Skip to content

Commit 7ff2ee6

Browse files
michaelnebelmichaelnebel
authored
Merge pull request #7348 from michaelnebel/csharp-mad-as-csv-json
C#: Convert flow summaries for JSon.NET
2 parents a4bea05 + f32d464 commit 7ff2ee6

File tree

7 files changed

+120
-96
lines changed

7 files changed

+120
-96
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ private module Frameworks {
9797
private import semmle.code.csharp.frameworks.system.Web
9898
private import semmle.code.csharp.frameworks.system.collections.Generic
9999
private import semmle.code.csharp.frameworks.system.web.ui.WebControls
100+
private import semmle.code.csharp.frameworks.JsonNET
100101
}
101102

102103
/**

‎csharp/ql/lib/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ private import semmle.code.csharp.dataflow.internal.DataFlowPublic
2121
private import semmle.code.csharp.dataflow.internal.DelegateDataFlow
2222
// import `LibraryTypeDataFlow` definitions from other files to avoid potential reevaluation
2323
private import semmle.code.csharp.frameworks.EntityFramework
24-
private import semmle.code.csharp.frameworks.JsonNET
2524
private import FlowSummary
2625

2726
private newtype TAccessPath =

‎csharp/ql/lib/semmle/code/csharp/frameworks/JsonNET.qll

Lines changed: 109 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*/
44

55
import csharp
6-
private import semmle.code.csharp.dataflow.LibraryTypeDataFlow
6+
private import semmle.code.csharp.dataflow.ExternalFlow
77

88
/** Definitions relating to the `Json.NET` package. */
99
module JsonNET {
@@ -31,15 +31,9 @@ module JsonNET {
3131
}
3232

3333
/** The class `Newtonsoft.Json.JsonConvert`. */
34-
class JsonConvertClass extends JsonClass, LibraryTypeDataFlow {
34+
class JsonConvertClass extends JsonClass {
3535
JsonConvertClass() { this.hasName("JsonConvert") }
3636

37-
/** Gets a `ToString` method. */
38-
private Method getAToStringMethod() {
39-
result = this.getAMethod("ToString") and
40-
result.isStatic()
41-
}
42-
4337
/** Gets a `Deserialize` method. */
4438
Method getADeserializeMethod() {
4539
result = this.getAMethod() and
@@ -51,39 +45,73 @@ module JsonNET {
5145
result = this.getAMethod() and
5246
result.getName().matches("Serialize%")
5347
}
48+
}
5449

55-
private Method getAPopulateMethod() {
56-
result = this.getAMethod() and
57-
result.getName().matches("Populate%")
58-
}
59-
60-
override predicate callableFlow(
61-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
62-
boolean preservesValue
63-
) {
64-
// ToString methods
65-
c = this.getAToStringMethod() and
66-
preservesValue = false and
67-
source = any(CallableFlowSourceArg arg | arg.getArgumentIndex() = 0) and
68-
sink instanceof CallableFlowSinkReturn
69-
or
70-
// Deserialize methods
71-
c = this.getADeserializeMethod() and
72-
preservesValue = false and
73-
source = any(CallableFlowSourceArg arg | arg.getArgumentIndex() = 0) and
74-
sink instanceof CallableFlowSinkReturn
75-
or
76-
// Serialize methods
77-
c = this.getASerializeMethod() and
78-
preservesValue = false and
79-
source = any(CallableFlowSourceArg arg | arg.getArgumentIndex() = 0) and
80-
sink instanceof CallableFlowSinkReturn
81-
or
82-
// Populate methods
83-
c = this.getAPopulateMethod() and
84-
preservesValue = false and
85-
source = any(CallableFlowSourceArg arg | arg.getArgumentIndex() = 0) and
86-
sink = any(CallableFlowSinkArg arg | arg.getArgumentIndex() = 1)
50+
/** Data flow for `Newtonsoft.Json.JsonConvert`. */
51+
private class JsonConvertClassFlowModelCsv extends SummaryModelCsv {
52+
override predicate row(string row) {
53+
row =
54+
[
55+
"Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T);;Argument[0];ReturnValue;taint",
56+
"Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint",
57+
"Newtonsoft.Json;JsonConvert;false;DeserializeObject;(System.String);;Argument[0];ReturnValue;taint",
58+
"Newtonsoft.Json;JsonConvert;false;DeserializeObject;(System.String,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint",
59+
"Newtonsoft.Json;JsonConvert;false;DeserializeObject;(System.String,System.Type);;Argument[0];ReturnValue;taint",
60+
"Newtonsoft.Json;JsonConvert;false;DeserializeObject;(System.String,System.Type,Newtonsoft.Json.JsonConverter[]);;Argument[0];ReturnValue;taint",
61+
"Newtonsoft.Json;JsonConvert;false;DeserializeObject;(System.String,System.Type,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint",
62+
"Newtonsoft.Json;JsonConvert;false;DeserializeObject<>;(System.String);;Argument[0];ReturnValue;taint",
63+
"Newtonsoft.Json;JsonConvert;false;DeserializeObject<>;(System.String,Newtonsoft.Json.JsonConverter[]);;Argument[0];ReturnValue;taint",
64+
"Newtonsoft.Json;JsonConvert;false;DeserializeObject<>;(System.String,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint",
65+
"Newtonsoft.Json;JsonConvert;false;DeserializeXNode;(System.String);;Argument[0];ReturnValue;taint",
66+
"Newtonsoft.Json;JsonConvert;false;DeserializeXNode;(System.String,System.String);;Argument[0];ReturnValue;taint",
67+
"Newtonsoft.Json;JsonConvert;false;DeserializeXNode;(System.String,System.String,System.Boolean);;Argument[0];ReturnValue;taint",
68+
"Newtonsoft.Json;JsonConvert;false;DeserializeXNode;(System.String,System.String,System.Boolean,System.Boolean);;Argument[0];ReturnValue;taint",
69+
"Newtonsoft.Json;JsonConvert;false;DeserializeXmlNode;(System.String);;Argument[0];ReturnValue;taint",
70+
"Newtonsoft.Json;JsonConvert;false;DeserializeXmlNode;(System.String,System.String);;Argument[0];ReturnValue;taint",
71+
"Newtonsoft.Json;JsonConvert;false;DeserializeXmlNode;(System.String,System.String,System.Boolean);;Argument[0];ReturnValue;taint",
72+
"Newtonsoft.Json;JsonConvert;false;DeserializeXmlNode;(System.String,System.String,System.Boolean,System.Boolean);;Argument[0];ReturnValue;taint",
73+
"Newtonsoft.Json;JsonConvert;false;PopulateObject;(System.String,System.Object);;Argument[0];Argument[1];taint",
74+
"Newtonsoft.Json;JsonConvert;false;PopulateObject;(System.String,System.Object,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];Argument[1];taint",
75+
"Newtonsoft.Json;JsonConvert;false;SerializeObject;(System.Object);;Argument[0];ReturnValue;taint",
76+
"Newtonsoft.Json;JsonConvert;false;SerializeObject;(System.Object,Newtonsoft.Json.Formatting);;Argument[0];ReturnValue;taint",
77+
"Newtonsoft.Json;JsonConvert;false;SerializeObject;(System.Object,Newtonsoft.Json.Formatting,Newtonsoft.Json.JsonConverter[]);;Argument[0];ReturnValue;taint",
78+
"Newtonsoft.Json;JsonConvert;false;SerializeObject;(System.Object,Newtonsoft.Json.Formatting,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint",
79+
"Newtonsoft.Json;JsonConvert;false;SerializeObject;(System.Object,Newtonsoft.Json.JsonConverter[]);;Argument[0];ReturnValue;taint",
80+
"Newtonsoft.Json;JsonConvert;false;SerializeObject;(System.Object,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint",
81+
"Newtonsoft.Json;JsonConvert;false;SerializeObject;(System.Object,System.Type,Newtonsoft.Json.Formatting,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint",
82+
"Newtonsoft.Json;JsonConvert;false;SerializeObject;(System.Object,System.Type,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint",
83+
"Newtonsoft.Json;JsonConvert;false;SerializeXNode;(System.Xml.Linq.XObject);;Argument[0];ReturnValue;taint",
84+
"Newtonsoft.Json;JsonConvert;false;SerializeXNode;(System.Xml.Linq.XObject,Newtonsoft.Json.Formatting);;Argument[0];ReturnValue;taint",
85+
"Newtonsoft.Json;JsonConvert;false;SerializeXNode;(System.Xml.Linq.XObject,Newtonsoft.Json.Formatting,System.Boolean);;Argument[0];ReturnValue;taint",
86+
"Newtonsoft.Json;JsonConvert;false;SerializeXmlNode;(System.Xml.XmlNode);;Argument[0];ReturnValue;taint",
87+
"Newtonsoft.Json;JsonConvert;false;SerializeXmlNode;(System.Xml.XmlNode,Newtonsoft.Json.Formatting);;Argument[0];ReturnValue;taint",
88+
"Newtonsoft.Json;JsonConvert;false;SerializeXmlNode;(System.Xml.XmlNode,Newtonsoft.Json.Formatting,System.Boolean);;Argument[0];ReturnValue;taint",
89+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Boolean);;Argument[0];ReturnValue;taint",
90+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Byte);;Argument[0];ReturnValue;taint",
91+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Char);;Argument[0];ReturnValue;taint",
92+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.DateTime);;Argument[0];ReturnValue;taint",
93+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.DateTime,Newtonsoft.Json.DateFormatHandling,Newtonsoft.Json.DateTimeZoneHandling);;Argument[0];ReturnValue;taint",
94+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.DateTimeOffset);;Argument[0];ReturnValue;taint",
95+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.DateTimeOffset,Newtonsoft.Json.DateFormatHandling);;Argument[0];ReturnValue;taint",
96+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Decimal);;Argument[0];ReturnValue;taint",
97+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Double);;Argument[0];ReturnValue;taint",
98+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Enum);;Argument[0];ReturnValue;taint",
99+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Guid);;Argument[0];ReturnValue;taint",
100+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Int16);;Argument[0];ReturnValue;taint",
101+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Int32);;Argument[0];ReturnValue;taint",
102+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Int64);;Argument[0];ReturnValue;taint",
103+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Object);;Argument[0];ReturnValue;taint",
104+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.SByte);;Argument[0];ReturnValue;taint",
105+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Single);;Argument[0];ReturnValue;taint",
106+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.String);;Argument[0];ReturnValue;taint",
107+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.String,System.Char);;Argument[0];ReturnValue;taint",
108+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.String,System.Char,Newtonsoft.Json.StringEscapeHandling);;Argument[0];ReturnValue;taint",
109+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.TimeSpan);;Argument[0];ReturnValue;taint",
110+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.UInt16);;Argument[0];ReturnValue;taint",
111+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.UInt32);;Argument[0];ReturnValue;taint",
112+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.UInt64);;Argument[0];ReturnValue;taint",
113+
"Newtonsoft.Json;JsonConvert;false;ToString;(System.Uri);;Argument[0];ReturnValue;taint",
114+
]
87115
}
88116
}
89117

@@ -137,30 +165,29 @@ module JsonNET {
137165
}
138166

139167
/** The class `NewtonSoft.Json.JsonSerializer`. */
140-
class JsonSerializerClass extends JsonClass, LibraryTypeDataFlow {
168+
class JsonSerializerClass extends JsonClass {
141169
JsonSerializerClass() { this.hasName("JsonSerializer") }
142170

143171
/** Gets the method for `JsonSerializer.Serialize`. */
144172
Method getSerializeMethod() { result = this.getAMethod("Serialize") }
145173

146174
/** Gets the method for `JsonSerializer.Deserialize`. */
147175
Method getDeserializeMethod() { result = this.getAMethod("Deserialize") }
176+
}
148177

149-
override predicate callableFlow(
150-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
151-
boolean preservesValue
152-
) {
153-
// Serialize
154-
c = this.getSerializeMethod() and
155-
preservesValue = false and
156-
source = any(CallableFlowSourceArg arg | arg.getArgumentIndex() = 1) and
157-
sink = any(CallableFlowSinkArg arg | arg.getArgumentIndex() = 0)
158-
or
159-
// Deserialize
160-
c = this.getDeserializeMethod() and
161-
preservesValue = false and
162-
source = any(CallableFlowSourceArg arg | arg.getArgumentIndex() = 0) and
163-
sink instanceof CallableFlowSinkReturn
178+
/** Data flow for `NewtonSoft.Json.JSonSerializer`. */
179+
private class JsonSerializerClassFlowModelCsv extends SummaryModelCsv {
180+
override predicate row(string row) {
181+
row =
182+
[
183+
"Newtonsoft.Json;JsonSerializer;false;Deserialize;(Newtonsoft.Json.JsonReader);;Argument[0];ReturnValue;taint",
184+
"Newtonsoft.Json;JsonSerializer;false;Deserialize;(Newtonsoft.Json.JsonReader,System.Type);;Argument[0];ReturnValue;taint",
185+
"Newtonsoft.Json;JsonSerializer;false;Deserialize;(System.IO.TextReader,System.Type);;Argument[0];ReturnValue;taint",
186+
"Newtonsoft.Json;JsonSerializer;false;Serialize;(Newtonsoft.Json.JsonWriter,System.Object);;Argument[1];Argument[0];taint",
187+
"Newtonsoft.Json;JsonSerializer;false;Serialize;(Newtonsoft.Json.JsonWriter,System.Object,System.Type);;Argument[1];Argument[0];taint",
188+
"Newtonsoft.Json;JsonSerializer;false;Serialize;(System.IO.TextWriter,System.Object);;Argument[1];Argument[0];taint",
189+
"Newtonsoft.Json;JsonSerializer;false;Serialize;(System.IO.TextWriter,System.Object,System.Type);;Argument[1];Argument[0];taint"
190+
]
164191
}
165192
}
166193

@@ -196,46 +223,39 @@ module JsonNET {
196223
LinqClass() { this.getDeclaringNamespace() instanceof LinqNamespace }
197224
}
198225

226+
/** Data flow for `Newtonsoft.Json.Linq.JToken`. */
227+
private class JTokenClassFlowModelCsv extends SummaryModelCsv {
228+
override predicate row(string row) {
229+
row =
230+
[
231+
"Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String);;Argument[-1];ReturnValue;taint",
232+
"Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,Newtonsoft.Json.Linq.JsonSelectSettings);;Argument[-1];ReturnValue;taint",
233+
"Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,System.Boolean);;Argument[-1];ReturnValue;taint",
234+
"Newtonsoft.Json.Linq;JToken;false;ToString;();;Argument[-1];ReturnValue;taint",
235+
"Newtonsoft.Json.Linq;JToken;false;ToString;(Newtonsoft.Json.Formatting,Newtonsoft.Json.JsonConverter[]);;Argument[-1];ReturnValue;taint",
236+
]
237+
}
238+
}
239+
199240
/** The `NewtonSoft.Json.Linq.JObject` class. */
200-
class JObjectClass extends LinqClass, LibraryTypeDataFlow {
241+
class JObjectClass extends LinqClass {
201242
JObjectClass() { this.hasName("JObject") }
202243

203-
override predicate callableFlow(
204-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
205-
boolean preservesValue
206-
) {
207-
// ToString method
208-
c = this.getAMethod("ToString") and
209-
source instanceof CallableFlowSourceQualifier and
210-
sink instanceof CallableFlowSinkReturn and
211-
preservesValue = false
212-
or
213-
// Parse method
214-
c = this.getParseMethod() and
215-
source = any(CallableFlowSourceArg arg | arg.getArgumentIndex() = 0) and
216-
sink instanceof CallableFlowSinkReturn and
217-
preservesValue = false
218-
or
219-
// operator string
220-
c =
221-
any(Operator op |
222-
op.getDeclaringType() = this.getABaseType*() and op.getReturnType() instanceof StringType
223-
) and
224-
source.(CallableFlowSourceArg).getArgumentIndex() = 0 and
225-
sink instanceof CallableFlowSinkReturn and
226-
preservesValue = false
227-
or
228-
// SelectToken method
229-
c = this.getSelectTokenMethod() and
230-
source instanceof CallableFlowSourceQualifier and
231-
sink instanceof CallableFlowSinkReturn and
232-
preservesValue = false
233-
}
234-
235244
/** Gets the `Parse` method. */
236245
Method getParseMethod() { result = this.getAMethod("Parse") }
237246

238247
/** Gets the `SelectToken` method. */
239248
Method getSelectTokenMethod() { result = this.getABaseType*().getAMethod("SelectToken") }
240249
}
250+
251+
/** Data flow for `NewtonSoft.Json.Linq.JObject`. */
252+
private class JObjectClassFlowModelCsv extends SummaryModelCsv {
253+
override predicate row(string row) {
254+
row =
255+
[
256+
"Newtonsoft.Json.Linq;JObject;false;Parse;(System.String);;Argument[0];ReturnValue;taint",
257+
"Newtonsoft.Json.Linq;JObject;false;Parse;(System.String,Newtonsoft.Json.Linq.JsonLoadSettings);;Argument[0];ReturnValue;taint"
258+
]
259+
}
260+
}
241261
}

‎csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,8 @@
5656
| Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String);;Argument[-1];ReturnValue;taint |
5757
| Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,Newtonsoft.Json.Linq.JsonSelectSettings);;Argument[-1];ReturnValue;taint |
5858
| Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,System.Boolean);;Argument[-1];ReturnValue;taint |
59-
| Newtonsoft.Json.Linq;JToken;false;explicit conversion;(Newtonsoft.Json.Linq.JToken);;Argument[0];ReturnValue;taint |
59+
| Newtonsoft.Json.Linq;JToken;false;ToString;();;Argument[-1];ReturnValue;taint |
60+
| Newtonsoft.Json.Linq;JToken;false;ToString;(Newtonsoft.Json.Formatting,Newtonsoft.Json.JsonConverter[]);;Argument[-1];ReturnValue;taint |
6061
| Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T);;Argument[0];ReturnValue;taint |
6162
| Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint |
6263
| Newtonsoft.Json;JsonConvert;false;DeserializeObject;(System.String);;Argument[0];ReturnValue;taint |

‎csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@
4949
| Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String);;Argument[-1];ReturnValue;taint |
5050
| Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,Newtonsoft.Json.Linq.JsonSelectSettings);;Argument[-1];ReturnValue;taint |
5151
| Newtonsoft.Json.Linq;JToken;false;SelectToken;(System.String,System.Boolean);;Argument[-1];ReturnValue;taint |
52-
| Newtonsoft.Json.Linq;JToken;false;explicit conversion;(Newtonsoft.Json.Linq.JToken);;Argument[0];ReturnValue;taint |
52+
| Newtonsoft.Json.Linq;JToken;false;ToString;();;Argument[-1];ReturnValue;taint |
53+
| Newtonsoft.Json.Linq;JToken;false;ToString;(Newtonsoft.Json.Formatting,Newtonsoft.Json.JsonConverter[]);;Argument[-1];ReturnValue;taint |
5354
| Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T);;Argument[0];ReturnValue;taint |
5455
| Newtonsoft.Json;JsonConvert;false;DeserializeAnonymousType<>;(System.String,T,Newtonsoft.Json.JsonSerializerSettings);;Argument[0];ReturnValue;taint |
5556
| Newtonsoft.Json;JsonConvert;false;DeserializeObject;(System.String);;Argument[0];ReturnValue;taint |

‎csharp/ql/test/library-tests/frameworks/JsonNET/Json.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ void F()
4343
Sink(jobject["1"]);
4444
Sink(jobject["1"]["2"]);
4545
Sink((string)jobject["1"]["2"]);
46+
Sink(jobject.ToString());
4647

4748
// Linq JToken tests
4849
Sink(jobject.First((JToken i) => true));

‎csharp/ql/test/library-tests/frameworks/JsonNET/Json.expected

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@
1010
| Json.cs:16:24:16:32 | "tainted" | Json.cs:43:18:43:29 | access to indexer |
1111
| Json.cs:16:24:16:32 | "tainted" | Json.cs:44:18:44:34 | access to indexer |
1212
| Json.cs:16:24:16:32 | "tainted" | Json.cs:45:18:45:42 | call to operator explicit conversion |
13-
| Json.cs:16:24:16:32 | "tainted" | Json.cs:48:18:48:50 | call to method First<JToken> |
14-
| Json.cs:16:24:16:32 | "tainted" | Json.cs:49:18:49:46 | call to method First<JToken> |
15-
| Json.cs:16:24:16:32 | "tainted" | Json.cs:50:18:50:51 | call to method First<JToken> |
16-
| Json.cs:16:24:16:32 | "tainted" | Json.cs:51:18:51:61 | call to method SelectToken |
13+
| Json.cs:16:24:16:32 | "tainted" | Json.cs:46:18:46:35 | call to method ToString |
14+
| Json.cs:16:24:16:32 | "tainted" | Json.cs:49:18:49:50 | call to method First<JToken> |
15+
| Json.cs:16:24:16:32 | "tainted" | Json.cs:50:18:50:46 | call to method First<JToken> |
16+
| Json.cs:16:24:16:32 | "tainted" | Json.cs:51:18:51:51 | call to method First<JToken> |
17+
| Json.cs:16:24:16:32 | "tainted" | Json.cs:52:18:52:61 | call to method SelectToken |

0 commit comments

Comments
 (0)