@@ -15,12 +15,10 @@ import semmle.code.csharp.security.SensitiveActions
15
15
import semmle.code.csharp.security.dataflow.flowsinks.Remote
16
16
import semmle.code.csharp.frameworks.system.data.Common
17
17
import semmle.code.csharp.frameworks.System
18
- import semmle.code.csharp.dataflow.DataFlow :: DataFlow :: PathGraph
18
+ import ExposureInTransmittedData :: PathGraph
19
19
20
- class TaintTrackingConfiguration extends TaintTracking:: Configuration {
21
- TaintTrackingConfiguration ( ) { this = "Exposure through transmitted data" }
22
-
23
- override predicate isSource ( DataFlow:: Node source ) {
20
+ module ExposureInTransmittedDataConfig implements DataFlow:: ConfigSig {
21
+ predicate isSource ( DataFlow:: Node source ) {
24
22
// `source` may contain a password
25
23
source .asExpr ( ) instanceof PasswordExpr
26
24
or
@@ -42,10 +40,12 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
42
40
)
43
41
}
44
42
45
- override predicate isSink ( DataFlow:: Node sink ) { sink instanceof RemoteFlowSink }
43
+ predicate isSink ( DataFlow:: Node sink ) { sink instanceof RemoteFlowSink }
46
44
}
47
45
48
- from TaintTrackingConfiguration configuration , DataFlow:: PathNode source , DataFlow:: PathNode sink
49
- where configuration .hasFlowPath ( source , sink )
46
+ module ExposureInTransmittedData = TaintTracking:: Global< ExposureInTransmittedDataConfig > ;
47
+
48
+ from ExposureInTransmittedData:: PathNode source , ExposureInTransmittedData:: PathNode sink
49
+ where ExposureInTransmittedData:: flowPath ( source , sink )
50
50
select sink .getNode ( ) , source , sink , "This data transmitted to the user depends on $@." ,
51
51
source .getNode ( ) , "sensitive information"
0 commit comments