Skip to content

Commit e3cbeba

Browse files
committed
C#: Re-factor ProcessNameToHashTaintFlow to use the new API.
1 parent 96f9c40 commit e3cbeba

File tree

1 file changed

+8
-14
lines changed

1 file changed

+8
-14
lines changed

csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,23 +11,17 @@
1111
*/
1212

1313
import csharp
14-
import DataFlow::PathGraph
1514
import experimental.code.csharp.Cryptography.NonCryptographicHashes
15+
import DataFlowFromMethodToHash::PathGraph
1616

17-
class DataFlowFromMethodToHash extends TaintTracking::Configuration {
18-
DataFlowFromMethodToHash() { this = "DataFlowFromMethodNameToHashFunction" }
17+
module DataFlowFromMethodToHashConfig implements DataFlow::ConfigSig {
18+
predicate isSource(DataFlow::Node source) { isSuspiciousPropertyName(source.asExpr()) }
1919

20-
/**
21-
* Holds if `source` is a relevant data flow source.
22-
*/
23-
override predicate isSource(DataFlow::Node source) { isSuspiciousPropertyName(source.asExpr()) }
24-
25-
/**
26-
* Holds if `sink` is a relevant data flow sink.
27-
*/
28-
override predicate isSink(DataFlow::Node sink) { isGetHash(sink.asExpr()) }
20+
predicate isSink(DataFlow::Node sink) { isGetHash(sink.asExpr()) }
2921
}
3022

23+
module DataFlowFromMethodToHash = TaintTracking::Global<DataFlowFromMethodToHashConfig>;
24+
3125
predicate isGetHash(Expr arg) {
3226
exists(MethodCall mc |
3327
(
@@ -48,8 +42,8 @@ predicate isSuspiciousPropertyName(PropertyRead pr) {
4842
pr.getTarget().hasQualifiedName("System.Diagnostics", "Process", "ProcessName")
4943
}
5044

51-
from DataFlow::PathNode src, DataFlow::PathNode sink, DataFlowFromMethodToHash conf
52-
where conf.hasFlow(src.getNode(), sink.getNode())
45+
from DataFlowFromMethodToHash::PathNode src, DataFlowFromMethodToHash::PathNode sink
46+
where DataFlowFromMethodToHash::flow(src.getNode(), sink.getNode())
5347
select src.getNode(), src, sink,
5448
"The hash is calculated on $@, may be related to a backdoor. Please review the code for possible malicious intent.",
5549
sink.getNode(), "this process name"

0 commit comments

Comments
 (0)