Skip to content

Commit 8d5ca53

Browse files
committed
C#: Re-refactor another SettingsDataFlow to use the new API.
1 parent 5b85443 commit 8d5ca53

File tree

1 file changed

+9
-9
lines changed

1 file changed

+9
-9
lines changed

csharp/ql/lib/semmle/code/csharp/security/xml/InsecureXMLQuery.qll

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -172,26 +172,24 @@ module XmlReader {
172172
isNetFrameworkBefore(this.(MethodCall).getTarget().getDeclaringType(), "4.0")
173173
or
174174
// bad settings flow here
175-
exists(SettingsDataFlowConfig flow, ObjectCreation settings |
176-
flow.hasFlow(DataFlow::exprNode(settings), DataFlow::exprNode(this.getSettings())) and
175+
exists(ObjectCreation settings |
176+
SettingsDataFlow::flow(DataFlow::exprNode(settings), DataFlow::exprNode(this.getSettings())) and
177177
XmlSettings::dtdEnabledSettings(settings, evidence, reason)
178178
)
179179
}
180180

181181
private predicate insecureResolver(string reason, Expr evidence) {
182182
// bad settings flow here
183-
exists(SettingsDataFlowConfig flow, ObjectCreation settings |
184-
flow.hasFlow(DataFlow::exprNode(settings), DataFlow::exprNode(this.getSettings())) and
183+
exists(ObjectCreation settings |
184+
SettingsDataFlow::flow(DataFlow::exprNode(settings), DataFlow::exprNode(this.getSettings())) and
185185
XmlSettings::insecureResolverSettings(settings, evidence, reason)
186186
)
187187
// default is secure
188188
}
189189
}
190190

191-
private class SettingsDataFlowConfig extends DataFlow2::Configuration {
192-
SettingsDataFlowConfig() { this = "SettingsDataFlowConfig" }
193-
194-
override predicate isSource(DataFlow::Node source) {
191+
private module SettingsDataFlowConfig implements DataFlow::ConfigSig {
192+
predicate isSource(DataFlow::Node source) {
195193
// flow from places where we construct an XmlReaderSettings
196194
source
197195
.asExpr()
@@ -202,10 +200,12 @@ module XmlReader {
202200
.hasQualifiedName("System.Xml", "XmlReaderSettings")
203201
}
204202

205-
override predicate isSink(DataFlow::Node sink) {
203+
predicate isSink(DataFlow::Node sink) {
206204
sink.asExpr() = any(InsecureXmlReaderCreate create).getSettings()
207205
}
208206
}
207+
208+
private module SettingsDataFlow = DataFlow::Global<SettingsDataFlowConfig>;
209209
}
210210

211211
/** Provides predicates related to `System.Xml.XmlTextReader`. */

0 commit comments

Comments
 (0)