Merge pull request github#9043 from michaelnebel/csharp/xml-injection-path

C#: Convert xml injection query to a path problem.

Author: michaelnebel

csharp/ql/src/Security Features/CWE-091/XMLInjection.ql

@@ -2,7 +2,7 @@
  * @name XML injection
  * @description Building an XML document from user-controlled sources is vulnerable to insertion of
  *              malicious code by the user.
- * @kind problem
+ * @kind path-problem
  * @id cs/xml-injection
  * @problem.severity error
  * @security-severity 8.8
@@ -12,6 +12,7 @@
  */
 
 import csharp
+import DataFlow::PathGraph
 import semmle.code.csharp.security.dataflow.flowsources.Remote
 import semmle.code.csharp.frameworks.system.Xml
 
@@ -45,6 +46,6 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
   }
 }
 
-from TaintTrackingConfiguration c, DataFlow::Node source, DataFlow::Node sink
-where c.hasFlow(source, sink)
-select sink, "$@ flows to here and is inserted as XML.", source, "User-provided value"
+from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
+where c.hasFlowPath(source, sink)
+select sink, source, sink, "$@ flows to here and is inserted as XML.", source, "User-provided value"

csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/XMLInjection.expected

@@ -1 +1,8 @@
-| Test.cs:15:25:15:80 | ... + ... | $@ flows to here and is inserted as XML. | Test.cs:8:27:8:49 | access to property QueryString | User-provided value |
+edges
+| Test.cs:8:27:8:49 | access to property QueryString : NameValueCollection | Test.cs:15:25:15:80 | ... + ... |
+nodes
+| Test.cs:8:27:8:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| Test.cs:15:25:15:80 | ... + ... | semmle.label | ... + ... |
+subpaths
+#select
+| Test.cs:15:25:15:80 | ... + ... | Test.cs:8:27:8:49 | access to property QueryString : NameValueCollection | Test.cs:15:25:15:80 | ... + ... | $@ flows to here and is inserted as XML. | Test.cs:8:27:8:49 | access to property QueryString : NameValueCollection | User-provided value |