Skip to content

Commit 3a9cf63

Browse files
tamasvajktamasvajk
committed
Change ServiceStack redis sinks to code injection instead of SQL injection
1 parent 5fa9f16 commit 3a9cf63

File tree

6 files changed

+72
-51
lines changed

6 files changed

+72
-51
lines changed

‎csharp/ql/lib/semmle/code/csharp/frameworks/ServiceStack.qll

Lines changed: 36 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -241,36 +241,44 @@ private class ServiceStackSqlSinkModelCsv extends SinkModelCsv {
241241
"ServiceStack.OrmLite;OrmLiteWriteApi;false;ExecuteSql;(System.Data.IDbConnection,System.String,System.Object);;Argument[1];sql",
242242
"ServiceStack.OrmLite;OrmLiteWriteApi;false;ExecuteSql;(System.Data.IDbConnection,System.String,System.Collections.Generic.Dictionary<System.String,System.Object>);;Argument[1];sql",
243243
"ServiceStack.OrmLite;OrmLiteWriteApiAsync;false;ExecuteSqlAsync;(System.Data.IDbConnection,System.String,System.Threading.CancellationToken);;Argument[1];sql",
244-
"ServiceStack.OrmLite;OrmLiteWriteApiAsync;false;ExecuteSqlAsync;(System.Data.IDbConnection,System.String,System.Object,System.Threading.CancellationToken);;Argument[1];sql",
244+
"ServiceStack.OrmLite;OrmLiteWriteApiAsync;false;ExecuteSqlAsync;(System.Data.IDbConnection,System.String,System.Object,System.Threading.CancellationToken);;Argument[1];sql"
245+
]
246+
}
247+
}
248+
249+
private class ServiceStackCodeInjectionSinkModelCsv extends SinkModelCsv {
250+
override predicate row(string row) {
251+
row =
252+
[
245253
// Redis API
246-
"ServiceStack.Redis;IRedisClient;true;Custom;(System.Object[]);;Argument[0];sql",
247-
"ServiceStack.Redis;IRedisClient;true;ExecCachedLua;(System.String,System.Func<System.String,T>);;Argument[0];sql",
248-
"ServiceStack.Redis;IRedisClient;true;ExecLua;(System.String,System.String[],System.String[]);;Argument[0];sql",
249-
"ServiceStack.Redis;IRedisClient;true;ExecLua;(System.String,System.String[]);;Argument[0];sql",
250-
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsInt;(System.String,System.String[],System.String[]);;Argument[0];sql",
251-
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsInt;(System.String,System.String[]);;Argument[0];sql",
252-
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsList;(System.String,System.String[],System.String[]);;Argument[0];sql",
253-
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsList;(System.String,System.String[]);;Argument[0];sql",
254-
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsString;(System.String,System.String[],System.String[]);;Argument[0];sql",
255-
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsString;(System.String,System.String[]);;Argument[0];sql",
256-
"ServiceStack.Redis;IRedisClient;true;LoadLuaScript;(System.String);;Argument[0];sql",
254+
"ServiceStack.Redis;IRedisClient;true;Custom;(System.Object[]);;Argument[0];code",
255+
"ServiceStack.Redis;IRedisClient;true;ExecCachedLua;(System.String,System.Func<System.String,T>);;Argument[0];code",
256+
"ServiceStack.Redis;IRedisClient;true;ExecLua;(System.String,System.String[],System.String[]);;Argument[0];code",
257+
"ServiceStack.Redis;IRedisClient;true;ExecLua;(System.String,System.String[]);;Argument[0];code",
258+
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsInt;(System.String,System.String[],System.String[]);;Argument[0];code",
259+
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsInt;(System.String,System.String[]);;Argument[0];code",
260+
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsList;(System.String,System.String[],System.String[]);;Argument[0];code",
261+
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsList;(System.String,System.String[]);;Argument[0];code",
262+
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsString;(System.String,System.String[],System.String[]);;Argument[0];code",
263+
"ServiceStack.Redis;IRedisClient;true;ExecLuaAsString;(System.String,System.String[]);;Argument[0];code",
264+
"ServiceStack.Redis;IRedisClient;true;LoadLuaScript;(System.String);;Argument[0];code",
257265
// IRedisClientAsync
258-
"ServiceStack.Redis;IRedisClientAsync;true;CustomAsync;(System.Object[]);;Argument[0];sql",
259-
"ServiceStack.Redis;IRedisClientAsync;true;CustomAsync;(System.Object[],System.Threading.CancellationToken);;Element of Argument[0];sql",
260-
"ServiceStack.Redis;IRedisClientAsync;true;ExecCachedLuaAsync;(System.String,System.Func<System.String,System.Threading.Tasks.ValueTask<T>>,System.Threading.CancellationToken);;Argument[0];sql",
261-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsync;(System.String,System.String[],System.String[],System.Threading.CancellationToken);;Argument[0];sql",
262-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsync;(System.String,System.String[],System.Threading.CancellationToken);;Argument[0];sql",
263-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsync;(System.String,System.String[]);;Argument[0];sql",
264-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsIntAsync;(System.String,System.String[],System.String[],System.Threading.CancellationToken);;Argument[0];sql",
265-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsIntAsync;(System.String,System.String[],System.Threading.CancellationToken);;Argument[0];sql",
266-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsIntAsync;(System.String,System.String[]);;Argument[0];sql",
267-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsStringAsync;(System.String,System.String[],System.String[],System.Threading.CancellationToken);;Argument[0];sql",
268-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsStringAsync;(System.String,System.String[],System.Threading.CancellationToken);;Argument[0];sql",
269-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsStringAsync;(System.String,System.String[]);;Argument[0];sql",
270-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsListAsync;(System.String,System.String[],System.String[],System.Threading.CancellationToken);;Argument[0];sql",
271-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsListAsync;(System.String,System.String[],System.Threading.CancellationToken);;Argument[0];sql",
272-
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsListAsync;(System.String,System.String[]);;Argument[0];sql",
273-
"ServiceStack.Redis;IRedisClientAsync;true;LoadLuaScriptAsync;(System.String,System.Threading.CancellationToken);;Argument[0];sql"
266+
"ServiceStack.Redis;IRedisClientAsync;true;CustomAsync;(System.Object[]);;Argument[0];code",
267+
"ServiceStack.Redis;IRedisClientAsync;true;CustomAsync;(System.Object[],System.Threading.CancellationToken);;Element of Argument[0];code",
268+
"ServiceStack.Redis;IRedisClientAsync;true;ExecCachedLuaAsync;(System.String,System.Func<System.String,System.Threading.Tasks.ValueTask<T>>,System.Threading.CancellationToken);;Argument[0];code",
269+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsync;(System.String,System.String[],System.String[],System.Threading.CancellationToken);;Argument[0];code",
270+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsync;(System.String,System.String[],System.Threading.CancellationToken);;Argument[0];code",
271+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsync;(System.String,System.String[]);;Argument[0];code",
272+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsIntAsync;(System.String,System.String[],System.String[],System.Threading.CancellationToken);;Argument[0];code",
273+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsIntAsync;(System.String,System.String[],System.Threading.CancellationToken);;Argument[0];code",
274+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsIntAsync;(System.String,System.String[]);;Argument[0];code",
275+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsStringAsync;(System.String,System.String[],System.String[],System.Threading.CancellationToken);;Argument[0];code",
276+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsStringAsync;(System.String,System.String[],System.Threading.CancellationToken);;Argument[0];code",
277+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsStringAsync;(System.String,System.String[]);;Argument[0];code",
278+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsListAsync;(System.String,System.String[],System.String[],System.Threading.CancellationToken);;Argument[0];code",
279+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsListAsync;(System.String,System.String[],System.Threading.CancellationToken);;Argument[0];code",
280+
"ServiceStack.Redis;IRedisClientAsync;true;ExecLuaAsListAsync;(System.String,System.String[]);;Argument[0];code",
281+
"ServiceStack.Redis;IRedisClientAsync;true;LoadLuaScriptAsync;(System.String,System.Threading.CancellationToken);;Argument[0];code"
274282
]
275283
}
276284
}

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ private import semmle.code.csharp.security.dataflow.flowsources.Remote
77
private import semmle.code.csharp.security.dataflow.flowsources.Local
88
private import semmle.code.csharp.frameworks.system.codedom.Compiler
99
private import semmle.code.csharp.security.Sanitizers
10+
private import semmle.code.csharp.dataflow.ExternalFlow
1011

1112
/**
1213
* A data flow source for user input treated as code vulnerabilities.
@@ -79,3 +80,8 @@ class RoslynCSharpScriptSink extends Sink {
7980
)
8081
}
8182
}
83+
84+
/** Code injection sinks defined through CSV models. */
85+
private class ExternalCodeInjectionExprSink extends Sink {
86+
ExternalCodeInjectionExprSink() { sinkNode(this, "code") }
87+
}

‎csharp/ql/test/library-tests/frameworks/ServiceStack/SinksSql.cs renamed to ‎csharp/ql/test/library-tests/frameworks/ServiceStack/SinksInjection.cs

File renamed without changes.

‎csharp/ql/test/library-tests/frameworks/ServiceStack/codeInjectionSinks.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| SinksInjection.cs:64:42:64:49 | "script" | SinksInjection.cs:64:42:64:49 | "script" |
2+
| SinksInjection.cs:65:28:65:35 | "script" | SinksInjection.cs:65:28:65:35 | "script" |
3+
| SinksInjection.cs:70:54:70:61 | "script" | SinksInjection.cs:70:54:70:61 | "script" |
4+
| SinksInjection.cs:71:38:71:45 | "script" | SinksInjection.cs:71:38:71:45 | "script" |

‎csharp/ql/test/library-tests/frameworks/ServiceStack/codeInjectionSinks.ql

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
import semmle.code.csharp.security.dataflow.CodeInjectionQuery
2+
3+
from Sink sink
4+
where
5+
sink.getLocation().getFile().fromSource() and
6+
not sink.getLocation().getFile().getAbsolutePath().matches("%/resources/stubs/%")
7+
select sink, sink.getExpr()

‎csharp/ql/test/library-tests/frameworks/ServiceStack/sqlSink.expected

Lines changed: 19 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,19 @@
1-
| SinksSql.cs:25:28:25:32 | "SQL" | SinksSql.cs:25:28:25:32 | "SQL" |
2-
| SinksSql.cs:26:29:26:33 | "SQL" | SinksSql.cs:26:29:26:33 | "SQL" |
3-
| SinksSql.cs:27:32:27:36 | "SQL" | SinksSql.cs:27:32:27:36 | "SQL" |
4-
| SinksSql.cs:28:31:28:35 | "SQL" | SinksSql.cs:28:31:28:35 | "SQL" |
5-
| SinksSql.cs:29:27:29:31 | "SQL" | SinksSql.cs:29:27:29:31 | "SQL" |
6-
| SinksSql.cs:30:32:30:36 | "SQL" | SinksSql.cs:30:32:30:36 | "SQL" |
7-
| SinksSql.cs:31:31:31:35 | "SQL" | SinksSql.cs:31:31:31:35 | "SQL" |
8-
| SinksSql.cs:32:30:32:34 | "SQL" | SinksSql.cs:32:30:32:34 | "SQL" |
9-
| SinksSql.cs:37:28:37:32 | "SQL" | SinksSql.cs:37:28:37:32 | "SQL" |
10-
| SinksSql.cs:38:29:38:33 | "SQL" | SinksSql.cs:38:29:38:33 | "SQL" |
11-
| SinksSql.cs:39:27:39:31 | "SQL" | SinksSql.cs:39:27:39:31 | "SQL" |
12-
| SinksSql.cs:40:31:40:35 | "SQL" | SinksSql.cs:40:31:40:35 | "SQL" |
13-
| SinksSql.cs:41:30:41:34 | "SQL" | SinksSql.cs:41:30:41:34 | "SQL" |
14-
| SinksSql.cs:48:58:48:62 | "SQL" | SinksSql.cs:48:58:48:62 | "SQL" |
15-
| SinksSql.cs:49:65:49:69 | "SQL" | SinksSql.cs:49:65:49:69 | "SQL" |
16-
| SinksSql.cs:51:39:51:43 | "SQL" | SinksSql.cs:51:39:51:43 | "SQL" |
17-
| SinksSql.cs:52:46:52:50 | "SQL" | SinksSql.cs:52:46:52:50 | "SQL" |
18-
| SinksSql.cs:54:29:54:33 | "SQL" | SinksSql.cs:54:29:54:33 | "SQL" |
19-
| SinksSql.cs:55:40:55:44 | "SQL" | SinksSql.cs:55:40:55:44 | "SQL" |
20-
| SinksSql.cs:64:42:64:49 | "script" | SinksSql.cs:64:42:64:49 | "script" |
21-
| SinksSql.cs:65:28:65:35 | "script" | SinksSql.cs:65:28:65:35 | "script" |
22-
| SinksSql.cs:70:54:70:61 | "script" | SinksSql.cs:70:54:70:61 | "script" |
23-
| SinksSql.cs:71:38:71:45 | "script" | SinksSql.cs:71:38:71:45 | "script" |
1+
| SinksInjection.cs:25:28:25:32 | "SQL" | SinksInjection.cs:25:28:25:32 | "SQL" |
2+
| SinksInjection.cs:26:29:26:33 | "SQL" | SinksInjection.cs:26:29:26:33 | "SQL" |
3+
| SinksInjection.cs:27:32:27:36 | "SQL" | SinksInjection.cs:27:32:27:36 | "SQL" |
4+
| SinksInjection.cs:28:31:28:35 | "SQL" | SinksInjection.cs:28:31:28:35 | "SQL" |
5+
| SinksInjection.cs:29:27:29:31 | "SQL" | SinksInjection.cs:29:27:29:31 | "SQL" |
6+
| SinksInjection.cs:30:32:30:36 | "SQL" | SinksInjection.cs:30:32:30:36 | "SQL" |
7+
| SinksInjection.cs:31:31:31:35 | "SQL" | SinksInjection.cs:31:31:31:35 | "SQL" |
8+
| SinksInjection.cs:32:30:32:34 | "SQL" | SinksInjection.cs:32:30:32:34 | "SQL" |
9+
| SinksInjection.cs:37:28:37:32 | "SQL" | SinksInjection.cs:37:28:37:32 | "SQL" |
10+
| SinksInjection.cs:38:29:38:33 | "SQL" | SinksInjection.cs:38:29:38:33 | "SQL" |
11+
| SinksInjection.cs:39:27:39:31 | "SQL" | SinksInjection.cs:39:27:39:31 | "SQL" |
12+
| SinksInjection.cs:40:31:40:35 | "SQL" | SinksInjection.cs:40:31:40:35 | "SQL" |
13+
| SinksInjection.cs:41:30:41:34 | "SQL" | SinksInjection.cs:41:30:41:34 | "SQL" |
14+
| SinksInjection.cs:48:58:48:62 | "SQL" | SinksInjection.cs:48:58:48:62 | "SQL" |
15+
| SinksInjection.cs:49:65:49:69 | "SQL" | SinksInjection.cs:49:65:49:69 | "SQL" |
16+
| SinksInjection.cs:51:39:51:43 | "SQL" | SinksInjection.cs:51:39:51:43 | "SQL" |
17+
| SinksInjection.cs:52:46:52:50 | "SQL" | SinksInjection.cs:52:46:52:50 | "SQL" |
18+
| SinksInjection.cs:54:29:54:33 | "SQL" | SinksInjection.cs:54:29:54:33 | "SQL" |
19+
| SinksInjection.cs:55:40:55:44 | "SQL" | SinksInjection.cs:55:40:55:44 | "SQL" |

0 commit comments

Comments
 (0)