Skip to content

Commit a4bea05

Browse files
michaelnebelmichaelnebel
authored
Merge pull request #7342 from michaelnebel/csharp-mad-as-csv3
C#: More Flow summaries in CSV format.
2 parents a636021 + be1e754 commit a4bea05

File tree

9 files changed

+101
-154
lines changed

9 files changed

+101
-154
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,10 @@ private module Frameworks {
9393
private import semmle.code.csharp.frameworks.Sql
9494
private import semmle.code.csharp.frameworks.EntityFramework
9595
private import semmle.code.csharp.frameworks.system.Text
96+
private import semmle.code.csharp.frameworks.system.Net
97+
private import semmle.code.csharp.frameworks.system.Web
98+
private import semmle.code.csharp.frameworks.system.collections.Generic
99+
private import semmle.code.csharp.frameworks.system.web.ui.WebControls
96100
}
97101

98102
/**

‎csharp/ql/lib/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll

Lines changed: 0 additions & 150 deletions
Original file line numberDiff line numberDiff line change
@@ -1330,106 +1330,6 @@ class IDictionaryFlow extends LibraryTypeDataFlow, RefType {
13301330
}
13311331
}
13321332

1333-
/** Data flow for `System.Web.HttpCookie`. */
1334-
class SystemWebHttpCookieFlow extends LibraryTypeDataFlow, SystemWebHttpCookie {
1335-
override predicate callableFlow(
1336-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
1337-
boolean preservesValue
1338-
) {
1339-
exists(Property p |
1340-
this.propertyFlow(p) and
1341-
source = TCallableFlowSourceQualifier() and
1342-
sink = TCallableFlowSinkReturn() and
1343-
c = p.getGetter()
1344-
) and
1345-
preservesValue = false
1346-
}
1347-
1348-
private predicate propertyFlow(Property p) {
1349-
p = this.getValueProperty() or
1350-
p = this.getValuesProperty()
1351-
}
1352-
}
1353-
1354-
/** Data flow for `System.Net.Cookie`. */
1355-
class SystemNetCookieFlow extends LibraryTypeDataFlow, SystemNetCookieClass {
1356-
override predicate callableFlow(
1357-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
1358-
boolean preservesValue
1359-
) {
1360-
exists(Property p |
1361-
this.propertyFlow(p) and
1362-
source = TCallableFlowSourceQualifier() and
1363-
sink = TCallableFlowSinkReturn() and
1364-
c = p.getGetter()
1365-
) and
1366-
preservesValue = false
1367-
}
1368-
1369-
private predicate propertyFlow(Property p) { p = this.getValueProperty() }
1370-
}
1371-
1372-
/** Data flow for `System.Net.IPHostEntry`. */
1373-
class SystemNetIPHostEntryFlow extends LibraryTypeDataFlow, SystemNetIPHostEntryClass {
1374-
override predicate callableFlow(
1375-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
1376-
boolean preservesValue
1377-
) {
1378-
exists(Property p |
1379-
this.propertyFlow(p) and
1380-
source = TCallableFlowSourceQualifier() and
1381-
sink = TCallableFlowSinkReturn() and
1382-
c = p.getGetter()
1383-
) and
1384-
preservesValue = false
1385-
}
1386-
1387-
private predicate propertyFlow(Property p) {
1388-
p = this.getHostNameProperty() or
1389-
p = this.getAliasesProperty()
1390-
}
1391-
}
1392-
1393-
/** Data flow for `System.Web.UI.WebControls.TextBox`. */
1394-
class SystemWebUIWebControlsTextBoxFlow extends LibraryTypeDataFlow,
1395-
SystemWebUIWebControlsTextBoxClass {
1396-
override predicate callableFlow(
1397-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
1398-
boolean preservesValue
1399-
) {
1400-
exists(Property p |
1401-
this.propertyFlow(p) and
1402-
source = TCallableFlowSourceQualifier() and
1403-
sink = TCallableFlowSinkReturn() and
1404-
c = p.getGetter()
1405-
) and
1406-
preservesValue = false
1407-
}
1408-
1409-
private predicate propertyFlow(Property p) { p = this.getTextProperty() }
1410-
}
1411-
1412-
/** Data flow for `System.Collections.Generic.KeyValuePair`. */
1413-
class SystemCollectionsGenericKeyValuePairStructFlow extends LibraryTypeDataFlow,
1414-
SystemCollectionsGenericKeyValuePairStruct {
1415-
override predicate callableFlow(
1416-
CallableFlowSource source, AccessPath sourceAp, CallableFlowSink sink, AccessPath sinkAp,
1417-
SourceDeclarationCallable c, boolean preservesValue
1418-
) {
1419-
preservesValue = true and
1420-
exists(int i |
1421-
c.(Constructor).getDeclaringType() = this and
1422-
source = TCallableFlowSourceArg(i) and
1423-
sourceAp = AccessPath::empty() and
1424-
sink = TCallableFlowSinkReturn()
1425-
|
1426-
i = 0 and sinkAp = AccessPath::property(this.getKeyProperty())
1427-
or
1428-
i = 1 and sinkAp = AccessPath::property(this.getValueProperty())
1429-
)
1430-
}
1431-
}
1432-
14331333
/** Data flow for `System.[Value]Tuple<,...,>`. */
14341334
class SystemTupleFlow extends LibraryTypeDataFlow, ValueOrRefType {
14351335
SystemTupleFlow() {
@@ -2065,56 +1965,6 @@ class SystemIOPathFlow extends LibraryTypeDataFlow, SystemIOPathClass {
20651965
}
20661966
}
20671967

2068-
/** Data flow for `System.Web.HttpUtility`. */
2069-
class SystemWebHttpUtilityFlow extends LibraryTypeDataFlow, SystemWebHttpUtility {
2070-
override predicate callableFlow(
2071-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
2072-
boolean preservesValue
2073-
) {
2074-
(
2075-
c = this.getAnHtmlAttributeEncodeMethod() or
2076-
c = this.getAnHtmlEncodeMethod() or
2077-
c = this.getAJavaScriptStringEncodeMethod() or
2078-
c = this.getAnUrlEncodeMethod()
2079-
) and
2080-
source = TCallableFlowSourceArg(0) and
2081-
sink = TCallableFlowSinkReturn() and
2082-
preservesValue = false
2083-
}
2084-
}
2085-
2086-
/** Data flow for `System.Web.HttpServerUtility`. */
2087-
class SystemWebHttpServerUtilityFlow extends LibraryTypeDataFlow, SystemWebHttpServerUtility {
2088-
override predicate callableFlow(
2089-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
2090-
boolean preservesValue
2091-
) {
2092-
(
2093-
c = this.getAnHtmlEncodeMethod() or
2094-
c = this.getAnUrlEncodeMethod()
2095-
) and
2096-
source = TCallableFlowSourceArg(0) and
2097-
sink = TCallableFlowSinkReturn() and
2098-
preservesValue = false
2099-
}
2100-
}
2101-
2102-
/** Data flow for `System.Net.WebUtility`. */
2103-
class SystemNetWebUtilityFlow extends LibraryTypeDataFlow, SystemNetWebUtility {
2104-
override predicate callableFlow(
2105-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
2106-
boolean preservesValue
2107-
) {
2108-
(
2109-
c = this.getAnHtmlEncodeMethod() or
2110-
c = this.getAnUrlEncodeMethod()
2111-
) and
2112-
source = TCallableFlowSourceArg(0) and
2113-
sink = TCallableFlowSinkReturn() and
2114-
preservesValue = false
2115-
}
2116-
}
2117-
21181968
/**
21191969
* Custom flow through `StringValues` library class.
21201970
*/

‎csharp/ql/lib/semmle/code/csharp/frameworks/system/Net.qll

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import csharp
44
private import semmle.code.csharp.frameworks.System
5+
private import semmle.code.csharp.dataflow.ExternalFlow
56

67
/** The `System.Net` namespace. */
78
class SystemNetNamespace extends Namespace {
@@ -27,6 +28,18 @@ class SystemNetWebUtility extends SystemNetClass {
2728
Method getAnUrlEncodeMethod() { result = this.getAMethod("UrlEncode") }
2829
}
2930

31+
/** Data flow for `System.Net.WebUtility`. */
32+
private class SystemNetWebUtilityFlowModelCsv extends SummaryModelCsv {
33+
override predicate row(string row) {
34+
row =
35+
[
36+
"System.Net;WebUtility;false;HtmlEncode;(System.String);;Argument[0];ReturnValue;taint",
37+
"System.Net;WebUtility;false;HtmlEncode;(System.String,System.IO.TextWriter);;Argument[0];ReturnValue;taint",
38+
"System.Net;WebUtility;false;UrlEncode;(System.String);;Argument[0];ReturnValue;taint"
39+
]
40+
}
41+
}
42+
3043
/** The `System.Net.HttpListenerResponse` class. */
3144
class SystemNetHttpListenerResponseClass extends SystemNetClass {
3245
SystemNetHttpListenerResponseClass() { this.hasName("HttpListenerResponse") }
@@ -59,10 +72,28 @@ class SystemNetIPHostEntryClass extends SystemNetClass {
5972
Property getAliasesProperty() { result = this.getProperty("Aliases") }
6073
}
6174

75+
/** Data flow for `System.Net.IPHostEntry`. */
76+
private class SystemNetIPHostEntryClassFlowModelCsv extends SummaryModelCsv {
77+
override predicate row(string row) {
78+
row =
79+
[
80+
"System.Net;IPHostEntry;false;get_Aliases;();;Argument[-1];ReturnValue;taint",
81+
"System.Net;IPHostEntry;false;get_HostName;();;Argument[-1];ReturnValue;taint"
82+
]
83+
}
84+
}
85+
6286
/** The `System.Net.Cookie` class. */
6387
class SystemNetCookieClass extends SystemNetClass {
6488
SystemNetCookieClass() { this.hasName("Cookie") }
6589

6690
/** Gets the `Value` property. */
6791
Property getValueProperty() { result = this.getProperty("Value") }
6892
}
93+
94+
/** Data flow for `System.Net.Cookie`. */
95+
private class SystemNetCookieClassFlowModelCsv extends SummaryModelCsv {
96+
override predicate row(string row) {
97+
row = "System.Net;Cookie;false;get_Value;();;Argument[-1];ReturnValue;taint"
98+
}
99+
}

‎csharp/ql/lib/semmle/code/csharp/frameworks/system/Web.qll

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import csharp
44
private import semmle.code.csharp.frameworks.System
55
private import semmle.code.csharp.frameworks.system.collections.Specialized
6+
private import semmle.code.csharp.dataflow.ExternalFlow
67

78
/** The `System.Web` namespace. */
89
class SystemWebNamespace extends Namespace {
@@ -174,6 +175,17 @@ class SystemWebHttpServerUtility extends SystemWebClass {
174175
Method getAnUrlEncodeMethod() { result = this.getAMethod("UrlEncode") }
175176
}
176177

178+
/** Data flow for `System.Web.HttpServerUtility`. */
179+
private class SystemWebHttpServerUtilityFlowModelCsv extends SummaryModelCsv {
180+
override predicate row(string row) {
181+
row =
182+
[
183+
"System.Web;HttpServerUtility;false;HtmlEncode;(System.String);;Argument[0];ReturnValue;taint",
184+
"System.Web;HttpServerUtility;false;UrlEncode;(System.String);;Argument[0];ReturnValue;taint"
185+
]
186+
}
187+
}
188+
177189
/** The `System.Web.HttpUtility` class. */
178190
class SystemWebHttpUtility extends SystemWebClass {
179191
SystemWebHttpUtility() { this.hasName("HttpUtility") }
@@ -191,6 +203,26 @@ class SystemWebHttpUtility extends SystemWebClass {
191203
Method getAnUrlEncodeMethod() { result = this.getAMethod("UrlEncode") }
192204
}
193205

206+
/** Data flow for `System.Web.HttpUtility`. */
207+
private class SystemWebHttpUtilityFlowModelCsv extends SummaryModelCsv {
208+
override predicate row(string row) {
209+
row =
210+
[
211+
"System.Web;HttpUtility;false;HtmlAttributeEncode;(System.String);;Argument[0];ReturnValue;taint",
212+
"System.Web;HttpUtility;false;HtmlAttributeEncode;(System.String,System.IO.TextWriter);;Argument[0];ReturnValue;taint",
213+
"System.Web;HttpUtility;false;HtmlEncode;(System.Object);;Argument[0];ReturnValue;taint",
214+
"System.Web;HttpUtility;false;HtmlEncode;(System.String);;Argument[0];ReturnValue;taint",
215+
"System.Web;HttpUtility;false;HtmlEncode;(System.String,System.IO.TextWriter);;Argument[0];ReturnValue;taint",
216+
"System.Web;HttpUtility;false;JavaScriptStringEncode;(System.String);;Argument[0];ReturnValue;taint",
217+
"System.Web;HttpUtility;false;JavaScriptStringEncode;(System.String,System.Boolean);;Argument[0];ReturnValue;taint",
218+
"System.Web;HttpUtility;false;UrlEncode;(System.Byte[]);;Argument[0];ReturnValue;taint",
219+
"System.Web;HttpUtility;false;UrlEncode;(System.Byte[],System.Int32,System.Int32);;Argument[0];ReturnValue;taint",
220+
"System.Web;HttpUtility;false;UrlEncode;(System.String);;Argument[0];ReturnValue;taint",
221+
"System.Web;HttpUtility;false;UrlEncode;(System.String,System.Text.Encoding);;Argument[0];ReturnValue;taint"
222+
]
223+
}
224+
}
225+
194226
/** The `System.Web.HttpCookie` class. */
195227
class SystemWebHttpCookie extends SystemWebClass {
196228
SystemWebHttpCookie() { this.hasName("HttpCookie") }
@@ -205,6 +237,17 @@ class SystemWebHttpCookie extends SystemWebClass {
205237
Property getSecureProperty() { result = this.getProperty("Secure") }
206238
}
207239

240+
/** Data flow for `System.Web.HttpCookie`. */
241+
private class SystemWebHttpCookieFlowModelCsv extends SummaryModelCsv {
242+
override predicate row(string row) {
243+
row =
244+
[
245+
"System.Web;HttpCookie;false;get_Value;();;Argument[-1];ReturnValue;taint",
246+
"System.Web;HttpCookie;false;get_Values;();;Argument[-1];ReturnValue;taint"
247+
]
248+
}
249+
}
250+
208251
/** The `System.Web.IHtmlString` class. */
209252
class SystemWebIHtmlString extends SystemWebInterface {
210253
SystemWebIHtmlString() { this.hasName("IHtmlString") }

‎csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Generic.qll

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import csharp
44
private import semmle.code.csharp.frameworks.system.Collections
5+
private import semmle.code.csharp.dataflow.ExternalFlow
56

67
/** The `System.Collections.Generic` namespace. */
78
class SystemCollectionsGenericNamespace extends Namespace {
@@ -123,6 +124,17 @@ class SystemCollectionsGenericKeyValuePairStruct extends SystemCollectionsGeneri
123124
}
124125
}
125126

127+
/** Data flow for `System.Collections.Generic.KeyValuePair`. */
128+
private class SystemCollectionsGenericKeyValuePairStructFlowModelCsv extends SummaryModelCsv {
129+
override predicate row(string row) {
130+
row =
131+
[
132+
"System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[0];Property[System.Collections.Generic.KeyValuePair<,>.Key] of ReturnValue;value",
133+
"System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[1];Property[System.Collections.Generic.KeyValuePair<,>.Value] of ReturnValue;value"
134+
]
135+
}
136+
}
137+
126138
/** The `System.Collections.Generic.ICollection<>` interface. */
127139
class SystemCollectionsGenericICollectionInterface extends SystemCollectionsGenericUnboundGenericInterface {
128140
SystemCollectionsGenericICollectionInterface() { this.hasName("ICollection<>") }

‎csharp/ql/lib/semmle/code/csharp/frameworks/system/web/ui/WebControls.qll

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import csharp
44
private import semmle.code.csharp.frameworks.system.web.UI
5+
private import semmle.code.csharp.dataflow.ExternalFlow
56

67
/** The `System.Web.UI.WebControls` namespace. */
78
class SystemWebUIWebControlsNamespace extends Namespace {
@@ -28,6 +29,13 @@ class SystemWebUIWebControlsTextBoxClass extends SystemWebUIWebControlsClass {
2829
}
2930
}
3031

32+
/** Data flow for `System.Web.UI.WebControls.TextBox`. */
33+
private class SystebWebUIWebControlsTextBoxClassFlowModelCsv extends SummaryModelCsv {
34+
override predicate row(string row) {
35+
row = "System.Web.UI.WebControls;TextBox;false;get_Text;();;Argument[-1];ReturnValue;taint"
36+
}
37+
}
38+
3139
/** The `System.Web.UI.WebControls.Label` class. */
3240
class SystemWebUIWebControlsLabelClass extends SystemWebUIWebControlsClass {
3341
SystemWebUIWebControlsLabelClass() { this.hasName("Label") }

‎csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,8 +225,6 @@
225225
| System.Collections.Generic;IList<>;true;get_Item;(System.Int32);;Element of Argument[-1];ReturnValue;value |
226226
| System.Collections.Generic;IList<>;true;set_Item;(System.Int32,T);;Argument[1];Element of Argument[-1];value |
227227
| System.Collections.Generic;ISet<>;true;Add;(T);;Argument[0];Element of Argument[-1];value |
228-
| System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;();;Argument[0];Property[System.Collections.Generic.KeyValuePair<,>.Key] of ReturnValue;value |
229-
| System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;();;Argument[1];Property[System.Collections.Generic.KeyValuePair<,>.Value] of ReturnValue;value |
230228
| System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[0];Property[System.Collections.Generic.KeyValuePair<,>.Key] of ReturnValue;value |
231229
| System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[1];Property[System.Collections.Generic.KeyValuePair<,>.Value] of ReturnValue;value |
232230
| System.Collections.Generic;LinkedList<>;false;Add;(T);;Argument[0];Element of Argument[-1];value |
@@ -2220,6 +2218,7 @@
22202218
| System.Web.UI.WebControls;TextBox;false;get_Text;();;Argument[-1];ReturnValue;taint |
22212219
| System.Web;HttpCookie;false;get_Value;();;Argument[-1];ReturnValue;taint |
22222220
| System.Web;HttpCookie;false;get_Values;();;Argument[-1];ReturnValue;taint |
2221+
| System.Web;HttpServerUtility;false;HtmlEncode;(System.String);;Argument[0];ReturnValue;taint |
22232222
| System.Web;HttpServerUtility;false;UrlEncode;(System.String);;Argument[0];ReturnValue;taint |
22242223
| System.Web;HttpUtility;false;HtmlAttributeEncode;(System.String);;Argument[0];ReturnValue;taint |
22252224
| System.Web;HttpUtility;false;HtmlAttributeEncode;(System.String,System.IO.TextWriter);;Argument[0];ReturnValue;taint |

‎csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,6 @@
190190
| System.Collections.Generic;IDictionary<,>;true;set_Item;(TKey,TValue);;Argument[1];Property[System.Collections.Generic.KeyValuePair<,>.Value] of Element of Argument[-1];value |
191191
| System.Collections.Generic;IList<>;true;get_Item;(System.Int32);;Element of Argument[-1];ReturnValue;value |
192192
| System.Collections.Generic;IList<>;true;set_Item;(System.Int32,T);;Argument[1];Element of Argument[-1];value |
193-
| System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;();;Argument[0];Property[System.Collections.Generic.KeyValuePair<,>.Key] of ReturnValue;value |
194-
| System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;();;Argument[1];Property[System.Collections.Generic.KeyValuePair<,>.Value] of ReturnValue;value |
195193
| System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[0];Property[System.Collections.Generic.KeyValuePair<,>.Key] of ReturnValue;value |
196194
| System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[1];Property[System.Collections.Generic.KeyValuePair<,>.Value] of ReturnValue;value |
197195
| System.Collections.Generic;LinkedList<>;false;Add;(T);;Argument[0];Element of Argument[-1];value |
@@ -1905,6 +1903,7 @@
19051903
| System.Web.UI.WebControls;TextBox;false;get_Text;();;Argument[-1];ReturnValue;taint |
19061904
| System.Web;HttpCookie;false;get_Value;();;Argument[-1];ReturnValue;taint |
19071905
| System.Web;HttpCookie;false;get_Values;();;Argument[-1];ReturnValue;taint |
1906+
| System.Web;HttpServerUtility;false;HtmlEncode;(System.String);;Argument[0];ReturnValue;taint |
19081907
| System.Web;HttpServerUtility;false;UrlEncode;(System.String);;Argument[0];ReturnValue;taint |
19091908
| System.Web;HttpUtility;false;HtmlAttributeEncode;(System.String);;Argument[0];ReturnValue;taint |
19101909
| System.Web;HttpUtility;false;HtmlAttributeEncode;(System.String,System.IO.TextWriter);;Argument[0];ReturnValue;taint |

‎csharp/ql/test/resources/stubs/System.Web.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ public class HttpServerUtility
4242
{
4343
public void Transfer(string path) { }
4444
public string UrlEncode(string s) => null;
45+
public string HtmlEncode(string s) => null;
4546
}
4647

4748
public class HttpApplication : IHttpHandler

0 commit comments

Comments
 (0)