Skip to content

Commit 0e8d72c

Browse files
aschackmullaschackmull
committed
C#: Add support for pretty-printed provenace in tests. Convert one test.
1 parent 4ec4da4 commit 0e8d72c

File tree

4 files changed

+63
-8
lines changed

4 files changed

+63
-8
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,44 @@ private import semmle.code.csharp.dispatch.OverridableCallable
9898
private import semmle.code.csharp.frameworks.System
9999
private import codeql.mad.ModelValidation as SharedModelVal
100100

101+
/**
102+
* Holds if the given extension tuple `madId` should pretty-print as `model`.
103+
*
104+
* This predicate should only be used in tests.
105+
*/
106+
predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
107+
exists(
108+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
109+
string output, string kind, string provenance
110+
|
111+
sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, madId) and
112+
model =
113+
"Source: " + namespace + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; "
114+
+ ext + "; " + output + "; " + kind + "; " + provenance
115+
)
116+
or
117+
exists(
118+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
119+
string input, string kind, string provenance
120+
|
121+
sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance, madId) and
122+
model =
123+
"Sink: " + namespace + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; " +
124+
ext + "; " + input + "; " + kind + "; " + provenance
125+
)
126+
or
127+
exists(
128+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
129+
string input, string output, string kind, string provenance
130+
|
131+
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind, provenance,
132+
madId) and
133+
model =
134+
"Summary: " + namespace + "; " + type + "; " + subtypes + "; " + name + "; " + signature +
135+
"; " + ext + "; " + input + "; " + output + "; " + kind + "; " + provenance
136+
)
137+
}
138+
101139
private predicate relevantNamespace(string namespace) {
102140
sourceModel(namespace, _, _, _, _, _, _, _, _, _) or
103141
sinkModel(namespace, _, _, _, _, _, _, _, _, _) or

‎csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.expected

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,32 @@
1+
models
2+
| 1 | Summary: System.Net; IPHostEntry; false; get_HostName; (); ; Argument[this]; ReturnValue; taint; manual |
3+
| 2 | Summary: System.Web; HttpCookie; false; get_Value; (); ; Argument[this]; ReturnValue; taint; manual |
4+
| 3 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
15
edges
26
| ConditionalBypass.cs:12:16:12:22 | access to local variable isAdmin : String | ConditionalBypass.cs:16:13:16:30 | ... == ... | provenance | |
37
| ConditionalBypass.cs:12:26:12:48 | access to property QueryString : NameValueCollection | ConditionalBypass.cs:12:16:12:22 | access to local variable isAdmin : String | provenance | |
4-
| ConditionalBypass.cs:12:26:12:48 | access to property QueryString : NameValueCollection | ConditionalBypass.cs:12:26:12:59 | access to indexer : String | provenance | MaD:11390 |
8+
| ConditionalBypass.cs:12:26:12:48 | access to property QueryString : NameValueCollection | ConditionalBypass.cs:12:26:12:59 | access to indexer : String | provenance | MaD:3 |
59
| ConditionalBypass.cs:12:26:12:59 | access to indexer : String | ConditionalBypass.cs:12:16:12:22 | access to local variable isAdmin : String | provenance | |
610
| ConditionalBypass.cs:19:20:19:30 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:22:13:22:23 | access to local variable adminCookie : HttpCookie | provenance | |
711
| ConditionalBypass.cs:19:20:19:30 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:27:13:27:23 | access to local variable adminCookie : HttpCookie | provenance | |
812
| ConditionalBypass.cs:19:34:19:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:19:20:19:30 | access to local variable adminCookie : HttpCookie | provenance | |
9-
| ConditionalBypass.cs:22:13:22:23 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:22:13:22:29 | access to property Value : String | provenance | MaD:2161 |
13+
| ConditionalBypass.cs:22:13:22:23 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:22:13:22:29 | access to property Value : String | provenance | MaD:2 |
1014
| ConditionalBypass.cs:22:13:22:29 | access to property Value : String | ConditionalBypass.cs:22:13:22:45 | call to method Equals | provenance | |
11-
| ConditionalBypass.cs:27:13:27:23 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:27:13:27:29 | access to property Value : String | provenance | MaD:2161 |
15+
| ConditionalBypass.cs:27:13:27:23 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:27:13:27:29 | access to property Value : String | provenance | MaD:2 |
1216
| ConditionalBypass.cs:27:13:27:29 | access to property Value : String | ConditionalBypass.cs:27:13:27:40 | ... == ... | provenance | |
1317
| ConditionalBypass.cs:42:21:42:28 | access to local variable hostInfo : IPHostEntry | ConditionalBypass.cs:44:13:44:20 | access to local variable hostInfo : IPHostEntry | provenance | |
1418
| ConditionalBypass.cs:42:21:42:28 | access to local variable hostInfo : IPHostEntry | ConditionalBypass.cs:49:13:49:20 | access to local variable hostInfo : IPHostEntry | provenance | |
1519
| ConditionalBypass.cs:42:32:42:66 | call to method GetHostByAddress : IPHostEntry | ConditionalBypass.cs:42:21:42:28 | access to local variable hostInfo : IPHostEntry | provenance | |
16-
| ConditionalBypass.cs:44:13:44:20 | access to local variable hostInfo : IPHostEntry | ConditionalBypass.cs:44:13:44:29 | access to property HostName : String | provenance | MaD:1827 |
20+
| ConditionalBypass.cs:44:13:44:20 | access to local variable hostInfo : IPHostEntry | ConditionalBypass.cs:44:13:44:29 | access to property HostName : String | provenance | MaD:1 |
1721
| ConditionalBypass.cs:44:13:44:29 | access to property HostName : String | ConditionalBypass.cs:44:13:44:46 | ... == ... | provenance | |
18-
| ConditionalBypass.cs:49:13:49:20 | access to local variable hostInfo : IPHostEntry | ConditionalBypass.cs:49:13:49:29 | access to property HostName | provenance | MaD:1827 |
22+
| ConditionalBypass.cs:49:13:49:20 | access to local variable hostInfo : IPHostEntry | ConditionalBypass.cs:49:13:49:29 | access to property HostName | provenance | MaD:1 |
1923
| ConditionalBypass.cs:70:20:70:30 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:72:13:72:23 | access to local variable adminCookie : HttpCookie | provenance | |
2024
| ConditionalBypass.cs:70:34:70:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:70:20:70:30 | access to local variable adminCookie : HttpCookie | provenance | |
21-
| ConditionalBypass.cs:72:13:72:23 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:72:13:72:29 | access to property Value : String | provenance | MaD:2161 |
25+
| ConditionalBypass.cs:72:13:72:23 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:72:13:72:29 | access to property Value : String | provenance | MaD:2 |
2226
| ConditionalBypass.cs:72:13:72:29 | access to property Value : String | ConditionalBypass.cs:72:13:72:40 | ... == ... | provenance | |
2327
| ConditionalBypass.cs:83:20:83:30 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:84:13:84:23 | access to local variable adminCookie : HttpCookie | provenance | |
2428
| ConditionalBypass.cs:83:34:83:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:83:20:83:30 | access to local variable adminCookie : HttpCookie | provenance | |
25-
| ConditionalBypass.cs:84:13:84:23 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:84:13:84:29 | access to property Value : String | provenance | MaD:2161 |
29+
| ConditionalBypass.cs:84:13:84:23 | access to local variable adminCookie : HttpCookie | ConditionalBypass.cs:84:13:84:29 | access to property Value : String | provenance | MaD:2 |
2630
| ConditionalBypass.cs:84:13:84:29 | access to property Value : String | ConditionalBypass.cs:84:13:84:40 | ... == ... | provenance | |
2731
nodes
2832
| ConditionalBypass.cs:12:16:12:22 | access to local variable isAdmin : String | semmle.label | access to local variable isAdmin : String |

‎csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.ql

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @kind path-problem
3+
*/
4+
5+
import csharp
6+
import semmle.code.csharp.security.dataflow.ConditionalBypassQuery
7+
import codeql.dataflow.test.ProvenancePathGraph
8+
import semmle.code.csharp.dataflow.internal.ExternalFlow
9+
import ShowProvenance<interpretModelForTest/2, ConditionalBypass::PathNode, ConditionalBypass::PathGraph>
10+
11+
from ConditionalBypass::PathNode source, ConditionalBypass::PathNode sink
12+
where ConditionalBypass::flowPath(source, sink)
13+
select sink.getNode(), source, sink, "This condition guards a sensitive $@, but a $@ controls it.",
14+
sink.getNode().(Sink).getSensitiveMethodCall(), "action", source.getNode(), "user-provided value"

‎csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.qlref

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)