12
12
13
13
import csharp
14
14
import semmle.code.csharp.frameworks.Format
15
- import DataFlow :: PathGraph
15
+ import FormatInvalid :: PathGraph
16
16
17
- private class FormatConfiguration extends DataFlow:: Configuration {
18
- FormatConfiguration ( ) { this = "format" }
17
+ module FormatInvalidConfig implements DataFlow:: ConfigSig {
18
+ predicate isSource ( DataFlow :: Node n ) { n . asExpr ( ) instanceof StringLiteral }
19
19
20
- override predicate isSource ( DataFlow:: Node n ) { n .asExpr ( ) instanceof StringLiteral }
21
-
22
- override predicate isSink ( DataFlow:: Node n ) {
23
- exists ( FormatCall c | n .asExpr ( ) = c .getFormatExpr ( ) )
24
- }
20
+ predicate isSink ( DataFlow:: Node n ) { exists ( FormatCall c | n .asExpr ( ) = c .getFormatExpr ( ) ) }
25
21
}
26
22
23
+ module FormatInvalid = DataFlow:: Global< FormatInvalidConfig > ;
24
+
27
25
private predicate invalidFormatString (
28
- InvalidFormatString src , DataFlow :: PathNode source , DataFlow :: PathNode sink , string msg ,
26
+ InvalidFormatString src , FormatInvalid :: PathNode source , FormatInvalid :: PathNode sink , string msg ,
29
27
FormatCall call , string callString
30
28
) {
31
29
source .getNode ( ) .asExpr ( ) = src and
32
30
sink .getNode ( ) .asExpr ( ) = call .getFormatExpr ( ) and
33
- any ( FormatConfiguration conf ) . hasFlowPath ( source , sink ) and
31
+ FormatInvalid :: flowPath ( source , sink ) and
34
32
call .hasInsertions ( ) and
35
33
msg = "Invalid format string used in $@ formatting call." and
36
34
callString = "this"
37
35
}
38
36
39
37
private predicate unusedArgument (
40
- FormatCall call , DataFlow :: PathNode source , DataFlow :: PathNode sink , string msg ,
38
+ FormatCall call , FormatInvalid :: PathNode source , FormatInvalid :: PathNode sink , string msg ,
41
39
ValidFormatString src , string srcString , Expr unusedExpr , string unusedString
42
40
) {
43
41
exists ( int unused |
44
42
source .getNode ( ) .asExpr ( ) = src and
45
43
sink .getNode ( ) .asExpr ( ) = call .getFormatExpr ( ) and
46
- any ( FormatConfiguration conf ) . hasFlowPath ( source , sink ) and
44
+ FormatInvalid :: flowPath ( source , sink ) and
47
45
unused = call .getASuppliedArgument ( ) and
48
46
not unused = src .getAnInsert ( ) and
49
47
not src .getValue ( ) = "" and
@@ -55,13 +53,13 @@ private predicate unusedArgument(
55
53
}
56
54
57
55
private predicate missingArgument (
58
- FormatCall call , DataFlow :: PathNode source , DataFlow :: PathNode sink , string msg ,
56
+ FormatCall call , FormatInvalid :: PathNode source , FormatInvalid :: PathNode sink , string msg ,
59
57
ValidFormatString src , string srcString
60
58
) {
61
59
exists ( int used , int supplied |
62
60
source .getNode ( ) .asExpr ( ) = src and
63
61
sink .getNode ( ) .asExpr ( ) = call .getFormatExpr ( ) and
64
- any ( FormatConfiguration conf ) . hasFlowPath ( source , sink ) and
62
+ FormatInvalid :: flowPath ( source , sink ) and
65
63
used = src .getAnInsert ( ) and
66
64
supplied = call .getSuppliedArguments ( ) and
67
65
used >= supplied and
@@ -71,8 +69,8 @@ private predicate missingArgument(
71
69
}
72
70
73
71
from
74
- Element alert , DataFlow :: PathNode source , DataFlow :: PathNode sink , string msg , Element extra1 ,
75
- string extra1String , Element extra2 , string extra2String
72
+ Element alert , FormatInvalid :: PathNode source , FormatInvalid :: PathNode sink , string msg ,
73
+ Element extra1 , string extra1String , Element extra2 , string extra2String
76
74
where
77
75
invalidFormatString ( alert , source , sink , msg , extra1 , extra1String ) and
78
76
extra2 = extra1 and
0 commit comments