12, 2022 12:56

C#: Add source TCP/UDP source models and StreamReader summary models.

204a1d3

C#: Add change note.

340fd8a

C#: Add remote type source kind in model validation.

1d303e0

C#: Cleanup and make the last StreamReader model explicit on its input.

0fdf9a4

michaelnebel requested a review from hvitved December 12, 2022 12:22

hvitved approved these changes Dec 12, 2022

View reviewed changes

michaelnebel merged commit b8ef961 into github:main Dec 13, 2022

Add TCP and UDP socket client taint sources #9415

Add TCP and UDP socket client taint sources #9415

Uh oh!

Conversation

JarLob commented Jun 2, 2022

Uh oh!

github-actions bot commented Jun 2, 2022

csharp

Generated file changes for csharp

Uh oh!

JarLob commented Jun 2, 2022

Uh oh!

Uh oh!

github-actions bot commented Jun 2, 2022

csharp

Generated file changes for csharp

Uh oh!

michaelnebel commented Jun 2, 2022

Uh oh!

michaelnebel commented Jun 2, 2022

Uh oh!

Uh oh!

github-actions bot commented Jul 13, 2022

csharp

Generated file changes for csharp

Uh oh!

JarLob commented Jul 13, 2022

Uh oh!

michaelnebel commented Jul 22, 2022

Uh oh!

github-actions bot commented Aug 24, 2022

csharp

Generated file changes for csharp

Uh oh!

github-actions bot commented Aug 24, 2022

csharp

Generated file changes for csharp

Uh oh!

Uh oh!

github-actions bot commented Nov 1, 2022

csharp

Generated file changes for csharp

Uh oh!

github-actions bot commented Nov 1, 2022

csharp

Generated file changes for csharp

Uh oh!

github-actions bot commented Nov 1, 2022

csharp

Generated file changes for csharp

Uh oh!

github-actions bot commented Nov 1, 2022

csharp

Generated file changes for csharp

Uh oh!

Uh oh!

JarLob commented Nov 1, 2022

Uh oh!

michaelnebel commented Nov 2, 2022

Uh oh!

github-actions bot commented Nov 2, 2022

csharp

Generated file changes for csharp

Uh oh!

github-actions bot commented Nov 2, 2022

csharp

Generated file changes for csharp

Uh oh!

Uh oh!

JarLob commented Nov 2, 2022

Uh oh!

hvitved commented Nov 2, 2022

Uh oh!

github-actions bot commented Nov 29, 2022

csharp

Generated file changes for csharp

Uh oh!

JarLob commented Nov 29, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JarLob commented Nov 29, 2022 •

edited

Loading