Skip to content

Commit 3210a96

Browse files
committed
C#: Fix ExternalAPISUsedWithUntrustedData compilation errors.
1 parent 9ee52d7 commit 3210a96

File tree

1 file changed

+16
-3
lines changed

1 file changed

+16
-3
lines changed

csharp/src/library_sources/ExternalAPIsQuery.qll

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,21 @@ private import semmle.code.csharp.dataflow.FlowSummary
1111
// SECLAB: Import CSV utils
1212
private import semmle.code.csharp.dataflow.internal.ExternalFlow as ExternalFlow
1313

14-
// SECLAB: Import Csv::asPartialModel
15-
predicate asPartialModel = ExternalFlow::asPartialModel/1;
14+
/**
15+
* Computes the first 6 columns for MaD rows used for summaries, sources and sinks.
16+
*/
17+
private string asPartialModel(Callable api) {
18+
exists(string container, string type, string extensible, string name, string parameters |
19+
ExternalFlow::partialModel(api, container, type, extensible, name, parameters) and
20+
result =
21+
container + ";" //
22+
+ type + ";" //
23+
+ extensible + ";" //
24+
+ name + ";" //
25+
+ parameters + ";" //
26+
+ /* ext + */ ";" //
27+
)
28+
}
1629

1730
/**
1831
* A callable that is considered a "safe" external API from a security perspective.
@@ -100,7 +113,7 @@ deprecated class UntrustedDataToExternalApiConfig extends TaintTracking::Configu
100113

101114
/** A configuration for tracking flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s. */
102115
private module RemoteSourceToExternalApiConfig implements DataFlow::ConfigSig {
103-
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
116+
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
104117

105118
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
106119
}

0 commit comments

Comments
 (0)