Skip to content

Commit aa27eaf

Browse files
Addrssing the comments from github#3951 (comment) that I missed previously
1 parent c52064a commit aa27eaf

File tree

2 files changed

+9
-9
lines changed

2 files changed

+9
-9
lines changed

csharp/ql/src/experimental/Security Features/Serialization/DataSetSerialization.qll

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -42,17 +42,17 @@ class SerializableClass extends Class {
4242
SerializableClass() {
4343
(
4444
this.getABaseType*().getQualifiedName() = "System.Xml.Serialization.XmlSerializer" or
45-
this.getABaseInterface*().getQualifiedName() = "System.Runtime.Serialization.ISerializable" or
45+
this.getABaseType*().getQualifiedName() = "System.Runtime.Serialization.ISerializable" or
4646
this.getABaseType*().getQualifiedName() = "System.Runtime.Serialization.XmlObjectSerializer" or
47-
this.getABaseInterface*().getQualifiedName() =
47+
this.getABaseType*().getQualifiedName() =
4848
"System.Runtime.Serialization.ISerializationSurrogateProvider" or
4949
this.getABaseType*().getQualifiedName() =
5050
"System.Runtime.Serialization.XmlSerializableServices" or
51-
this.getABaseInterface*().getQualifiedName() = "System.Xml.Serialization.IXmlSerializable"
51+
this.getABaseType*().getQualifiedName() = "System.Xml.Serialization.IXmlSerializable"
5252
)
5353
or
5454
exists(Attribute a | a = this.getAnAttribute() |
55-
a.getType().getQualifiedName().toString() = "System.SerializableAttribute"
55+
a.getType().getQualifiedName() = "System.SerializableAttribute"
5656
)
5757
}
5858
}
@@ -77,13 +77,13 @@ class UnsafeXmlSerializerImplementation extends SerializableClass {
7777
*/
7878
class UnsafeXmlReadMethod extends Method {
7979
UnsafeXmlReadMethod() {
80-
this.getQualifiedName().toString() = "System.Data.DataTable.ReadXml"
80+
this.getQualifiedName() = "System.Data.DataTable.ReadXml"
8181
or
82-
this.getQualifiedName().toString() = "System.Data.DataTable.ReadXmlSchema"
82+
this.getQualifiedName() = "System.Data.DataTable.ReadXmlSchema"
8383
or
84-
this.getQualifiedName().toString() = "System.Data.DataSet.ReadXml"
84+
this.getQualifiedName() = "System.Data.DataSet.ReadXml"
8585
or
86-
this.getQualifiedName().toString() = "System.Data.DataSet.ReadXmlSchema"
86+
this.getQualifiedName() = "System.Data.DataSet.ReadXmlSchema"
8787
or
8888
this.getName().matches("ReadXml%") and
8989
exists(Class c | c.getAMethod() = this |

csharp/ql/src/experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* @name Defining a potentially unsafe XML serializer
3-
* @description Defining an XML serializable class that includes members that derive from dataSet or DataTable type may lead to a security problem. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details.
3+
* @description Defining an XML serializable class that includes members that derive from DataSet or DataTable type may lead to a security problem. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details.
44
* @kind problem
55
* @problem.severity error
66
* @precision medium

0 commit comments

Comments
 (0)