Skip to content

Commit 49d3356

Browse files
committed
C#: Re-factor FlowToDataSerializerConstructor to use the new API.
1 parent 5964daa commit 49d3356

File tree

1 file changed

+7
-7
lines changed

1 file changed

+7
-7
lines changed

csharp/ql/src/experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.ql

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,16 @@ predicate unsafeDataContractTypeCreation(Expr e) {
3131
e.(TypeofExpr).getTypeAccess().getTarget() instanceof DataSetOrTableRelatedClass
3232
}
3333

34-
class Conf extends DataFlow::Configuration {
35-
Conf() { this = "FlowToDataSerializerConstructor" }
34+
module FlowToDataSerializerConstructorConfig implements DataFlow::ConfigSig {
35+
predicate isSource(DataFlow::Node node) { unsafeDataContractTypeCreation(node.asExpr()) }
3636

37-
override predicate isSource(DataFlow::Node node) { unsafeDataContractTypeCreation(node.asExpr()) }
38-
39-
override predicate isSink(DataFlow::Node node) { xmlSerializerConstructorArgument(node.asExpr()) }
37+
predicate isSink(DataFlow::Node node) { xmlSerializerConstructorArgument(node.asExpr()) }
4038
}
4139

42-
from Conf conf, DataFlow::Node source, DataFlow::Node sink
43-
where conf.hasFlow(source, sink)
40+
module FlowToDataSerializerConstructor = DataFlow::Global<FlowToDataSerializerConstructorConfig>;
41+
42+
from DataFlow::Node source, DataFlow::Node sink
43+
where FlowToDataSerializerConstructor::flow(source, sink)
4444
select sink,
4545
"Unsafe type is used in data contract serializer. Make sure $@ comes from the trusted source.",
4646
source, source.toString()

0 commit comments

Comments
 (0)