Skip to content

Commit 3247794

Browse files
tamasvajktamasvajk
authored
Merge pull request github#6196 from tamasvajk/feature/sql-sinks
C#: Migrate SQL sinks to CSV format
2 parents 6a78aa7 + 8232698 commit 3247794

File tree

7 files changed

+260
-97
lines changed

7 files changed

+260
-97
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ private module Frameworks {
8989
private import semmle.code.csharp.frameworks.System
9090
private import semmle.code.csharp.security.dataflow.XSSSinks
9191
private import semmle.code.csharp.frameworks.ServiceStack
92+
private import semmle.code.csharp.frameworks.Sql
93+
private import semmle.code.csharp.frameworks.EntityFramework
9294
}
9395

9496
/**

‎csharp/ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ private import semmle.code.csharp.frameworks.system.data.Entity
99
private import semmle.code.csharp.frameworks.system.collections.Generic
1010
private import semmle.code.csharp.frameworks.Sql
1111
private import semmle.code.csharp.dataflow.FlowSummary
12+
private import semmle.code.csharp.dataflow.ExternalFlow
1213
private import semmle.code.csharp.dataflow.internal.DataFlowPrivate as DataFlowPrivate
1314

1415
/**
@@ -234,26 +235,29 @@ module EntityFramework {
234235
override Expr getSql() { result = this.getArgumentForParameter(sqlParam) }
235236
}
236237

237-
/** A call to `System.Data.Entity.DbSet.SqlQuery`. */
238-
class SystemDataEntityDbSetSqlExpr extends SqlExpr, MethodCall {
239-
SystemDataEntityDbSetSqlExpr() {
240-
this.getTarget() = any(SystemDataEntity::DbSet dbSet).getSqlQueryMethod()
238+
/** The sink method `System.Data.Entity.DbSet.SqlQuery`. */
239+
private class SystemDataEntityDbSetSqlQuerySinkModelCsv extends SinkModelCsv {
240+
override predicate row(string row) {
241+
row =
242+
["System.Data.Entity;DbSet;false;SqlQuery;(System.String,System.Object[]);;Argument[0];sql"]
241243
}
242-
243-
override Expr getSql() { result = this.getArgumentForName("sql") }
244244
}
245245

246-
/** A call to a method in `System.Data.Entity.Database` that executes SQL. */
247-
class SystemDataEntityDatabaseSqlExpr extends SqlExpr, MethodCall {
248-
SystemDataEntityDatabaseSqlExpr() {
249-
exists(SystemDataEntity::Database db |
250-
this.getTarget() = db.getSqlQueryMethod() or
251-
this.getTarget() = db.getExecuteSqlCommandMethod() or
252-
this.getTarget() = db.getExecuteSqlCommandAsyncMethod()
253-
)
246+
/** A sink method in `System.Data.Entity.Database` that executes SQL. */
247+
private class SystemDataEntityDatabaseSinkModelCsv extends SinkModelCsv {
248+
override predicate row(string row) {
249+
row =
250+
[
251+
"System.Data.Entity;Database;false;SqlQuery;(System.Type,System.String,System.Object[]);;Argument[1];sql",
252+
"System.Data.Entity;Database;false;SqlQuery<>;(System.String,System.Object[]);;Argument[0];sql",
253+
"System.Data.Entity;Database;false;ExecuteSqlCommand;(System.String,System.Object[]);;Argument[0];sql",
254+
"System.Data.Entity;Database;false;ExecuteSqlCommand;(System.Data.Entity.TransactionalBehavior,System.String,System.Object[]);;Argument[1];sql",
255+
"System.Data.Entity;Database;false;ExecuteSqlCommandAsync;(System.Data.Entity.TransactionalBehavior,System.String,System.Threading.CancellationToken,System.Object[]);;Argument[1];sql",
256+
"System.Data.Entity;Database;false;ExecuteSqlCommandAsync;(System.String,System.Threading.CancellationToken,System.Object[]);;Argument[0];sql",
257+
"System.Data.Entity;Database;false;ExecuteSqlCommandAsync;(System.String,System.Object[]);;Argument[0];sql",
258+
"System.Data.Entity;Database;false;ExecuteSqlCommandAsync;(System.Data.Entity.TransactionalBehavior,System.String,System.Object[]);;Argument[1];sql"
259+
]
254260
}
255-
256-
override Expr getSql() { result = this.getArgumentForName("sql") }
257261
}
258262

259263
/** Holds if `t` is compatible with a DB column type. */

‎csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll

Lines changed: 207 additions & 41 deletions
Large diffs are not rendered by default.

‎csharp/ql/test/library-tests/frameworks/sql/Sql1.expected

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
1-
| sql.cs:66:46:66:65 | object creation of type SqlCommand | sql.cs:66:61:66:64 | access to parameter text |
2-
| sql.cs:67:23:67:44 | object creation of type MySqlCommand | sql.cs:67:40:67:43 | access to parameter text |
3-
| sql.cs:68:13:68:38 | ... = ... | sql.cs:68:35:68:38 | access to parameter text |
4-
| sql.cs:69:13:69:34 | object creation of type MySqlCommand | sql.cs:69:30:69:33 | access to parameter text |
5-
| sql.cs:69:13:69:53 | ... = ... | sql.cs:69:50:69:53 | access to parameter text |
6-
| sql.cs:70:13:70:36 | object creation of type SqlDataAdapter | sql.cs:70:32:70:35 | access to parameter text |
7-
| sql.cs:71:13:71:47 | call to method ExecuteScalar | sql.cs:71:43:71:46 | access to parameter text |
8-
| sql.cs:72:13:72:45 | call to method ExecuteScalar | sql.cs:72:41:72:44 | access to parameter text |
1+
sqlExpressions
2+
| sql.cs:44:23:44:44 | object creation of type MySqlCommand | sql.cs:44:40:44:43 | access to parameter text |
3+
| sql.cs:45:13:45:38 | ... = ... | sql.cs:45:35:45:38 | access to parameter text |
4+
| sql.cs:46:13:46:34 | object creation of type MySqlCommand | sql.cs:46:30:46:33 | access to parameter text |
5+
| sql.cs:46:13:46:53 | ... = ... | sql.cs:46:50:46:53 | access to parameter text |
6+
sqlCsvSinks
7+
| sql.cs:43:46:43:65 | object creation of type SqlCommand | sql.cs:43:61:43:64 | access to parameter text |
8+
| sql.cs:47:13:47:42 | object creation of type SqlDataAdapter | sql.cs:47:32:47:35 | access to parameter text |
9+
| sql.cs:48:13:48:47 | call to method ExecuteScalar | sql.cs:48:43:48:46 | access to parameter text |
10+
| sql.cs:49:13:49:75 | call to method ExecuteScalar | sql.cs:49:71:49:74 | access to parameter text |

‎csharp/ql/test/library-tests/frameworks/sql/Sql1.ql

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
11
import semmle.code.csharp.frameworks.Sql
2+
import semmle.code.csharp.dataflow.ExternalFlow
3+
import semmle.code.csharp.dataflow.internal.DataFlowPublic
24

3-
from SqlExpr se
4-
select se, se.getSql()
5+
query predicate sqlExpressions(SqlExpr se, Expr e) { se.getSql() = e }
6+
7+
query predicate sqlCsvSinks(Element p, Expr e) {
8+
p = e.getParent() and
9+
exists(Node n |
10+
sinkNode(n, "sql") and
11+
n.asExpr() = e
12+
)
13+
}

‎csharp/ql/test/library-tests/frameworks/sql/options

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Data.cs
2+
semmle-extractor-options: ${testdir}/../../../resources/stubs/_frameworks/Microsoft.NETCore.App/System.ComponentModel.cs
3+
semmle-extractor-options: /r:System.ComponentModel.TypeConverter.dll /r:System.Data.Common.dll

‎csharp/ql/test/library-tests/frameworks/sql/sql.cs

Lines changed: 7 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,5 @@
11
using System;
22

3-
namespace System.Data
4-
{
5-
public interface IDbCommand
6-
{
7-
string CommandText { get; set; }
8-
}
9-
10-
public interface IDbDataAdapter { }
11-
}
12-
13-
namespace System.Data.SqlClient
14-
{
15-
public class SqlCommand : IDbCommand
16-
{
17-
public SqlCommand(string commandText) { }
18-
19-
string IDbCommand.CommandText { get; set; }
20-
}
21-
22-
public class SqlDataAdapter : IDbDataAdapter
23-
{
24-
public SqlDataAdapter() { }
25-
26-
public SqlDataAdapter(string sql) { }
27-
}
28-
}
29-
303
namespace MySql.Data.MySqlClient
314
{
325
using System.Data;
@@ -36,6 +9,10 @@ public class MySqlCommand : IDbCommand
369
public MySqlCommand(string commandText) { }
3710

3811
public string CommandText { get; set; }
12+
13+
public IDataReader ExecuteReader() => throw null;
14+
public CommandType CommandType { get; set; }
15+
public IDataParameterCollection Parameters { get; set; }
3916
}
4017

4118
public class MySqlHelper
@@ -48,7 +25,7 @@ namespace Microsoft.ApplicationBlocks.Data
4825
{
4926
class SqlHelper
5027
{
51-
public static object ExecuteScalar(string connectionString, string commandText) { return null; }
28+
public static object ExecuteScalar(string connectionString, System.Data.CommandType ct, string commandText) { return null; }
5229
}
5330
}
5431

@@ -67,9 +44,9 @@ public static void TestMethod(string text)
6744
command = new MySqlCommand(text);
6845
command.CommandText = text;
6946
new MySqlCommand(text).CommandText = text;
70-
new SqlDataAdapter(text);
47+
new SqlDataAdapter(text, null);
7148
MySqlHelper.ExecuteScalar("", text);
72-
SqlHelper.ExecuteScalar("", text);
49+
SqlHelper.ExecuteScalar("", System.Data.CommandType.Text, text);
7350
}
7451
}
7552
}

0 commit comments

Comments
 (0)