Skip to content

Commit 6807fd1

Browse files
michaelnebelmichaelnebel
committed
C#: Add some stubs, a testcase and update the expected output without based on main.
1 parent 66b456d commit 6807fd1

File tree

3 files changed

+49
-23
lines changed

3 files changed

+49
-23
lines changed

‎csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
using System;
22
using System.Web;
3+
using System.Web.Helpers;
34
using System.Web.Mvc;
45

56
public class UrlRedirectHandler : IHttpHandler
@@ -48,6 +49,13 @@ public void ProcessRequest(HttpContext ctx)
4849

4950
// GOOD: request parameter is URL encoded
5051
ctx.Response.Redirect(HttpUtility.UrlEncode(ctx.Request.QueryString["page"]));
52+
53+
// GOOD: whitelisted redirect
54+
var url3 = ctx.Request.QueryString["page"];
55+
if (new HttpRequestWrapper(ctx.Request).IsUrlLocalToHost(url3))
56+
{
57+
ctx.Response.Redirect(url3);
58+
}
5159
}
5260

5361
// Implementation as recommended by Microsoft.

‎csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.expected

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11
edges
2-
| UrlRedirect.cs:12:31:12:53 | access to property QueryString : NameValueCollection | UrlRedirect.cs:12:31:12:61 | access to indexer |
3-
| UrlRedirect.cs:22:22:22:44 | access to property QueryString : NameValueCollection | UrlRedirect.cs:22:22:22:52 | access to indexer : String |
4-
| UrlRedirect.cs:22:22:22:44 | access to property QueryString : NameValueCollection | UrlRedirect.cs:47:29:47:31 | access to local variable url |
5-
| UrlRedirect.cs:22:22:22:52 | access to indexer : String | UrlRedirect.cs:47:29:47:31 | access to local variable url |
6-
| UrlRedirect.cs:37:44:37:66 | access to property QueryString : NameValueCollection | UrlRedirect.cs:37:44:37:74 | access to indexer |
7-
| UrlRedirect.cs:38:47:38:69 | access to property QueryString : NameValueCollection | UrlRedirect.cs:38:47:38:77 | access to indexer |
2+
| UrlRedirect.cs:13:31:13:53 | access to property QueryString : NameValueCollection | UrlRedirect.cs:13:31:13:61 | access to indexer |
3+
| UrlRedirect.cs:23:22:23:44 | access to property QueryString : NameValueCollection | UrlRedirect.cs:23:22:23:52 | access to indexer : String |
4+
| UrlRedirect.cs:23:22:23:44 | access to property QueryString : NameValueCollection | UrlRedirect.cs:48:29:48:31 | access to local variable url |
5+
| UrlRedirect.cs:23:22:23:52 | access to indexer : String | UrlRedirect.cs:48:29:48:31 | access to local variable url |
6+
| UrlRedirect.cs:38:44:38:66 | access to property QueryString : NameValueCollection | UrlRedirect.cs:38:44:38:74 | access to indexer |
7+
| UrlRedirect.cs:39:47:39:69 | access to property QueryString : NameValueCollection | UrlRedirect.cs:39:47:39:77 | access to indexer |
8+
| UrlRedirect.cs:54:20:54:42 | access to property QueryString : NameValueCollection | UrlRedirect.cs:54:20:54:50 | access to indexer : String |
9+
| UrlRedirect.cs:54:20:54:42 | access to property QueryString : NameValueCollection | UrlRedirect.cs:57:35:57:38 | access to local variable url3 |
10+
| UrlRedirect.cs:54:20:54:50 | access to indexer : String | UrlRedirect.cs:57:35:57:38 | access to local variable url3 |
811
| UrlRedirectCore.cs:13:44:13:48 | value : String | UrlRedirectCore.cs:16:22:16:26 | access to parameter value |
912
| UrlRedirectCore.cs:13:44:13:48 | value : String | UrlRedirectCore.cs:19:44:19:48 | call to operator implicit conversion |
1013
| UrlRedirectCore.cs:13:44:13:48 | value : String | UrlRedirectCore.cs:25:46:25:50 | call to operator implicit conversion |
@@ -17,15 +20,18 @@ edges
1720
| UrlRedirectCore.cs:45:51:45:55 | value : String | UrlRedirectCore.cs:56:31:56:35 | access to parameter value |
1821
| UrlRedirectCore.cs:53:40:53:44 | access to parameter value : String | UrlRedirectCore.cs:53:32:53:45 | object creation of type Uri |
1922
nodes
20-
| UrlRedirect.cs:12:31:12:53 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
21-
| UrlRedirect.cs:12:31:12:61 | access to indexer | semmle.label | access to indexer |
22-
| UrlRedirect.cs:22:22:22:44 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
23-
| UrlRedirect.cs:22:22:22:52 | access to indexer : String | semmle.label | access to indexer : String |
24-
| UrlRedirect.cs:37:44:37:66 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
25-
| UrlRedirect.cs:37:44:37:74 | access to indexer | semmle.label | access to indexer |
26-
| UrlRedirect.cs:38:47:38:69 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
27-
| UrlRedirect.cs:38:47:38:77 | access to indexer | semmle.label | access to indexer |
28-
| UrlRedirect.cs:47:29:47:31 | access to local variable url | semmle.label | access to local variable url |
23+
| UrlRedirect.cs:13:31:13:53 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
24+
| UrlRedirect.cs:13:31:13:61 | access to indexer | semmle.label | access to indexer |
25+
| UrlRedirect.cs:23:22:23:44 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
26+
| UrlRedirect.cs:23:22:23:52 | access to indexer : String | semmle.label | access to indexer : String |
27+
| UrlRedirect.cs:38:44:38:66 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
28+
| UrlRedirect.cs:38:44:38:74 | access to indexer | semmle.label | access to indexer |
29+
| UrlRedirect.cs:39:47:39:69 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
30+
| UrlRedirect.cs:39:47:39:77 | access to indexer | semmle.label | access to indexer |
31+
| UrlRedirect.cs:48:29:48:31 | access to local variable url | semmle.label | access to local variable url |
32+
| UrlRedirect.cs:54:20:54:42 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
33+
| UrlRedirect.cs:54:20:54:50 | access to indexer : String | semmle.label | access to indexer : String |
34+
| UrlRedirect.cs:57:35:57:38 | access to local variable url3 | semmle.label | access to local variable url3 |
2935
| UrlRedirectCore.cs:13:44:13:48 | value : String | semmle.label | value : String |
3036
| UrlRedirectCore.cs:16:22:16:26 | access to parameter value | semmle.label | access to parameter value |
3137
| UrlRedirectCore.cs:19:44:19:48 | call to operator implicit conversion | semmle.label | call to operator implicit conversion |
@@ -41,10 +47,11 @@ nodes
4147
| UrlRedirectCore.cs:56:31:56:35 | access to parameter value | semmle.label | access to parameter value |
4248
subpaths
4349
#select
44-
| UrlRedirect.cs:12:31:12:61 | access to indexer | UrlRedirect.cs:12:31:12:53 | access to property QueryString : NameValueCollection | UrlRedirect.cs:12:31:12:61 | access to indexer | Untrusted URL redirection due to $@. | UrlRedirect.cs:12:31:12:53 | access to property QueryString | user-provided value |
45-
| UrlRedirect.cs:37:44:37:74 | access to indexer | UrlRedirect.cs:37:44:37:66 | access to property QueryString : NameValueCollection | UrlRedirect.cs:37:44:37:74 | access to indexer | Untrusted URL redirection due to $@. | UrlRedirect.cs:37:44:37:66 | access to property QueryString | user-provided value |
46-
| UrlRedirect.cs:38:47:38:77 | access to indexer | UrlRedirect.cs:38:47:38:69 | access to property QueryString : NameValueCollection | UrlRedirect.cs:38:47:38:77 | access to indexer | Untrusted URL redirection due to $@. | UrlRedirect.cs:38:47:38:69 | access to property QueryString | user-provided value |
47-
| UrlRedirect.cs:47:29:47:31 | access to local variable url | UrlRedirect.cs:22:22:22:44 | access to property QueryString : NameValueCollection | UrlRedirect.cs:47:29:47:31 | access to local variable url | Untrusted URL redirection due to $@. | UrlRedirect.cs:22:22:22:44 | access to property QueryString | user-provided value |
50+
| UrlRedirect.cs:13:31:13:61 | access to indexer | UrlRedirect.cs:13:31:13:53 | access to property QueryString : NameValueCollection | UrlRedirect.cs:13:31:13:61 | access to indexer | Untrusted URL redirection due to $@. | UrlRedirect.cs:13:31:13:53 | access to property QueryString | user-provided value |
51+
| UrlRedirect.cs:38:44:38:74 | access to indexer | UrlRedirect.cs:38:44:38:66 | access to property QueryString : NameValueCollection | UrlRedirect.cs:38:44:38:74 | access to indexer | Untrusted URL redirection due to $@. | UrlRedirect.cs:38:44:38:66 | access to property QueryString | user-provided value |
52+
| UrlRedirect.cs:39:47:39:77 | access to indexer | UrlRedirect.cs:39:47:39:69 | access to property QueryString : NameValueCollection | UrlRedirect.cs:39:47:39:77 | access to indexer | Untrusted URL redirection due to $@. | UrlRedirect.cs:39:47:39:69 | access to property QueryString | user-provided value |
53+
| UrlRedirect.cs:48:29:48:31 | access to local variable url | UrlRedirect.cs:23:22:23:44 | access to property QueryString : NameValueCollection | UrlRedirect.cs:48:29:48:31 | access to local variable url | Untrusted URL redirection due to $@. | UrlRedirect.cs:23:22:23:44 | access to property QueryString | user-provided value |
54+
| UrlRedirect.cs:57:35:57:38 | access to local variable url3 | UrlRedirect.cs:54:20:54:42 | access to property QueryString : NameValueCollection | UrlRedirect.cs:57:35:57:38 | access to local variable url3 | Untrusted URL redirection due to $@. | UrlRedirect.cs:54:20:54:42 | access to property QueryString | user-provided value |
4855
| UrlRedirectCore.cs:16:22:16:26 | access to parameter value | UrlRedirectCore.cs:13:44:13:48 | value : String | UrlRedirectCore.cs:16:22:16:26 | access to parameter value | Untrusted URL redirection due to $@. | UrlRedirectCore.cs:13:44:13:48 | value | user-provided value |
4956
| UrlRedirectCore.cs:19:44:19:48 | call to operator implicit conversion | UrlRedirectCore.cs:13:44:13:48 | value : String | UrlRedirectCore.cs:19:44:19:48 | call to operator implicit conversion | Untrusted URL redirection due to $@. | UrlRedirectCore.cs:13:44:13:48 | value | user-provided value |
5057
| UrlRedirectCore.cs:25:46:25:50 | call to operator implicit conversion | UrlRedirectCore.cs:13:44:13:48 | value : String | UrlRedirectCore.cs:25:46:25:50 | call to operator implicit conversion | Untrusted URL redirection due to $@. | UrlRedirectCore.cs:13:44:13:48 | value | user-provided value |

‎csharp/ql/test/resources/stubs/System.Web.cs

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ public class Control
8181

8282
public class Page
8383
{
84-
public System.Security.Principal.IPrincipal User { get; }
84+
public System.Security.Principal.IPrincipal User { get; }
8585
public System.Web.HttpRequest Request { get; }
8686
}
8787

@@ -157,6 +157,11 @@ public class HttpRequest
157157
public HttpCookieCollection Cookies => null;
158158
}
159159

160+
public class HttpRequestWrapper : System.Web.HttpRequestBase
161+
{
162+
public HttpRequestWrapper(HttpRequest r) { }
163+
}
164+
160165
public class HttpResponse
161166
{
162167
public void Write(object o) { }
@@ -306,15 +311,16 @@ public class RequestContext
306311
{
307312
}
308313

309-
public class Route
314+
public class Route
310315
{
311316
}
312317

313-
public class RouteTable {
318+
public class RouteTable
319+
{
314320
public RouteCollection Routes { get; }
315321
}
316322

317-
public class RouteCollection
323+
public class RouteCollection
318324
{
319325
public Route MapPageRoute(string routeName, string routeUrl, string physicalFile, bool checkPhysicalUrlAccess) { return null; }
320326
}
@@ -367,6 +373,11 @@ public static class AntiForgery
367373
{
368374
public static void Validate() { }
369375
}
376+
377+
public static class RequestExtensions
378+
{
379+
public static bool IsUrlLocalToHost(this System.Web.HttpRequestBase request, string url) => throw null;
380+
}
370381
}
371382

372383
namespace System.Web.Script.Serialization

0 commit comments

Comments
 (0)