Merge pull request github#18178 from hvitved/csharp/unsafe-crypto-transform-from-source

hvitved · web-flow · commit 6b7522fe770a · 2024-12-03T09:30:28.000+01:00
C#: Restrict `cs/thread-unsafe-icryptotransform-field-in-class` to source fields
diff --git a/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql b/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql
@@ -52,6 +52,7 @@ class ICryptoTransform extends ValueOrRefType {
 }
 
 from UnsafeField field
+where field.fromSource()
 select field,
   "Static field '" + field.getName() +
     "' contains a 'System.Security.Cryptography.ICryptoTransform' that could be used in an unsafe way."

Original file line number	Diff line number	Diff line change
`@@ -52,6 +52,7 @@ class ICryptoTransform extends ValueOrRefType {`
`52`	`52`	`}`
`53`	`53`
`54`	`54`	`from UnsafeField field`
	`55`	`+where field.fromSource()`
`55`	`56`	`select field,`
`56`	`57`	`"Static field '" + field.getName() +`
`57`	`58`	`"' contains a 'System.Security.Cryptography.ICryptoTransform' that could be used in an unsafe way."`