Skip to content

Commit 98001c4

Browse files
tamasvajktamasvajk
committed
C#: Add Dapper stub and new SqlInjection test cases
1 parent a23d8de commit 98001c4

File tree

3 files changed

+119
-1
lines changed

3 files changed

+119
-1
lines changed

‎csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// semmle-extractor-options: /r:System.ComponentModel.Primitives.dll /r:System.ComponentModel.TypeConverter.dll /r:System.Data.Common.dll ${testdir}/../../../resources/stubs/EntityFramework.cs ${testdir}/../../../resources/stubs/System.Data.cs ${testdir}/../../../resources/stubs/System.Windows.cs
1+
// semmle-extractor-options: /r:System.ComponentModel.Primitives.dll /r:System.ComponentModel.TypeConverter.dll /r:System.Data.Common.dll ${testdir}/../../../resources/stubs/EntityFramework.cs ${testdir}/../../../resources/stubs/System.Data.cs ${testdir}/../../../resources/stubs/System.Windows.cs ${testdir}/../../../resources/stubs/Dapper.cs /r:System.Linq.Expressions.dll
22

33
using System;
44

‎csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjectionDapper.cs

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
using System;
2+
3+
namespace Test
4+
{
5+
using System.Data;
6+
using System.Data.Entity;
7+
using System.Data.SqlClient;
8+
using System.Web.UI.WebControls;
9+
using System.Threading.Tasks;
10+
using Dapper;
11+
12+
class SqlInjectionDapper
13+
{
14+
string connectionString;
15+
16+
public void Bad01()
17+
{
18+
using (var connection = new SqlConnection(connectionString))
19+
{
20+
var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
21+
var result = connection.Query<object>(query);
22+
}
23+
}
24+
25+
public async Task Bad02()
26+
{
27+
using (var connection = new SqlConnection(connectionString))
28+
{
29+
var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
30+
var result = await connection.QueryAsync<object>(query);
31+
}
32+
}
33+
34+
public async Task Bad03()
35+
{
36+
using (var connection = new SqlConnection(connectionString))
37+
{
38+
var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
39+
var result = await connection.QueryFirstAsync(query);
40+
}
41+
}
42+
43+
public async Task Bad04()
44+
{
45+
using (var connection = new SqlConnection(connectionString))
46+
{
47+
var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
48+
49+
await connection.ExecuteAsync(query);
50+
}
51+
}
52+
53+
public void Bad05()
54+
{
55+
using (var connection = new SqlConnection(connectionString))
56+
{
57+
var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
58+
connection.ExecuteScalar(query);
59+
}
60+
}
61+
62+
public void Bad06()
63+
{
64+
using (var connection = new SqlConnection(connectionString))
65+
{
66+
var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
67+
connection.ExecuteReader(query);
68+
}
69+
}
70+
71+
public async Task Bad07()
72+
{
73+
using (var connection = new SqlConnection(connectionString))
74+
{
75+
var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
76+
77+
var comDef = new CommandDefinition(query);
78+
var result = await connection.QueryFirstAsync(comDef);
79+
}
80+
}
81+
82+
System.Windows.Forms.TextBox box1;
83+
}
84+
}

‎csharp/ql/test/resources/stubs/Dapper.cs

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// This file contains auto-generated code.
2+
// original-extractor-options: /r:Dapper.dll /r:System.Data.SqlClient.dll ...
3+
4+
namespace Dapper
5+
{
6+
// Generated from `Dapper.CommandDefinition` in `Dapper, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null`
7+
public struct CommandDefinition
8+
{
9+
public CommandDefinition(string commandText, object parameters = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null, Dapper.CommandFlags flags = CommandFlags.Buffered, System.Threading.CancellationToken cancellationToken = default) => throw null;
10+
}
11+
12+
// Generated from `Dapper.CommandFlags` in `Dapper, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null`
13+
[System.Flags]
14+
public enum CommandFlags
15+
{
16+
None = 0x0,
17+
Buffered = 0x1,
18+
Pipelined = 0x2,
19+
NoCache = 0x4
20+
}
21+
22+
// Generated from `Dapper.SqlMapper` in `Dapper, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null`
23+
static public class SqlMapper
24+
{
25+
public static System.Collections.Generic.IEnumerable<T> Query<T>(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, bool buffered = true, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
26+
public static System.Data.IDataReader ExecuteReader(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
27+
public static System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<T>> QueryAsync<T>(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
28+
public static System.Threading.Tasks.Task<dynamic> QueryFirstAsync(this System.Data.IDbConnection cnn, Dapper.CommandDefinition command) => throw null;
29+
public static System.Threading.Tasks.Task<dynamic> QueryFirstAsync(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
30+
public static System.Threading.Tasks.Task<int> ExecuteAsync(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
31+
public static object ExecuteScalar(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
32+
}
33+
}
34+

0 commit comments

Comments
 (0)