Skip to content

Commit 68b6181

Browse files
committed
Convert barrier guard to MaD
I checked that without the model a test fails.
1 parent b30bc5e commit 68b6181

File tree

2 files changed

+5
-21
lines changed

2 files changed

+5
-21
lines changed

csharp/ql/lib/ext/System.model.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,11 @@ extensions:
1111
- ["System", "Environment", False, "get_CommandLine", "()", "", "ReturnValue", "commandargs", "manual"]
1212
- ["System", "Environment", False, "GetEnvironmentVariable", "", "", "ReturnValue", "environment", "manual"]
1313
- ["System", "Environment", False, "GetEnvironmentVariables", "", "", "ReturnValue", "environment", "manual"]
14+
- addsTo:
15+
pack: codeql/csharp-all
16+
extensible: barrierGuardModel
17+
data:
18+
- ["System", "Uri", False, "get_IsAbsoluteUri", "()", "", "Argument[this]", "false", "url-redirection", "manual"]
1419
- addsTo:
1520
pack: codeql/csharp-all
1621
extensible: summaryModel

csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -165,27 +165,6 @@ class ContainsUrlSanitizer extends Sanitizer {
165165
}
166166
}
167167

168-
/**
169-
* A check that the URL is relative, and therefore safe for URL redirects.
170-
*/
171-
private predicate isRelativeUrlSanitizer(Guard guard, Expr e, GuardValue v) {
172-
guard =
173-
any(PropertyAccess access |
174-
access.getProperty().hasFullyQualifiedName("System", "Uri", "IsAbsoluteUri") and
175-
e = access.getQualifier() and
176-
v.asBooleanValue() = false
177-
)
178-
}
179-
180-
/**
181-
* A check that the URL is relative, and therefore safe for URL redirects.
182-
*/
183-
class RelativeUrlSanitizer extends Sanitizer {
184-
RelativeUrlSanitizer() {
185-
this = DataFlow::BarrierGuard<isRelativeUrlSanitizer/3>::getABarrierNode()
186-
}
187-
}
188-
189168
/**
190169
* A comparison on the `Host` property of a url, that is a sanitizer for URL redirects.
191170
* E.g. `url.Host == "example.org"`

0 commit comments

Comments
 (0)