Skip to content

Commit 6f845b0

Browse files
raulgarciamsftraulgarciamsft
committed
Using CodeQL AutoFormat
1 parent 7923c48 commit 6f845b0

File tree

5 files changed

+62
-70
lines changed

5 files changed

+62
-70
lines changed

‎csharp/ql/src/experimental/Security Features/Serialization/DataSetSerialization.qll

Lines changed: 35 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,13 @@
33
*
44
* Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details.
55
*/
6-
7-
import csharp
6+
7+
import csharp
88

99
/**
1010
* Abstract class that depends or inherits from `DataSet` or `DataTable` types.
1111
*/
12-
abstract class DataSetOrTableRelatedClass extends Class {
13-
}
12+
abstract class DataSetOrTableRelatedClass extends Class { }
1413

1514
/**
1615
* `DataSet`, `DataTable` types, or any types derived from them.
@@ -27,14 +26,13 @@ class DataSetOrTable extends DataSetOrTableRelatedClass {
2726
*/
2827
class ClassWithDataSetOrTableMember extends DataSetOrTableRelatedClass {
2928
ClassWithDataSetOrTableMember() {
30-
exists( Property p |
31-
p = this.getAProperty() |
32-
p.getType() instanceof DataSetOrTable
33-
) or this.getAMember().(AssignableMember).getType() instanceof DataSetOrTable
34-
or exists( Property p |
35-
p = this.getAProperty() |
29+
exists(Property p | p = this.getAProperty() | p.getType() instanceof DataSetOrTable)
30+
or
31+
this.getAMember().(AssignableMember).getType() instanceof DataSetOrTable
32+
or
33+
exists(Property p | p = this.getAProperty() |
3634
p.getType() instanceof DataSetOrTable or
37-
p.getType().(ConstructedGeneric).getATypeArgument() instanceof DataSetOrTable
35+
p.getType().(ConstructedGeneric).getATypeArgument() instanceof DataSetOrTable
3836
)
3937
}
4038
}
@@ -48,11 +46,14 @@ class SerializableClass extends Class {
4846
this.getABaseType*().getQualifiedName() = "System.Xml.Serialization.XmlSerializer" or
4947
this.getABaseInterface*().getQualifiedName() = "System.Runtime.Serialization.ISerializable" or
5048
this.getABaseType*().getQualifiedName() = "System.Runtime.Serialization.XmlObjectSerializer" or
51-
this.getABaseInterface*().getQualifiedName() = "System.Runtime.Serialization.ISerializationSurrogateProvider" or
52-
this.getABaseType*().getQualifiedName() = "System.Runtime.Serialization.XmlSerializableServices" or
49+
this.getABaseInterface*().getQualifiedName() =
50+
"System.Runtime.Serialization.ISerializationSurrogateProvider" or
51+
this.getABaseType*().getQualifiedName() =
52+
"System.Runtime.Serialization.XmlSerializableServices" or
5353
this.getABaseInterface*().getQualifiedName() = "System.Xml.Serialization.IXmlSerializable"
54-
) or exists( Attribute a |
55-
a = this.getAnAttribute() |
54+
)
55+
or
56+
exists(Attribute a | a = this.getAnAttribute() |
5657
a.getType().getQualifiedName().toString() = "System.SerializableAttribute"
5758
)
5859
}
@@ -61,14 +62,14 @@ class SerializableClass extends Class {
6162
/**
6263
* Holds if the serializable class `c` has a property or field `m` that is of `DataSet` or `DataTable` related type
6364
*/
64-
predicate isClassUnsafeXmlSerializerImplementation( SerializableClass c, Member m) {
65-
exists( Property p |
66-
m = p |
65+
predicate isClassUnsafeXmlSerializerImplementation(SerializableClass c, Member m) {
66+
exists(Property p | m = p |
6767
p = c.getAProperty() and
6868
p.getType() instanceof DataSetOrTableRelatedClass
69-
) or exists ( AssignableMember am |
70-
am = m |
71-
( am = c.getAField() or am = c.getAMember() ) and
69+
)
70+
or
71+
exists(AssignableMember am | am = m |
72+
(am = c.getAField() or am = c.getAMember()) and
7273
am.getType() instanceof DataSetOrTableRelatedClass
7374
)
7475
}
@@ -77,26 +78,25 @@ predicate isClassUnsafeXmlSerializerImplementation( SerializableClass c, Member
7778
* Serializable class that has a property or field that is of `DataSet` or `DataTable` related type
7879
*/
7980
class UnsafeXmlSerializerImplementation extends SerializableClass {
80-
UnsafeXmlSerializerImplementation() {
81-
isClassUnsafeXmlSerializerImplementation( this, _ )
82-
}
81+
UnsafeXmlSerializerImplementation() { isClassUnsafeXmlSerializerImplementation(this, _) }
8382
}
8483

8584
/**
8685
* Method that may be unsafe when used to deserialize DataSet and DataTable related types
8786
*/
8887
class UnsafeXmlReadMethod extends Method {
8988
UnsafeXmlReadMethod() {
90-
this.getQualifiedName().toString() = "System.Data.DataTable.ReadXml" or
91-
this.getQualifiedName().toString() = "System.Data.DataTable.ReadXmlSchema" or
92-
this.getQualifiedName().toString() = "System.Data.DataSet.ReadXml" or
93-
this.getQualifiedName().toString() = "System.Data.DataSet.ReadXmlSchema" or
94-
(
95-
this.getName().matches("ReadXml%") and
96-
exists( Class c |
97-
c.getAMethod() = this |
98-
c.getABaseType*() instanceof DataSetOrTableRelatedClass
99-
)
89+
this.getQualifiedName().toString() = "System.Data.DataTable.ReadXml"
90+
or
91+
this.getQualifiedName().toString() = "System.Data.DataTable.ReadXmlSchema"
92+
or
93+
this.getQualifiedName().toString() = "System.Data.DataSet.ReadXml"
94+
or
95+
this.getQualifiedName().toString() = "System.Data.DataSet.ReadXmlSchema"
96+
or
97+
this.getName().matches("ReadXml%") and
98+
exists(Class c | c.getAMethod() = this |
99+
c.getABaseType*() instanceof DataSetOrTableRelatedClass
100100
)
101101
}
102102
}
@@ -105,9 +105,5 @@ class UnsafeXmlReadMethod extends Method {
105105
* MethodCall that may be unsafe when used to deserialize DataSet and DataTable related types
106106
*/
107107
class UnsafeXmlReadMethodCall extends MethodCall {
108-
UnsafeXmlReadMethodCall() {
109-
exists( UnsafeXmlReadMethod uxrm |
110-
uxrm.getACall() = this
111-
)
112-
}
108+
UnsafeXmlReadMethodCall() { exists(UnsafeXmlReadMethod uxrm | uxrm.getACall() = this) }
113109
}

‎csharp/ql/src/experimental/Security Features/Serialization/DefiningDatasetRelatedType.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,5 @@ import DataSetSerialization
1212

1313
from DataSetOrTableRelatedClass dstc
1414
where dstc.fromSource()
15-
select dstc, "Defining a class that inherits or has a property derived from the obsolete DataSet or DataTable types. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details."
15+
select dstc,
16+
"Defining a class that inherits or has a property derived from the obsolete DataSet or DataTable types. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details."

‎csharp/ql/src/experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.ql

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* @name Defining a potentially unsafe XML serializer
2+
* @name Defining a potentially unsafe XML serializer
33
* @description Defining an XML serializable class that includes members that derive from dataSet or DataTable type may lead to a security problem. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details.
44
* @kind problem
55
* @problem.severity error
@@ -12,8 +12,9 @@ import csharp
1212
import DataSetSerialization
1313

1414
from UnsafeXmlSerializerImplementation c, Member m
15-
where c.fromSource() and
16-
isClassUnsafeXmlSerializerImplementation( c, m)
17-
select m, "Defining an serializable class $@ that has member $@ of a type that is derived from DataSet or DataTable types and may lead to a security problem. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details.",
18-
c, c.toString(),
19-
m, m.toString()
15+
where
16+
c.fromSource() and
17+
isClassUnsafeXmlSerializerImplementation(c, m)
18+
select m,
19+
"Defining an serializable class $@ that has member $@ of a type that is derived from DataSet or DataTable types and may lead to a security problem. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details.",
20+
c, c.toString(), m, m.toString()

‎csharp/ql/src/experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.ql

Lines changed: 15 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -11,40 +11,33 @@
1111
import csharp
1212
import DataSetSerialization
1313

14-
predicate xmlSerializerConstructorArgument (Expr e) {
15-
exists (ObjectCreation oc, Constructor c |
16-
e = oc.getArgument(0) |
14+
predicate xmlSerializerConstructorArgument(Expr e) {
15+
exists(ObjectCreation oc, Constructor c | e = oc.getArgument(0) |
1716
c = oc.getTarget() and
18-
(
19-
c.getDeclaringType().getABaseType*().hasQualifiedName("System.Xml.Serialization.XmlSerializer")
20-
)
17+
c.getDeclaringType().getABaseType*().hasQualifiedName("System.Xml.Serialization.XmlSerializer")
2118
)
2219
}
2320

24-
predicate unsafeDataContractTypeCreation (Expr e) {
25-
exists(MethodCall gt |
21+
predicate unsafeDataContractTypeCreation(Expr e) {
22+
exists(MethodCall gt |
2623
gt.getTarget().getName() = "GetType" and
2724
e = gt and
2825
gt.getQualifier().getType() instanceof DataSetOrTableRelatedClass
29-
) or
26+
)
27+
or
3028
e.(TypeofExpr).getTypeAccess().getTarget() instanceof DataSetOrTableRelatedClass
3129
}
3230

3331
class Conf extends DataFlow::Configuration {
34-
Conf() {
35-
this = "FlowToDataSerializerConstructor"
36-
}
37-
38-
override predicate isSource(DataFlow::Node node) {
39-
unsafeDataContractTypeCreation(node.asExpr())
40-
}
41-
42-
override predicate isSink(DataFlow::Node node) {
43-
xmlSerializerConstructorArgument (node.asExpr())
44-
}
45-
}
32+
Conf() { this = "FlowToDataSerializerConstructor" }
4633

34+
override predicate isSource(DataFlow::Node node) { unsafeDataContractTypeCreation(node.asExpr()) }
35+
36+
override predicate isSink(DataFlow::Node node) { xmlSerializerConstructorArgument(node.asExpr()) }
37+
}
4738

4839
from Conf conf, DataFlow::Node source, DataFlow::Node sink
4940
where conf.hasFlow(source, sink)
50-
select sink, "Unsafe type is used in data contract serializer. Make sure $@ comes from the trusted source.", source, source.toString()
41+
select sink,
42+
"Unsafe type is used in data contract serializer. Make sure $@ comes from the trusted source.",
43+
source, source.toString()

‎csharp/ql/src/experimental/Security Features/Serialization/XmlDeserializationWithDataSet.ql

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,6 @@ import csharp
1212
import DataSetSerialization
1313

1414
from UnsafeXmlReadMethodCall mc
15-
where exists( Method m | m.getACall() = mc )
16-
select mc, "Making an XML deserialization call with a type derived from DataSet or DataTable types and may lead to a security problem. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details."
15+
where exists(Method m | m.getACall() = mc)
16+
select mc,
17+
"Making an XML deserialization call with a type derived from DataSet or DataTable types and may lead to a security problem. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details."

0 commit comments

Comments
 (0)