C#: Restrict cs/thread-unsafe-icryptotransform-field-in-class to source fields

hvitved · hvitved · commit 972cd2b21a00 · 2024-12-02T13:45:51.000+01:00
diff --git a/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql b/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql
@@ -52,6 +52,7 @@ class ICryptoTransform extends ValueOrRefType {
 }
 
 from UnsafeField field
+where field.fromSource()
 select field,
   "Static field '" + field.getName() +
     "' contains a 'System.Security.Cryptography.ICryptoTransform' that could be used in an unsafe way."

Original file line number	Diff line number	Diff line change
`@@ -52,6 +52,7 @@ class ICryptoTransform extends ValueOrRefType {`
`52`	`52`	`}`
`53`	`53`
`54`	`54`	`from UnsafeField field`
	`55`	`+where field.fromSource()`
`55`	`56`	`select field,`
`56`	`57`	`"Static field '" + field.getName() +`
`57`	`58`	`"' contains a 'System.Security.Cryptography.ICryptoTransform' that could be used in an unsafe way."`