Skip to content

Commit 0b8e83d

Browse files
michaelnebelmichaelnebel
committed
C#: Add log forging false positive example using ReplaceLineEndings.
1 parent ce53964 commit 0b8e83d

File tree

2 files changed

+16
-6
lines changed

2 files changed

+16
-6
lines changed

‎csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ public void ProcessRequest(HttpContext ctx)
2323
logger.Warn(username.Replace(Environment.NewLine, "") + " logged in");
2424
// GOOD: New-lines removed
2525
logger.Warn(username.Replace(Environment.NewLine, "", StringComparison.InvariantCultureIgnoreCase) + " logged in");
26+
// GOOD: New-lines replaced (False positive)
27+
logger.Warn(username.ReplaceLineEndings("") + " logged in");
2628
// GOOD: Html encoded
2729
logger.Warn(WebUtility.HtmlEncode(username) + " logged in");
2830
// BAD: Logged as-is to TraceSource

‎csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,33 @@
11
#select
22
| LogForging.cs:21:21:21:43 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:21:21:21:43 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
3-
| LogForging.cs:29:50:29:72 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:29:50:29:72 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
4-
| LogForging.cs:33:26:33:33 | access to local variable username | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:33:26:33:33 | access to local variable username | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
3+
| LogForging.cs:27:21:27:66 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:27:21:27:66 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
4+
| LogForging.cs:31:50:31:72 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:31:50:31:72 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
5+
| LogForging.cs:35:26:35:33 | access to local variable username | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:35:26:35:33 | access to local variable username | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
56
| LogForgingAsp.cs:12:21:12:43 | ... + ... | LogForgingAsp.cs:8:32:8:39 | username : String | LogForgingAsp.cs:12:21:12:43 | ... + ... | This log entry depends on a $@. | LogForgingAsp.cs:8:32:8:39 | username | user-provided value |
67
edges
78
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:21:21:21:43 | ... + ... | provenance | |
8-
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:29:50:29:72 | ... + ... | provenance | |
9-
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:33:26:33:33 | access to local variable username | provenance | |
9+
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:27:21:27:28 | access to local variable username : String | provenance | |
10+
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:31:50:31:72 | ... + ... | provenance | |
11+
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:35:26:35:33 | access to local variable username | provenance | |
1012
| LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:18:16:18:23 | access to local variable username : String | provenance | |
1113
| LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:18:27:18:61 | access to indexer : String | provenance | MaD:1 |
1214
| LogForging.cs:18:27:18:61 | access to indexer : String | LogForging.cs:18:16:18:23 | access to local variable username : String | provenance | |
15+
| LogForging.cs:27:21:27:28 | access to local variable username : String | LogForging.cs:27:21:27:51 | call to method ReplaceLineEndings : String | provenance | MaD:2 |
16+
| LogForging.cs:27:21:27:51 | call to method ReplaceLineEndings : String | LogForging.cs:27:21:27:66 | ... + ... | provenance | |
1317
| LogForgingAsp.cs:8:32:8:39 | username : String | LogForgingAsp.cs:12:21:12:43 | ... + ... | provenance | |
1418
models
1519
| 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
20+
| 2 | Summary: System; String; false; ReplaceLineEndings; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
1621
nodes
1722
| LogForging.cs:18:16:18:23 | access to local variable username : String | semmle.label | access to local variable username : String |
1823
| LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
1924
| LogForging.cs:18:27:18:61 | access to indexer : String | semmle.label | access to indexer : String |
2025
| LogForging.cs:21:21:21:43 | ... + ... | semmle.label | ... + ... |
21-
| LogForging.cs:29:50:29:72 | ... + ... | semmle.label | ... + ... |
22-
| LogForging.cs:33:26:33:33 | access to local variable username | semmle.label | access to local variable username |
26+
| LogForging.cs:27:21:27:28 | access to local variable username : String | semmle.label | access to local variable username : String |
27+
| LogForging.cs:27:21:27:51 | call to method ReplaceLineEndings : String | semmle.label | call to method ReplaceLineEndings : String |
28+
| LogForging.cs:27:21:27:66 | ... + ... | semmle.label | ... + ... |
29+
| LogForging.cs:31:50:31:72 | ... + ... | semmle.label | ... + ... |
30+
| LogForging.cs:35:26:35:33 | access to local variable username | semmle.label | access to local variable username |
2331
| LogForgingAsp.cs:8:32:8:39 | username : String | semmle.label | username : String |
2432
| LogForgingAsp.cs:12:21:12:43 | ... + ... | semmle.label | ... + ... |
2533
subpaths

0 commit comments

Comments
 (0)