Skip to content

Commit e84a509

Browse files
egregius313egregius313
committed
Modify test cases
1 parent c3671c7 commit e84a509

20 files changed

+254
-165
lines changed

‎csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
using System;
2+
using System.Data.SqlClient;
3+
using System.Diagnostics;
24

35
namespace System.Web.UI.WebControls
46
{
@@ -34,5 +36,22 @@ public void WebCommandInjection()
3436
startInfoProps.WorkingDirectory = userInput;
3537
Process.Start(startInfoProps);
3638
}
39+
40+
public void StoredCommandInjection()
41+
{
42+
using (SqlConnection connection = new SqlConnection(""))
43+
{
44+
connection.Open();
45+
SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
46+
SqlDataReader customerReader = customerCommand.ExecuteReader();
47+
48+
while (customerReader.Read())
49+
{
50+
// BAD: Read from database, and use it to directly execute a command
51+
Process.Start("foo.exe", "/c " + customerReader.GetString(1));
52+
}
53+
customerReader.Close();
54+
}
55+
}
3756
}
3857
}

‎csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected

Lines changed: 58 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
edges
2+
<<<<<<< HEAD
23
| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:26:27:26:47 | ... + ... | provenance | |
34
| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:26:50:26:66 | ... + ... | provenance | |
45
| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:28:63:28:71 | access to local variable userInput | provenance | |
@@ -42,18 +43,63 @@ nodes
4243
| CommandInjection.cs:33:13:33:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
4344
| CommandInjection.cs:33:40:33:48 | access to local variable userInput | semmle.label | access to local variable userInput |
4445
| CommandInjection.cs:33:40:33:48 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
46+
=======
47+
| CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:27:32:27:51 | access to property Text : String | provenance | |
48+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:28:27:28:47 | ... + ... | provenance | |
49+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:28:50:28:66 | ... + ... | provenance | |
50+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:63:30:71 | access to local variable userInput | provenance | |
51+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | provenance | |
52+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:74:30:82 | access to local variable userInput | provenance | |
53+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | provenance | |
54+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:34:39:34:47 | access to local variable userInput | provenance | |
55+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:34:39:34:47 | access to local variable userInput : String | provenance | |
56+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:35:40:35:48 | access to local variable userInput | provenance | |
57+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:35:40:35:48 | access to local variable userInput : String | provenance | |
58+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:36:47:36:55 | access to local variable userInput | provenance | |
59+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:36:47:36:55 | access to local variable userInput : String | provenance | |
60+
| CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | CommandInjection.cs:31:27:31:35 | access to local variable startInfo | provenance | |
61+
| CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | provenance | |
62+
| CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | provenance | |
63+
| CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | provenance | |
64+
| CommandInjection.cs:34:39:34:47 | access to local variable userInput : String | CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
65+
| CommandInjection.cs:35:13:35:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | provenance | |
66+
| CommandInjection.cs:35:40:35:48 | access to local variable userInput : String | CommandInjection.cs:35:13:35:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
67+
| CommandInjection.cs:36:13:36:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | provenance | |
68+
| CommandInjection.cs:36:47:36:55 | access to local variable userInput : String | CommandInjection.cs:36:13:36:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
69+
| CommandInjection.cs:51:54:51:80 | call to method GetString : String | CommandInjection.cs:51:46:51:80 | ... + ... | provenance | |
70+
nodes
71+
| CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
72+
| CommandInjection.cs:27:32:27:51 | access to property Text : String | semmle.label | access to property Text : String |
73+
| CommandInjection.cs:28:27:28:47 | ... + ... | semmle.label | ... + ... |
74+
| CommandInjection.cs:28:50:28:66 | ... + ... | semmle.label | ... + ... |
75+
| CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | semmle.label | object creation of type ProcessStartInfo : ProcessStartInfo |
76+
| CommandInjection.cs:30:63:30:71 | access to local variable userInput | semmle.label | access to local variable userInput |
77+
| CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
78+
| CommandInjection.cs:30:74:30:82 | access to local variable userInput | semmle.label | access to local variable userInput |
79+
| CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
80+
| CommandInjection.cs:31:27:31:35 | access to local variable startInfo | semmle.label | access to local variable startInfo |
81+
>>>>>>> 4fc83a3267 (Modify test cases)
4582
| CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
46-
| CommandInjection.cs:34:47:34:55 | access to local variable userInput | semmle.label | access to local variable userInput |
47-
| CommandInjection.cs:34:47:34:55 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
48-
| CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | semmle.label | access to local variable startInfoProps |
83+
| CommandInjection.cs:34:39:34:47 | access to local variable userInput | semmle.label | access to local variable userInput |
84+
| CommandInjection.cs:34:39:34:47 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
85+
| CommandInjection.cs:35:13:35:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
86+
| CommandInjection.cs:35:40:35:48 | access to local variable userInput | semmle.label | access to local variable userInput |
87+
| CommandInjection.cs:35:40:35:48 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
88+
| CommandInjection.cs:36:13:36:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
89+
| CommandInjection.cs:36:47:36:55 | access to local variable userInput | semmle.label | access to local variable userInput |
90+
| CommandInjection.cs:36:47:36:55 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
91+
| CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | semmle.label | access to local variable startInfoProps |
92+
| CommandInjection.cs:51:46:51:80 | ... + ... | semmle.label | ... + ... |
93+
| CommandInjection.cs:51:54:51:80 | call to method GetString : String | semmle.label | call to method GetString : String |
4994
subpaths
5095
#select
51-
| CommandInjection.cs:26:27:26:47 | ... + ... | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:27:26:47 | ... + ... | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
52-
| CommandInjection.cs:26:50:26:66 | ... + ... | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:50:26:66 | ... + ... | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
53-
| CommandInjection.cs:28:63:28:71 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:63:28:71 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
54-
| CommandInjection.cs:28:74:28:82 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:74:28:82 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
55-
| CommandInjection.cs:29:27:29:35 | access to local variable startInfo | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:29:27:29:35 | access to local variable startInfo | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
56-
| CommandInjection.cs:32:39:32:47 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:32:39:32:47 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
57-
| CommandInjection.cs:33:40:33:48 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:33:40:33:48 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
58-
| CommandInjection.cs:34:47:34:55 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:34:47:34:55 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
59-
| CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
96+
| CommandInjection.cs:28:27:28:47 | ... + ... | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:27:28:47 | ... + ... | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
97+
| CommandInjection.cs:28:50:28:66 | ... + ... | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:50:28:66 | ... + ... | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
98+
| CommandInjection.cs:30:63:30:71 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:30:63:30:71 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
99+
| CommandInjection.cs:30:74:30:82 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:30:74:30:82 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
100+
| CommandInjection.cs:31:27:31:35 | access to local variable startInfo | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:31:27:31:35 | access to local variable startInfo | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
101+
| CommandInjection.cs:34:39:34:47 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:34:39:34:47 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
102+
| CommandInjection.cs:35:40:35:48 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:35:40:35:48 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
103+
| CommandInjection.cs:36:47:36:55 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:36:47:36:55 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
104+
| CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
105+
| CommandInjection.cs:51:46:51:80 | ... + ... | CommandInjection.cs:51:54:51:80 | call to method GetString : String | CommandInjection.cs:51:46:51:80 | ... + ... | This command line depends on a $@. | CommandInjection.cs:51:54:51:80 | call to method GetString | user-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.ext.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
3+
- addsTo:
4+
pack: codeql/threat-models
5+
extensible: threatModelConfiguration
6+
data:
7+
- ["local", true, 0]

‎csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.cs

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.expected

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.qlref

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.ext.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
3+
- addsTo:
4+
pack: codeql/threat-models
5+
extensible: threatModelConfiguration
6+
data:
7+
- ["local", true, 0]

‎csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.qlref

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
Security Features/CWE-079/StoredXSS.ql
1+
Security Features/CWE-079/XSS.ql

‎csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.cs

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
using System;
2+
using System.Data.SqlClient;
23
using System.DirectoryServices;
34
using System.DirectoryServices.Protocols;
45
using System.Web;
@@ -27,6 +28,20 @@ public void ProcessRequest(HttpContext ctx)
2728
DirectoryEntry de = new DirectoryEntry("LDAP://Cn=" + userName);
2829
DirectoryEntry de2 = new DirectoryEntry();
2930
de2.Path = "LDAP://Cn=" + userName;
31+
32+
using (SqlConnection connection = new SqlConnection(""))
33+
{
34+
connection.Open();
35+
SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
36+
SqlDataReader customerReader = customerCommand.ExecuteReader();
37+
38+
while (customerReader.Read())
39+
{
40+
// BAD: Read from database, write it straight to a response
41+
DirectorySearcher ds4 = new DirectorySearcher("accountname=" + customerReader.GetString(1));
42+
}
43+
customerReader.Close();
44+
}
3045
}
3146

3247
public string LDAPEncode(string value)

0 commit comments

Comments
 (0)