Skip to content

Commit 9fe822f

Browse files
author
Porcuiney Hairs
committed
Include suggestions from review
1 parent cf31b6e commit 9fe822f

File tree

2 files changed

+7
-6
lines changed

2 files changed

+7
-6
lines changed

csharp/ql/src/experimental/CWE-918/RequestForgery.ql

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
/**
2-
* @name Uncontrolled data used in a WebClient
3-
* @description The WebClient class allows developers to request resources,
4-
* accessing resources influenced by users can allow an attacker to access local files.
2+
* @name Uncontrolled data used in network request
3+
* @description Sending network requests with user-controlled data allows for request forgery attacks.
54
* @kind path-problem
65
* @problem.severity error
76
* @precision high
@@ -16,5 +15,5 @@ import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1615

1716
from RequestForgeryConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
1817
where c.hasFlowPath(source, sink)
19-
select sink.getNode(), source, sink, "$@ flows to here and is used in a method of WebClient.",
18+
select sink.getNode(), source, sink, "$@ flows to here and is used in a server side web request.",
2019
source.getNode(), "User-provided value"

csharp/ql/src/experimental/CWE-918/RequestForgery.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ module RequestForgery {
2424
abstract private class BarrierGuard extends DataFlow::BarrierGuard { }
2525

2626
/**
27-
* A taint-tracking configuration for detecting server side request forgery vulnerabilities.
27+
* A data flow configuration for detecting server side request forgery vulnerabilities.
2828
*/
2929
class RequestForgeryConfiguration extends DataFlow::Configuration {
3030
RequestForgeryConfiguration() { this = "Server Side Request forgery" }
@@ -148,7 +148,9 @@ module RequestForgery {
148148
* This guard considers all checks as valid.
149149
*/
150150
private class StringStartsWithBarrierGuard extends BarrierGuard, MethodCall {
151-
StringStartsWithBarrierGuard() { this.getTarget().hasQualifiedName("System.String.StartsWith") }
151+
StringStartsWithBarrierGuard() {
152+
this.getTarget().hasQualifiedName("System.String", "StartsWith")
153+
}
152154

153155
override predicate checks(Expr e, AbstractValue v) {
154156
// Any check such as the ones shown below

0 commit comments

Comments
 (0)