11
11
*/
12
12
13
13
import csharp
14
- import DataFlow:: PathGraph
15
14
import experimental.code.csharp.Cryptography.NonCryptographicHashes
15
+ import DataFlowFromMethodToHash:: PathGraph
16
16
17
- class DataFlowFromMethodToHash extends TaintTracking :: Configuration {
18
- DataFlowFromMethodToHash ( ) { this = "DataFlowFromMethodNameToHashFunction" }
17
+ module DataFlowFromMethodToHashConfig implements DataFlow :: ConfigSig {
18
+ predicate isSource ( DataFlow :: Node source ) { isSuspiciousPropertyName ( source . asExpr ( ) ) }
19
19
20
- /**
21
- * Holds if `source` is a relevant data flow source.
22
- */
23
- override predicate isSource ( DataFlow:: Node source ) { isSuspiciousPropertyName ( source .asExpr ( ) ) }
24
-
25
- /**
26
- * Holds if `sink` is a relevant data flow sink.
27
- */
28
- override predicate isSink ( DataFlow:: Node sink ) { isGetHash ( sink .asExpr ( ) ) }
20
+ predicate isSink ( DataFlow:: Node sink ) { isGetHash ( sink .asExpr ( ) ) }
29
21
}
30
22
23
+ module DataFlowFromMethodToHash = TaintTracking:: Global< DataFlowFromMethodToHashConfig > ;
24
+
31
25
predicate isGetHash ( Expr arg ) {
32
26
exists ( MethodCall mc |
33
27
(
@@ -48,8 +42,8 @@ predicate isSuspiciousPropertyName(PropertyRead pr) {
48
42
pr .getTarget ( ) .hasQualifiedName ( "System.Diagnostics" , "Process" , "ProcessName" )
49
43
}
50
44
51
- from DataFlow :: PathNode src , DataFlow :: PathNode sink , DataFlowFromMethodToHash conf
52
- where conf . hasFlow ( src .getNode ( ) , sink .getNode ( ) )
45
+ from DataFlowFromMethodToHash :: PathNode src , DataFlowFromMethodToHash :: PathNode sink
46
+ where DataFlowFromMethodToHash :: flow ( src .getNode ( ) , sink .getNode ( ) )
53
47
select src .getNode ( ) , src , sink ,
54
48
"The hash is calculated on $@, may be related to a backdoor. Please review the code for possible malicious intent." ,
55
49
sink .getNode ( ) , "this process name"
0 commit comments