Merge pull request github#6461 from tamasvajk/feature/service-stack

C#: Add ServiceStack support

Author: tamasvajk

csharp/change-notes/2021-09-09-service-stack-support.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* added support for ServiceStack framework with support for SQL injection, XSS and external API calls

csharp/documentation/library-coverage/frameworks.csv

@@ -1,2 +1,3 @@
 Framework name,URL,Namespace prefixes
 System,,System.* System
+ServiceStack,https://servicestack.net/,ServiceStack.* ServiceStack

csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

@@ -88,6 +88,7 @@ private module Frameworks {
   private import semmle.code.csharp.security.dataflow.flowsinks.Html
   private import semmle.code.csharp.frameworks.System
   private import semmle.code.csharp.security.dataflow.XSSSinks
+  private import semmle.code.csharp.frameworks.ServiceStack
 }
 
 /**

csharp/ql/lib/semmle/code/csharp/frameworks/ServiceStack.qll

@@ -7,6 +7,7 @@ private import semmle.code.csharp.security.dataflow.flowsources.Remote
 private import semmle.code.csharp.security.dataflow.flowsources.Local
 private import semmle.code.csharp.frameworks.system.codedom.Compiler
 private import semmle.code.csharp.security.Sanitizers
+private import semmle.code.csharp.dataflow.ExternalFlow
 
 /**
  * A data flow source for user input treated as code vulnerabilities.
@@ -79,3 +80,8 @@ class RoslynCSharpScriptSink extends Sink {
     )
   }
 }
+
+/** Code injection sinks defined through CSV models. */
+private class ExternalCodeInjectionExprSink extends Sink {
+  ExternalCodeInjectionExprSink() { sinkNode(this, "code") }
+}

csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll

@@ -7,6 +7,7 @@ private import semmle.code.csharp.security.dataflow.flowsources.Remote
 private import semmle.code.csharp.security.dataflow.flowsources.Local
 private import semmle.code.csharp.frameworks.Sql
 private import semmle.code.csharp.security.Sanitizers
+private import semmle.code.csharp.dataflow.ExternalFlow
 
 /**
  * A source specific to SQL injection vulnerabilities.
@@ -51,6 +52,11 @@ class SqlInjectionExprSink extends Sink {
   SqlInjectionExprSink() { exists(SqlExpr s | this.getExpr() = s.getSql()) }
 }
 
+/** SQL sinks defined through CSV models. */
+private class ExternalSqlInjectionExprSink extends Sink {
+  ExternalSqlInjectionExprSink() { sinkNode(this, "sql") }
+}
+
 private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }
 
 private class GuidSanitizer extends Sanitizer, GuidSanitizedExpr { }

csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll

@@ -10,6 +10,7 @@ private import semmle.code.csharp.frameworks.system.web.UI
 private import semmle.code.csharp.security.dataflow.flowsinks.Html
 private import semmle.code.csharp.security.dataflow.flowsinks.Remote
 private import semmle.code.csharp.dataflow.ExternalFlow
+private import semmle.code.csharp.frameworks.ServiceStack::XSS
 
 /**
  * A data flow sink for cross-site scripting (XSS) vulnerabilities.

csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSSinks.qll

@@ -6,6 +6,7 @@ import csharp
 private import Remote
 private import semmle.code.csharp.commons.Loggers
 private import semmle.code.csharp.frameworks.system.Web
+private import semmle.code.csharp.dataflow.ExternalFlow
 
 /**
  * An external location sink.
@@ -16,6 +17,10 @@ private import semmle.code.csharp.frameworks.system.Web
  */
 abstract class ExternalLocationSink extends DataFlow::ExprNode { }
 
+private class ExternalModelSink extends ExternalLocationSink {
+  ExternalModelSink() { sinkNode(this, "remote") }
+}
+
 /**
  * An argument to a call to a method on a logger class.
  */

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll

@@ -0,0 +1,61 @@
+using System.Collections.Generic;
+using System.Linq;
+using ServiceStack;
+using System.Threading.Tasks;
+using System;
+using Microsoft.Extensions.ObjectPool;
+using System.IO;
+
+namespace ServiceStackTest
+{
+    public class ResponseDto { }
+    public class ReqDto1 : IReturn<ResponseDto> { }
+
+    public class ReqDto2 : IReturnVoid { }
+
+    public class C
+    {
+        public async Task M()
+        {
+            var client = new JsonServiceClient("");
+
+            client.DeserializeFromStream<object>(new MemoryStream());   // not a sink
+
+            client.Get(new ReqDto1());
+            client.Get(new ReqDto2());
+            client.Get<ResponseDto>("relativeOrAbsoluteUrl");           // not a sink
+            client.Get<ResponseDto>(new object());
+            client.Get("relativeOrAbsoluteUrl");                        // not a sink
+            client.Get(new object());
+
+            await client.GetAsync<ResponseDto>("relativeOrAbsoluteUrl");    // not a sink
+            await client.GetAsync<ResponseDto>(new object());
+            await client.GetAsync(new ReqDto1());
+            await client.GetAsync(new ReqDto2());
+
+
+            client.CustomMethod("GET", new ReqDto2());
+            client.CustomMethod<ResponseDto>("GET", "relativeOrAbsoluteUrl", new ReqDto1());
+            client.CustomMethod<ResponseDto>("GET", new ReqDto1());
+            client.CustomMethod<ResponseDto>("GET", new object());
+            client.CustomMethod("GET", "relativeOrAbsoluteUrl", new object());
+            client.CustomMethod("GET", (IReturnVoid)null);
+            await client.CustomMethodAsync("GET", new ReqDto2());
+            await client.CustomMethodAsync<ResponseDto>("GET", "relativeOrAbsoluteUrl", new ReqDto1());
+            await client.CustomMethodAsync<ResponseDto>("GET", new ReqDto1());
+            await client.CustomMethodAsync<ResponseDto>("GET", new object());
+
+            client.DownloadBytes("GET", "requestUri", new object());
+            await client.DownloadBytesAsync("GET", "relativeOrAbsoluteUrl", new object());
+
+            client.Head(new object());
+            client.Patch(new object());
+            client.Post(new object());
+            client.Put(new object());
+
+            client.Send<ResponseDto>(new object());
+            client.Publish(new ReqDto1());
+            client.SendOneWay(new object());
+        }
+    }
+}

csharp/ql/test/library-tests/frameworks/ServiceStack/SinksExternal.cs

@@ -0,0 +1,74 @@
+using System.Collections.Generic;
+using System.Linq;
+using ServiceStack;
+using System.Threading.Tasks;
+using System;
+using Microsoft.AspNetCore.Components.Forms;
+using ServiceStack.OrmLite;
+
+namespace ServiceStackTest
+{
+    public class Table
+    {
+        public int Column { get; set; }
+    }
+
+    public class Sql
+    {
+        public static async Task M()
+        {
+            ServiceStack.OrmLite.SqlExpression<int> expr = null;
+
+            expr = expr.Select<Table>(t => t.Column); // ok
+
+            expr = expr
+                .UnsafeAnd("SQL")
+                .UnsafeFrom("SQL")
+                .UnsafeGroupBy("SQL")
+                .UnsafeHaving("SQL")
+                .UnsafeOr("SQL")
+                .UnsafeOrderBy("SQL")
+                .UnsafeSelect("SQL")
+                .UnsafeWhere("SQL");
+
+            var untyped = expr.GetUntypedSqlExpression();
+
+            untyped
+                .UnsafeAnd("SQL")
+                .UnsafeFrom("SQL")
+                .UnsafeOr("SQL")
+                .UnsafeSelect("SQL")
+                .UnsafeWhere("SQL")
+                .Where("SQL");       // safe
+
+            System.Data.IDbConnection conn = null;
+
+            var row = conn.SingleById<Table>(1); // ok
+
+            var rows = conn.Select<Table>(typeof(Table), "SQL", null);
+            rows = await conn.SelectAsync<Table>(typeof(Table), "SQL", null);
+
+            var count = conn.RowCount("SQL");
+            count = await conn.RowCountAsync("SQL");
+
+            conn.ExecuteSql("SQL", null);
+            await conn.ExecuteSqlAsync("SQL", null);
+        }
+
+        public static async Task Redis()
+        {
+            ServiceStack.Redis.IRedisClient client = null;
+
+            client.SetValue("key", "value"); // ok
+
+            var s = client.LoadLuaScript("script");
+            client.ExecLua("script", new[] { "" }, new[] { "" });
+            client.ExecLuaSha("SHA", new[] { "" }, new[] { "" }); // ok
+            client.Custom("command", "arg");        // false negative, params sinks doesn't work
+
+            ServiceStack.Redis.IRedisClientAsync asyncClient = null;
+            s = await asyncClient.LoadLuaScriptAsync("script");
+            asyncClient.ExecLuaAsync("script", new[] { "" }, new[] { "" });
+        }
+    }
+}