Skip to content

Commit 64961e6

Browse files
MathiasVPDilan Bhalla
MathiasVP
authored and
Dilan Bhalla
committed
Merge pull request #264 from microsoft/simple-type-sanitizers
PS: Add simple type-based sanitizer to SQL injection query
1 parent ec5723e commit 64961e6

File tree

19 files changed

+137
-37
lines changed

19 files changed

+137
-37
lines changed

‎powershell/ql/lib/semmle/code/powershell/ApiGraphs.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -563,15 +563,15 @@ module API {
563563
)
564564
or
565565
exists(DataFlow::AutomaticVariableNode automatic |
566-
automatic.getName() = name and
566+
automatic.getLowerCaseName() = name and
567567
succ = getForwardStartNode(automatic)
568568
)
569569
or
570570
succ = getAnImplicitRootMember(name)
571571
)
572572
or
573573
exists(DataFlow::QualifiedTypeNameNode typeName |
574-
typeName.getName() = name and
574+
typeName.getLowerCaseName() = name and
575575
pred = MkNamespaceOfTypeNameNode(typeName) and
576576
succ = getForwardStartNode(typeName)
577577
)

‎powershell/ql/lib/semmle/code/powershell/ast/internal/AutomaticVariable.qll

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
private import AstImport
22

33
class AutomaticVariable extends Expr, TAutomaticVariable {
4-
final override string toString() { result = this.getName() }
4+
final override string toString() { result = this.getLowerCaseName() }
55

6-
string getName() { any(Synthesis s).automaticVariableName(this, result) }
6+
string getLowerCaseName() { any(Synthesis s).automaticVariableName(this, result) }
7+
8+
bindingset[result]
9+
pragma[inline_late]
10+
string getAName() { result.toLowerCase() = this.getLowerCaseName() }
711
}
812

913
class MyInvocation extends AutomaticVariable {
10-
MyInvocation() { this.getName() = "myinvocation" }
14+
MyInvocation() { this.getLowerCaseName() = "myinvocation" }
1115
}

‎powershell/ql/lib/semmle/code/powershell/ast/internal/InvokeMemberExpression.qll

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,13 @@ class ConstructorCall extends InvokeMemberExpr {
7171
this.isStatic() and typename = this.getQualifier() and this.getLowerCaseName() = "new"
7272
}
7373

74+
/** Gets a name of the type being constructed by this constructor call. */
75+
bindingset[result]
76+
pragma[inline_late]
77+
string getAConstructedTypeName() { result = typename.getAName() }
78+
7479
/** Gets the name of the type being constructed by this constructor call. */
75-
string getConstructedTypeName() { result = typename.getName() }
80+
string getLowerCaseConstructedTypeName() { result = typename.getLowerCaseName() }
7681
}
7782

7883
/**

‎powershell/ql/lib/semmle/code/powershell/ast/internal/ObjectCreation.qll

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,11 @@ import powershell
22

33
abstract private class AbstractObjectCreation extends CallExpr {
44
/** The name of the type of the object being constructed. */
5-
abstract string getConstructedTypeName();
5+
bindingset[result]
6+
pragma[inline_late]
7+
string getAConstructedTypeName() { result.toLowerCase() = this.getLowerCaseConstructedTypeName() }
8+
9+
abstract string getLowerCaseConstructedTypeName();
610

711
abstract Expr getConstructedTypeExpr();
812
}
@@ -14,8 +18,14 @@ abstract private class AbstractObjectCreation extends CallExpr {
1418
* ```
1519
*/
1620
class NewObjectCreation extends AbstractObjectCreation, ConstructorCall {
17-
final override string getConstructedTypeName() {
18-
result = ConstructorCall.super.getConstructedTypeName()
21+
final override string getLowerCaseConstructedTypeName() {
22+
result = ConstructorCall.super.getLowerCaseConstructedTypeName()
23+
}
24+
25+
bindingset[result]
26+
pragma[inline_late]
27+
final override string getAConstructedTypeName() {
28+
result = ConstructorCall.super.getAConstructedTypeName()
1929
}
2030

2131
final override Expr getConstructedTypeExpr() { result = typename }
@@ -30,8 +40,8 @@ class NewObjectCreation extends AbstractObjectCreation, ConstructorCall {
3040
class DotNetObjectCreation extends AbstractObjectCreation, CmdCall {
3141
DotNetObjectCreation() { this.getLowerCaseName() = "new-object" }
3242

33-
final override string getConstructedTypeName() {
34-
result = this.getConstructedTypeExpr().(StringConstExpr).getValueString()
43+
final override string getLowerCaseConstructedTypeName() {
44+
result = this.getConstructedTypeExpr().(StringConstExpr).getValueString().toLowerCase()
3545
}
3646

3747
final override Expr getConstructedTypeExpr() {

‎powershell/ql/lib/semmle/code/powershell/ast/internal/Raw/NamedAttributeArgument.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,11 @@ class NamedAttributeArgument extends @named_attribute_argument, Ast {
1515
}
1616

1717
class ValueFromPipelineAttribute extends NamedAttributeArgument {
18-
ValueFromPipelineAttribute() { this.getName() = "ValueFromPipeline" }
18+
ValueFromPipelineAttribute() { this.getName().toLowerCase() = "valuefrompipeline" }
1919
}
2020

2121
class ValueFromPipelineByPropertyName extends NamedAttributeArgument {
22-
ValueFromPipelineByPropertyName() { this.getName() = "ValueFromPipelineByPropertyName" }
22+
ValueFromPipelineByPropertyName() {
23+
this.getName().toLowerCase() = "valuefrompipelinebypropertyname"
24+
}
2325
}

‎powershell/ql/lib/semmle/code/powershell/ast/internal/Synthesis.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -345,7 +345,7 @@ private module ParameterSynth {
345345
// has a static type.
346346
this.parameter(parent, i, p, _) and
347347
n = TVariableSynth(parent, i) and
348-
type = p.getStaticType()
348+
type = p.getStaticType().toLowerCase()
349349
)
350350
}
351351
}
@@ -530,7 +530,7 @@ private module TypeSynth {
530530
override predicate typeName(Type t, string name) {
531531
exists(Raw::TypeStmt typeStmt |
532532
t = TTypeSynth(typeStmt, _) and
533-
typeStmt.getName() = name
533+
typeStmt.getName().toLowerCase() = name
534534
)
535535
}
536536

‎powershell/ql/lib/semmle/code/powershell/ast/internal/TypeExpression.qll

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,21 @@ class TypeNameExpr extends Expr, TTypeNameExpr {
1414
)
1515
}
1616

17-
string getName() { this.parseName(_, result) }
17+
string getLowerCaseName() { this.parseName(_, result) }
18+
19+
bindingset[result]
20+
pragma[inline_late]
21+
string getAName() { this.parseName(_, result.toLowerCase()) }
1822

1923
/** If any */
20-
string getPossiblyQualifiedName() { result = getRawAst(this).(Raw::TypeNameExpr).getName() }
24+
string getPossiblyQualifiedName() {
25+
result = getRawAst(this).(Raw::TypeNameExpr).getName().toLowerCase()
26+
}
2127

2228
// TODO: What to do when System is omitted?
2329
string getNamespace() { this.parseName(result, _) }
2430

25-
override string toString() { result = this.getName() }
31+
override string toString() { result = this.getLowerCaseName() }
2632

2733
predicate isQualified() { this.getNamespace() != "" }
2834

‎powershell/ql/lib/semmle/code/powershell/controlflow/CfgNodes.qll

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -587,7 +587,15 @@ module ExprNodes {
587587

588588
override ObjectCreation getExpr() { result = e }
589589

590-
string getConstructedTypeName() { result = this.getExpr().getConstructedTypeName() }
590+
string getLowerCaseConstructedTypeName() {
591+
result = this.getExpr().getLowerCaseConstructedTypeName()
592+
}
593+
594+
bindingset[result]
595+
pragma[inline_late]
596+
string getAConstructedTypeName() {
597+
result.toLowerCase() = this.getLowerCaseConstructedTypeName()
598+
}
591599

592600
ExprCfgNode getConstructedTypeExpr() {
593601
e.hasCfgChild(this.getExpr().getConstructedTypeExpr(), this, result)
@@ -717,7 +725,11 @@ module ExprNodes {
717725

718726
override TypeNameExpr getExpr() { result = e }
719727

720-
string getName() { result = e.getName() }
728+
bindingset[result]
729+
pragma[inline_late]
730+
string getAName() { result = e.getAName() }
731+
732+
string getLowerCaseName() { result = e.getLowerCaseName() }
721733

722734
string getNamespace() { result = e.getNamespace() }
723735

@@ -1118,7 +1130,11 @@ module ExprNodes {
11181130

11191131
override AutomaticVariable getExpr() { result = e }
11201132

1121-
string getName() { result = e.getName() }
1133+
bindingset[result]
1134+
pragma[inline_late]
1135+
string getAName() { result = e.getAName() }
1136+
1137+
string getLowerCaseName() { result = e.getLowerCaseName() }
11221138
}
11231139
}
11241140

‎powershell/ql/lib/semmle/code/powershell/dataflow/internal/DataFlowDispatch.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -159,10 +159,10 @@ private predicate localFlowStep(Node nodeFrom, Node nodeTo, StepSummary summary)
159159

160160
private module TrackInstanceInput implements CallGraphConstruction::InputSig {
161161
private predicate start0(Node start, string typename, boolean exact) {
162-
start.(ObjectCreationNode).getObjectCreationNode().getConstructedTypeName() = typename and
162+
start.(ObjectCreationNode).getObjectCreationNode().getLowerCaseConstructedTypeName() = typename and
163163
exact = true
164164
or
165-
start.asExpr().(CfgNodes::ExprNodes::TypeNameExprCfgNode).getName() = typename and
165+
start.asExpr().(CfgNodes::ExprNodes::TypeNameExprCfgNode).getLowerCaseName() = typename and
166166
exact = true
167167
or
168168
start.asParameter().getStaticType() = typename and

‎powershell/ql/lib/semmle/code/powershell/dataflow/internal/DataFlowPublic.qll

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -495,7 +495,11 @@ class ObjectCreationNode extends ExprNode {
495495
*/
496496
Node getConstructedTypeNode() { result.asExpr() = objectCreation.getConstructedTypeExpr() }
497497

498-
string getConstructedTypeName() { result = this.getObjectCreationNode().getConstructedTypeName() }
498+
bindingset[result]
499+
pragma[inline_late]
500+
string getAConstructedTypeName() {
501+
result = this.getObjectCreationNode().getAConstructedTypeName()
502+
}
499503
}
500504

501505
/** A call, viewed as a node in a data flow graph. */
@@ -567,7 +571,11 @@ class TypeNameNode extends ExprNode {
567571

568572
override CfgNodes::ExprNodes::TypeNameExprCfgNode getExprNode() { result = n }
569573

570-
string getName() { result = n.getName() }
574+
bindingset[result]
575+
pragma[inline_late]
576+
string getAName() { result = n.getAName() }
577+
578+
string getLowerCaseName() { result = n.getLowerCaseName() }
571579

572580
predicate isQualified() { n.isQualified() }
573581

@@ -593,5 +601,9 @@ class AutomaticVariableNode extends ExprNode {
593601

594602
final override CfgNodes::ExprNodes::AutomaticVariableCfgNode getExprNode() { result = n }
595603

596-
string getName() { result = n.getName() }
604+
bindingset[result]
605+
pragma[inline_late]
606+
string getAName() { result = n.getAName() }
607+
608+
string getLowerCaseName() { result = n.getLowerCaseName() }
597609
}

0 commit comments

Comments
 (0)