Skip to content

Commit f2c3d83

Browse files
joefarebrotherjoefarebrother
committed
Add tests for area cases
1 parent 7bd7cc5 commit f2c3d83

File tree

13 files changed

+490
-6
lines changed

13 files changed

+490
-6
lines changed

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSFlowSteps.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ private predicate viewCallRefersToPageRelative(ViewCall vc, RazorPage rp) {
112112
["", "~"] + rp.getSourceFilepath() =
113113
min(int i, RelativeViewCallFilepath fp |
114114
fp.hasViewCallWithIndex(vc, i) and
115-
exists(RazorPage rp2 | rp2.getSourceFilepath() = fp.getNormalizedPath())
115+
exists(RazorPage rp2 | ["", "~"] + rp2.getSourceFilepath() = fp.getNormalizedPath())
116116
|
117117
fp.getNormalizedPath() order by i
118118
)

‎csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Shared/Test18.cshtml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
@namespace test
2+
@model UserData
3+
@{
4+
}
5+
6+
@if (Model != null)
7+
{
8+
<h3>Hello "@Html.Raw(Model.Name)"</h3>
9+
}

‎csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Test4/Test17.cshtml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
@namespace test
2+
@model UserData
3+
@{
4+
}
5+
6+
@if (Model != null)
7+
{
8+
<h3>Hello "@Html.Raw(Model.Name)"</h3>
9+
}

‎csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Controllers/TestController.cs

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,10 +100,39 @@ class Helper {
100100
public class Test3Controller : Controller {
101101
public void Setup(RazorViewEngineOptions o) {
102102
o.ViewLocationFormats.Add("/Views/Custom/{1}/{0}.cshtml");
103+
o.ViewLocationFormats.Add("~/Views/Custom2/{0}.cshtml");
103104
}
104105

105106
public IActionResult Test15(UserData tainted15) {
106107
// Expected to find file /Views/Custom/Test3/Test15.cshtml
107108
return View(tainted15);
108109
}
110+
111+
public IActionResult test16(UserData tainted16) {
112+
// Expected to find file /Views/Custom2/Test16.cshtml
113+
return View("Test16", tainted16);
114+
}
115+
}
116+
117+
[Area("TestArea")]
118+
public class Test4Controller : Controller {
119+
public IActionResult test17(UserData tainted17) {
120+
// Expected to find file /Areas/TestArea/Views/Test4/Test17.cshtml
121+
return View("Test17", tainted17);
122+
}
123+
124+
public IActionResult test18(UserData tainted18) {
125+
// Expected to find file /Areas/TestArea/Views/Shared/Test17.cshtml
126+
return View("Test18", tainted18);
127+
}
128+
129+
public IActionResult test19(UserData tainted19) {
130+
// Expected to find file /Views/Shared/Test19.cshtml
131+
return View("Test19", tainted19);
132+
}
133+
134+
public IActionResult test20(UserData tainted20) {
135+
// SPURIOUS: Expected to find nothing (and NOT /Views/Test4/Test20.cshtml).
136+
return View("Test20", tainted20);
137+
}
109138
}

‎csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Shared_Test18.cshtml.g.cs

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// A test file that mimics the output of compiling a `.cshtml` file
2+
// <auto-generated/>
3+
#pragma warning disable 1591
4+
[assembly: global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemAttribute(typeof(test.Views.Areas_TestArea_Views_Shared_Test18), @"mvc.1.0.view", @"/Areas/TestArea/Views/Shared/Test18.cshtml")]
5+
namespace test.Views
6+
{
7+
#line hidden
8+
using System;
9+
using System.Collections.Generic;
10+
using System.Linq;
11+
using System.Threading.Tasks;
12+
using Microsoft.AspNetCore.Mvc;
13+
using Microsoft.AspNetCore.Mvc.Rendering;
14+
using Microsoft.AspNetCore.Mvc.ViewFeatures;
15+
#nullable restore
16+
using test;
17+
18+
#line default
19+
#line hidden
20+
#nullable disable
21+
[global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemMetadataAttribute("Identifier", "/Areas/TestArea/Views/Shared/Test18.cshtml")]
22+
public class Areas_TestArea_Views_Shared_Test18 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPage<UserData>
23+
{
24+
#pragma warning disable 1998
25+
public async override global::System.Threading.Tasks.Task ExecuteAsync()
26+
{
27+
#line 6 "Areas/TestArea/Views/Shared/Test18.cshtml"
28+
if (Model != null)
29+
{
30+
31+
#line default
32+
#line hidden
33+
#nullable disable
34+
WriteLiteral(" <h3>Hello \"");
35+
#nullable restore
36+
#line 8 "Areas/TestArea/Views/Shared/Test18.cshtml"
37+
Write(Html.Raw(Model.Name));
38+
39+
#line default
40+
#line hidden
41+
#nullable disable
42+
WriteLiteral("\"</h3>\n");
43+
#nullable restore
44+
#line 9 "Areas/TestArea/Views/Shared/Test18.cshtml"
45+
}
46+
47+
#line default
48+
#line hidden
49+
#nullable disable
50+
}
51+
#pragma warning restore 1998
52+
#nullable restore
53+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
54+
public global::Microsoft.AspNetCore.Mvc.ViewFeatures.IModelExpressionProvider ModelExpressionProvider { get; private set; } = default!;
55+
#nullable disable
56+
#nullable restore
57+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
58+
public global::Microsoft.AspNetCore.Mvc.IUrlHelper Url { get; private set; } = default!;
59+
#nullable disable
60+
#nullable restore
61+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
62+
public global::Microsoft.AspNetCore.Mvc.IViewComponentHelper Component { get; private set; } = default!;
63+
#nullable disable
64+
#nullable restore
65+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
66+
public global::Microsoft.AspNetCore.Mvc.Rendering.IJsonHelper Json { get; private set; } = default!;
67+
#nullable disable
68+
#nullable restore
69+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
70+
public global::Microsoft.AspNetCore.Mvc.Rendering.IHtmlHelper<UserData> Html { get; private set; } = default!;
71+
#nullable disable
72+
}
73+
}
74+
#pragma warning restore 1591

‎csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Test4_Test17.cshtml.g.cs

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// A test file that mimics the output of compiling a `.cshtml` file
2+
// <auto-generated/>
3+
#pragma warning disable 1591
4+
[assembly: global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemAttribute(typeof(test.Views.Areas_TestArea_Views_Test4_Test17), @"mvc.1.0.view", @"/Areas/TestArea/Views/Test4/Test17.cshtml")]
5+
namespace test.Views
6+
{
7+
#line hidden
8+
using System;
9+
using System.Collections.Generic;
10+
using System.Linq;
11+
using System.Threading.Tasks;
12+
using Microsoft.AspNetCore.Mvc;
13+
using Microsoft.AspNetCore.Mvc.Rendering;
14+
using Microsoft.AspNetCore.Mvc.ViewFeatures;
15+
#nullable restore
16+
using test;
17+
18+
#line default
19+
#line hidden
20+
#nullable disable
21+
[global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemMetadataAttribute("Identifier", "/Areas/TestArea/Views/Test4/Test17.cshtml")]
22+
public class Areas_TestArea_Views_Test4_Test17 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPage<UserData>
23+
{
24+
#pragma warning disable 1998
25+
public async override global::System.Threading.Tasks.Task ExecuteAsync()
26+
{
27+
#line 6 "Areas/TestArea/Views/Test4/Test17.cshtml"
28+
if (Model != null)
29+
{
30+
31+
#line default
32+
#line hidden
33+
#nullable disable
34+
WriteLiteral(" <h3>Hello \"");
35+
#nullable restore
36+
#line 8 "Areas/TestArea/Views/Test4/Test17.cshtml"
37+
Write(Html.Raw(Model.Name));
38+
39+
#line default
40+
#line hidden
41+
#nullable disable
42+
WriteLiteral("\"</h3>\n");
43+
#nullable restore
44+
#line 9 "Areas/TestArea/Views/Test4/Test17.cshtml"
45+
}
46+
47+
#line default
48+
#line hidden
49+
#nullable disable
50+
}
51+
#pragma warning restore 1998
52+
#nullable restore
53+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
54+
public global::Microsoft.AspNetCore.Mvc.ViewFeatures.IModelExpressionProvider ModelExpressionProvider { get; private set; } = default!;
55+
#nullable disable
56+
#nullable restore
57+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
58+
public global::Microsoft.AspNetCore.Mvc.IUrlHelper Url { get; private set; } = default!;
59+
#nullable disable
60+
#nullable restore
61+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
62+
public global::Microsoft.AspNetCore.Mvc.IViewComponentHelper Component { get; private set; } = default!;
63+
#nullable disable
64+
#nullable restore
65+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
66+
public global::Microsoft.AspNetCore.Mvc.Rendering.IJsonHelper Json { get; private set; } = default!;
67+
#nullable disable
68+
#nullable restore
69+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
70+
public global::Microsoft.AspNetCore.Mvc.Rendering.IHtmlHelper<UserData> Html { get; private set; } = default!;
71+
#nullable disable
72+
}
73+
}
74+
#pragma warning restore 1591

‎csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Custom2_Test16.cshtml.g.cs

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// A test file that mimics the output of compiling a `.cshtml` file
2+
// <auto-generated/>
3+
#pragma warning disable 1591
4+
[assembly: global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemAttribute(typeof(test.Views.Views_Custom2_Test16), @"mvc.1.0.view", @"/Views/Custom2/Test16.cshtml")]
5+
namespace test.Views
6+
{
7+
#line hidden
8+
using System;
9+
using System.Collections.Generic;
10+
using System.Linq;
11+
using System.Threading.Tasks;
12+
using Microsoft.AspNetCore.Mvc;
13+
using Microsoft.AspNetCore.Mvc.Rendering;
14+
using Microsoft.AspNetCore.Mvc.ViewFeatures;
15+
#nullable restore
16+
using test;
17+
18+
#line default
19+
#line hidden
20+
#nullable disable
21+
[global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemMetadataAttribute("Identifier", "/Views/Custom2/Test16.cshtml")]
22+
public class Views_Custom2_Test16 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPage<UserData>
23+
{
24+
#pragma warning disable 1998
25+
public async override global::System.Threading.Tasks.Task ExecuteAsync()
26+
{
27+
#line 6 "Views/Custom2/Test16.cshtml"
28+
if (Model != null)
29+
{
30+
31+
#line default
32+
#line hidden
33+
#nullable disable
34+
WriteLiteral(" <h3>Hello \"");
35+
#nullable restore
36+
#line 8 "Views/Custom2/Test16.cshtml"
37+
Write(Html.Raw(Model.Name));
38+
39+
#line default
40+
#line hidden
41+
#nullable disable
42+
WriteLiteral("\"</h3>\n");
43+
#nullable restore
44+
#line 9 "Views/Custom2/Test16.cshtml"
45+
}
46+
47+
#line default
48+
#line hidden
49+
#nullable disable
50+
}
51+
#pragma warning restore 1998
52+
#nullable restore
53+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
54+
public global::Microsoft.AspNetCore.Mvc.ViewFeatures.IModelExpressionProvider ModelExpressionProvider { get; private set; } = default!;
55+
#nullable disable
56+
#nullable restore
57+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
58+
public global::Microsoft.AspNetCore.Mvc.IUrlHelper Url { get; private set; } = default!;
59+
#nullable disable
60+
#nullable restore
61+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
62+
public global::Microsoft.AspNetCore.Mvc.IViewComponentHelper Component { get; private set; } = default!;
63+
#nullable disable
64+
#nullable restore
65+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
66+
public global::Microsoft.AspNetCore.Mvc.Rendering.IJsonHelper Json { get; private set; } = default!;
67+
#nullable disable
68+
#nullable restore
69+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
70+
public global::Microsoft.AspNetCore.Mvc.Rendering.IHtmlHelper<UserData> Html { get; private set; } = default!;
71+
#nullable disable
72+
}
73+
}
74+
#pragma warning restore 1591

‎csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test19.cshtml.g.cs

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// A test file that mimics the output of compiling a `.cshtml` file
2+
// <auto-generated/>
3+
#pragma warning disable 1591
4+
[assembly: global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemAttribute(typeof(test.Views.Views_Shared_Test19), @"mvc.1.0.view", @"/Views/Shared/Test19.cshtml")]
5+
namespace test.Views
6+
{
7+
#line hidden
8+
using System;
9+
using System.Collections.Generic;
10+
using System.Linq;
11+
using System.Threading.Tasks;
12+
using Microsoft.AspNetCore.Mvc;
13+
using Microsoft.AspNetCore.Mvc.Rendering;
14+
using Microsoft.AspNetCore.Mvc.ViewFeatures;
15+
#nullable restore
16+
using test;
17+
18+
#line default
19+
#line hidden
20+
#nullable disable
21+
[global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemMetadataAttribute("Identifier", "/Views/Shared/Test19.cshtml")]
22+
public class Views_Shared_Test19 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPage<UserData>
23+
{
24+
#pragma warning disable 1998
25+
public async override global::System.Threading.Tasks.Task ExecuteAsync()
26+
{
27+
#line 6 "Views/Shared/Test19.cshtml"
28+
if (Model != null)
29+
{
30+
31+
#line default
32+
#line hidden
33+
#nullable disable
34+
WriteLiteral(" <h3>Hello \"");
35+
#nullable restore
36+
#line 8 "Views/Shared/Test19.cshtml"
37+
Write(Html.Raw(Model.Name));
38+
39+
#line default
40+
#line hidden
41+
#nullable disable
42+
WriteLiteral("\"</h3>\n");
43+
#nullable restore
44+
#line 9 "Views/Shared/Test19.cshtml"
45+
}
46+
47+
#line default
48+
#line hidden
49+
#nullable disable
50+
}
51+
#pragma warning restore 1998
52+
#nullable restore
53+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
54+
public global::Microsoft.AspNetCore.Mvc.ViewFeatures.IModelExpressionProvider ModelExpressionProvider { get; private set; } = default!;
55+
#nullable disable
56+
#nullable restore
57+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
58+
public global::Microsoft.AspNetCore.Mvc.IUrlHelper Url { get; private set; } = default!;
59+
#nullable disable
60+
#nullable restore
61+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
62+
public global::Microsoft.AspNetCore.Mvc.IViewComponentHelper Component { get; private set; } = default!;
63+
#nullable disable
64+
#nullable restore
65+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
66+
public global::Microsoft.AspNetCore.Mvc.Rendering.IJsonHelper Json { get; private set; } = default!;
67+
#nullable disable
68+
#nullable restore
69+
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
70+
public global::Microsoft.AspNetCore.Mvc.Rendering.IHtmlHelper<UserData> Html { get; private set; } = default!;
71+
#nullable disable
72+
}
73+
}
74+
#pragma warning restore 1591

0 commit comments

Comments
 (0)