Use TaintTracking2

Author: edvraa

csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql

@@ -24,12 +24,12 @@ class LocalSource extends Source {
   LocalSource() { this instanceof LocalFlowSource }
 }
 
-from
-  TaintToObjectMethodTrackingConfig taintTracking, DataFlow::PathNode userInput,
-  DataFlow::PathNode deserializeCallArg
+from DataFlow::PathNode userInput, DataFlow::PathNode deserializeCallArg
 where
-  // all flows from user input to deserialization with weak and strong type serializers
-  taintTracking.hasFlowPath(userInput, deserializeCallArg) and
+  exists(TaintToObjectMethodTrackingConfig taintTracking |
+    // all flows from user input to deserialization with weak and strong type serializers
+    taintTracking.hasFlowPath(userInput, deserializeCallArg)
+  ) and
   // intersect with strong types, but user controlled or weak types deserialization usages
   (
     exists(

csharp/ql/src/semmle/code/csharp/security/dataflow/UnsafeDeserialization.qll

@@ -7,6 +7,7 @@ import csharp
 
 module UnsafeDeserialization {
   private import semmle.code.csharp.serialization.Deserializers
+  private import semmle.code.csharp.dataflow.TaintTracking2
 
   /**
    * A data flow source for unsafe deserialization vulnerabilities.
@@ -57,7 +58,7 @@ module UnsafeDeserialization {
   /**
    * User input to instance type flow tracking.
    */
-  class TaintToObjectTypeTrackingConfig extends TaintTracking::Configuration {
+  class TaintToObjectTypeTrackingConfig extends TaintTracking2::Configuration {
     TaintToObjectTypeTrackingConfig() { this = "TaintToObjectTypeTrackingConfig" }
 
     override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -90,7 +91,7 @@ module UnsafeDeserialization {
   /**
    * Unsafe deserializer creation to usage tracking config.
    */
-  class WeakTypeCreationToUsageTrackingConfig extends TaintTracking::Configuration {
+  class WeakTypeCreationToUsageTrackingConfig extends TaintTracking2::Configuration {
     WeakTypeCreationToUsageTrackingConfig() { this = "DeserializerCreationToUsageTrackingConfig" }
 
     override predicate isSource(DataFlow::Node source) {
@@ -111,7 +112,7 @@ module UnsafeDeserialization {
   /**
    * Safe deserializer creation to usage tracking config.
    */
-  abstract class SafeConstructorTrackingConfig extends TaintTracking::Configuration {
+  abstract class SafeConstructorTrackingConfig extends TaintTracking2::Configuration {
     bindingset[this]
     SafeConstructorTrackingConfig() { any() }
   }