Skip to content

Commit 0815989

Browse files
michaelnebelmichaelnebel
committed
C#: Convert cs/log-forging tests to inline expectations.
1 parent 60e3b43 commit 0815989

File tree

4 files changed

+27
-12
lines changed

4 files changed

+27
-12
lines changed

‎csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.cs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ public class LogForgingHandler : IHttpHandler
1515

1616
public void ProcessRequest(HttpContext ctx)
1717
{
18-
String username = ctx.Request.QueryString["username"];
18+
String username = ctx.Request.QueryString["username"]; // $ Source
1919
ILogger logger = new ILogger();
2020
// BAD: Logged as-is
21-
logger.Warn(username + " logged in");
21+
logger.Warn(username + " logged in"); // $ Alert
2222
// GOOD: New-lines removed
2323
logger.Warn(username.Replace(Environment.NewLine, "") + " logged in");
2424
// GOOD: New-lines removed
@@ -28,11 +28,11 @@ public void ProcessRequest(HttpContext ctx)
2828
// GOOD: Html encoded
2929
logger.Warn(WebUtility.HtmlEncode(username) + " logged in");
3030
// BAD: Logged as-is to TraceSource
31-
new TraceSource("Test").TraceInformation(username + " logged in");
31+
new TraceSource("Test").TraceInformation(username + " logged in"); // $ Alert
3232

3333
Microsoft.Extensions.Logging.ILogger logger2 = null;
3434
// BAD: Logged as-is
35-
logger2.LogError(username);
35+
logger2.LogError(username); // $ Alert
3636
}
3737

3838
public bool IsReusable

‎csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,19 @@
22
| LogForging.cs:21:21:21:43 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:21:21:21:43 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
33
| LogForging.cs:31:50:31:72 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:31:50:31:72 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
44
| LogForging.cs:35:26:35:33 | access to local variable username | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:35:26:35:33 | access to local variable username | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
5-
| LogForgingAsp.cs:12:21:12:43 | ... + ... | LogForgingAsp.cs:8:32:8:39 | username : String | LogForgingAsp.cs:12:21:12:43 | ... + ... | This log entry depends on a $@. | LogForgingAsp.cs:8:32:8:39 | username | user-provided value |
5+
| LogForgingAsp.cs:17:21:17:43 | ... + ... | LogForgingAsp.cs:13:32:13:39 | username : String | LogForgingAsp.cs:17:21:17:43 | ... + ... | This log entry depends on a $@. | LogForgingAsp.cs:13:32:13:39 | username | user-provided value |
6+
| LogForgingAsp.cs:86:21:86:50 | $"..." | LogForgingAsp.cs:82:37:82:37 | e : TestEnum | LogForgingAsp.cs:86:21:86:50 | $"..." | This log entry depends on a $@. | LogForgingAsp.cs:82:37:82:37 | e | user-provided value |
7+
| LogForgingAsp.cs:93:21:93:61 | $"..." | LogForgingAsp.cs:89:47:89:48 | dt : DateTimeOffset | LogForgingAsp.cs:93:21:93:61 | $"..." | This log entry depends on a $@. | LogForgingAsp.cs:89:47:89:48 | dt | user-provided value |
68
edges
79
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:21:21:21:43 | ... + ... | provenance | |
810
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:31:50:31:72 | ... + ... | provenance | |
911
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:35:26:35:33 | access to local variable username | provenance | |
1012
| LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:18:16:18:23 | access to local variable username : String | provenance | |
1113
| LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:18:27:18:61 | access to indexer : String | provenance | MaD:1 |
1214
| LogForging.cs:18:27:18:61 | access to indexer : String | LogForging.cs:18:16:18:23 | access to local variable username : String | provenance | |
13-
| LogForgingAsp.cs:8:32:8:39 | username : String | LogForgingAsp.cs:12:21:12:43 | ... + ... | provenance | |
15+
| LogForgingAsp.cs:13:32:13:39 | username : String | LogForgingAsp.cs:17:21:17:43 | ... + ... | provenance | |
16+
| LogForgingAsp.cs:82:37:82:37 | e : TestEnum | LogForgingAsp.cs:86:21:86:50 | $"..." | provenance | |
17+
| LogForgingAsp.cs:89:47:89:48 | dt : DateTimeOffset | LogForgingAsp.cs:93:21:93:61 | $"..." | provenance | |
1418
models
1519
| 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
1620
nodes
@@ -20,6 +24,15 @@ nodes
2024
| LogForging.cs:21:21:21:43 | ... + ... | semmle.label | ... + ... |
2125
| LogForging.cs:31:50:31:72 | ... + ... | semmle.label | ... + ... |
2226
| LogForging.cs:35:26:35:33 | access to local variable username | semmle.label | access to local variable username |
23-
| LogForgingAsp.cs:8:32:8:39 | username : String | semmle.label | username : String |
24-
| LogForgingAsp.cs:12:21:12:43 | ... + ... | semmle.label | ... + ... |
27+
| LogForgingAsp.cs:13:32:13:39 | username : String | semmle.label | username : String |
28+
| LogForgingAsp.cs:17:21:17:43 | ... + ... | semmle.label | ... + ... |
29+
| LogForgingAsp.cs:82:37:82:37 | e : TestEnum | semmle.label | e : TestEnum |
30+
| LogForgingAsp.cs:86:21:86:50 | $"..." | semmle.label | $"..." |
31+
| LogForgingAsp.cs:89:47:89:48 | dt : DateTimeOffset | semmle.label | dt : DateTimeOffset |
32+
| LogForgingAsp.cs:93:21:93:61 | $"..." | semmle.label | $"..." |
2533
subpaths
34+
testFailures
35+
| LogForgingAsp.cs:82:37:82:37 | e : TestEnum | Unexpected result: Source |
36+
| LogForgingAsp.cs:86:21:86:50 | $"..." | Unexpected result: Alert |
37+
| LogForgingAsp.cs:89:47:89:48 | dt : DateTimeOffset | Unexpected result: Source |
38+
| LogForgingAsp.cs:93:21:93:61 | $"..." | Unexpected result: Alert |

‎csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.qlref

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: Security Features/CWE-117/LogForging.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎csharp/ql/test/query-tests/Security Features/CWE-117/LogForgingAsp.cs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ public enum TestEnum
1010

1111
public class AspController : ControllerBase
1212
{
13-
public void Action1(string username)
13+
public void Action1(string username) // $ Source
1414
{
1515
var logger = new ILogger();
1616
// BAD: Logged as-is
17-
logger.Warn(username + " logged in");
17+
logger.Warn(username + " logged in"); // $ Alert
1818
}
1919

2020
public void Action1(DateTime date)
@@ -89,7 +89,7 @@ public void ActionEnum(TestEnum e)
8989
public void ActionDateTime(DateTimeOffset dt)
9090
{
9191
var logger = new ILogger();
92-
// GOOD: DateTimeOffset is a sanitizer. [FALSEPOSITIVE]
92+
// GOOD: DateTimeOffset is a sanitizer. [FALSE POSITIVE]
9393
logger.Warn($"Warning about the DateTimeOffset: {dt}");
9494
}
9595
}

0 commit comments

Comments
 (0)