Skip to content

Commit a97510a

Browse files
michaelnebelmichaelnebel
authored
Merge pull request github#15419 from github/egregius313/csharp/dataflow/threat-modeling/refactor-to-threatmodelflowsource
C#: Refactor C# queries to use `ThreatModelFlowSource` instead of `RemoteFlowSource`
2 parents 15d1105 + f488f23 commit a97510a

33 files changed

+210
-94
lines changed

‎csharp/ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ module EntityFramework {
4949
StoredFlowSource() {
5050
this.asExpr() = any(PropertyRead read | read.getTarget() instanceof MappedProperty)
5151
}
52+
53+
override string getSourceType() { result = "ORM mapped property" }
5254
}
5355

5456
private class EFClass extends Class {

‎csharp/ql/lib/semmle/code/csharp/frameworks/NHibernate.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,8 @@ module NHibernate {
9191
StoredFlowSource() {
9292
this.asExpr() = any(PropertyRead read | read.getTarget() instanceof MappedProperty)
9393
}
94+
95+
override string getSourceType() { result = "ORM mapped property" }
9496
}
9597

9698
/**

‎csharp/ql/lib/semmle/code/csharp/security/auth/InsecureDirectObjectReferenceQuery.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
/** Definitions for the Insecure Direct Object Reference query */
22

33
import csharp
4-
import semmle.code.csharp.dataflow.flowsources.Remote
4+
import semmle.code.csharp.security.dataflow.flowsources.FlowSources
5+
deprecated import semmle.code.csharp.dataflow.flowsources.Remote
56
import ActionMethods
67

78
/**
@@ -17,7 +18,7 @@ private predicate needsChecks(ActionMethod m) { m.isEdit() and not m.isAdmin() }
1718
* that may indicate that it's used as the ID for some resource
1819
*/
1920
private predicate hasIdParameter(ActionMethod m) {
20-
exists(RemoteFlowSource src | src.getEnclosingCallable() = m |
21+
exists(ThreatModelFlowSource src | src.getEnclosingCallable() = m |
2122
src.asParameter().getName().toLowerCase().matches(["%id", "%idx"])
2223
or
2324
// handle cases like `Request.QueryString["Id"]`

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@
33
*/
44

55
import csharp
6-
private import semmle.code.csharp.security.dataflow.flowsources.Remote
7-
private import semmle.code.csharp.security.dataflow.flowsources.Local
6+
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
87
private import semmle.code.csharp.frameworks.system.codedom.Compiler
98
private import semmle.code.csharp.security.Sanitizers
109
private import semmle.code.csharp.dataflow.internal.ExternalFlow
@@ -55,11 +54,24 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
5554
*/
5655
module CodeInjection = TaintTracking::Global<CodeInjectionConfig>;
5756

58-
/** A source of remote user input. */
59-
class RemoteSource extends Source instanceof RemoteFlowSource { }
57+
/**
58+
* DEPRECATED: Use `ThreatModelSource` instead.
59+
*
60+
* A source of remote user input.
61+
*/
62+
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
63+
64+
/**
65+
* DEPRECATED: Use `ThreatModelSource` instead.
66+
*
67+
* A source of local user input.
68+
*/
69+
deprecated class LocalSource extends DataFlow::Node instanceof LocalFlowSource { }
70+
71+
private class AddLocalSource extends Source instanceof LocalFlowSource { }
6072

61-
/** A source of local user input. */
62-
class LocalSource extends Source instanceof LocalFlowSource { }
73+
/** A source supported by the current threat model. */
74+
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
6375

6476
private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }
6577

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*/
44

55
import csharp
6-
private import semmle.code.csharp.security.dataflow.flowsources.Remote
6+
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
77
private import semmle.code.csharp.frameworks.system.Diagnostics
88
private import semmle.code.csharp.security.Sanitizers
99
private import semmle.code.csharp.dataflow.internal.ExternalFlow
@@ -64,8 +64,15 @@ module CommandInjectionConfig implements DataFlow::ConfigSig {
6464
*/
6565
module CommandInjection = TaintTracking::Global<CommandInjectionConfig>;
6666

67-
/** A source of remote user input. */
68-
class RemoteSource extends Source instanceof RemoteFlowSource { }
67+
/**
68+
* DEPRECATED: Use `ThreatModelSource` instead.
69+
*
70+
* A source of remote user input.
71+
*/
72+
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
73+
74+
/** A source supported by the current threat model. */
75+
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
6976

7077
/** Command Injection sinks defined through Models as Data. */
7178
private class ExternalCommandInjectionExprSink extends Sink {

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
import csharp
77
private import semmle.code.csharp.controlflow.Guards
88
private import semmle.code.csharp.controlflow.BasicBlocks
9-
private import semmle.code.csharp.security.dataflow.flowsources.Remote
9+
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
1010
private import semmle.code.csharp.frameworks.System
1111
private import semmle.code.csharp.frameworks.system.Net
1212
private import semmle.code.csharp.security.SensitiveActions
@@ -60,8 +60,15 @@ private module ConditionalBypassConfig implements DataFlow::ConfigSig {
6060
*/
6161
module ConditionalBypass = TaintTracking::Global<ConditionalBypassConfig>;
6262

63-
/** A source of remote user input. */
64-
class RemoteSource extends Source instanceof RemoteFlowSource { }
63+
/**
64+
* DEPRECATED: Use `ThreatModelSource` instead.
65+
*
66+
* A source of remote user input.
67+
*/
68+
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
69+
70+
/** A source supported by the current threat model. */
71+
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
6572

6673
/** The result of a reverse dns may be user-controlled. */
6774
class ReverseDnsSource extends Source {

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*/
44

55
import csharp
6-
private import semmle.code.csharp.security.dataflow.flowsources.Remote
6+
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
77
private import semmle.code.csharp.security.dataflow.flowsinks.ExternalLocationSink
88
private import semmle.code.csharp.security.PrivateData
99

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
import csharp
77
private import semmle.code.csharp.commons.QualifiedName
8-
private import semmle.code.csharp.dataflow.flowsources.Remote
8+
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
99
private import semmle.code.csharp.frameworks.System
1010
private import semmle.code.csharp.dataflow.FlowSummary
1111

@@ -92,19 +92,19 @@ class ExternalApiDataNode extends DataFlow::Node {
9292
deprecated class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
9393
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfig" }
9494

95-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
95+
override predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
9696

9797
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
9898
}
9999

100-
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
100+
/** A configuration for tracking flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s. */
101101
private module RemoteSourceToExternalApiConfig implements DataFlow::ConfigSig {
102-
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
102+
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
103103

104104
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
105105
}
106106

107-
/** A module for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
107+
/** A module for tracking flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s. */
108108
module RemoteSourceToExternalApi = TaintTracking::Global<RemoteSourceToExternalApiConfig>;
109109

110110
/** A node representing untrusted data being passed to an external API. */

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
*/
55

66
import csharp
7-
private import semmle.code.csharp.security.dataflow.flowsources.Remote
7+
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
88
private import semmle.code.csharp.frameworks.system.DirectoryServices
99
private import semmle.code.csharp.frameworks.system.directoryservices.Protocols
1010
private import semmle.code.csharp.security.Sanitizers
@@ -66,8 +66,15 @@ module LdapInjectionConfig implements DataFlow::ConfigSig {
6666
*/
6767
module LdapInjection = TaintTracking::Global<LdapInjectionConfig>;
6868

69-
/** A source of remote user input. */
70-
class RemoteSource extends Source instanceof RemoteFlowSource { }
69+
/**
70+
* DEPRECATED: Use `ThreadModelSource` instead.
71+
*
72+
* A source of remote user input.
73+
*/
74+
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
75+
76+
/** A source supported by the current threat model. */
77+
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
7178

7279
/** LDAP sinks defined through Models as Data. */
7380
private class ExternalLdapExprSink extends Sink {

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*/
44

55
import csharp
6-
private import semmle.code.csharp.security.dataflow.flowsources.Remote
6+
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
77
private import semmle.code.csharp.frameworks.System
88
private import semmle.code.csharp.frameworks.system.text.RegularExpressions
99
private import semmle.code.csharp.security.Sanitizers
@@ -57,7 +57,7 @@ private module LogForgingConfig implements DataFlow::ConfigSig {
5757
module LogForging = TaintTracking::Global<LogForgingConfig>;
5858

5959
/** A source of remote user input. */
60-
private class RemoteSource extends Source instanceof RemoteFlowSource { }
60+
private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
6161

6262
private class HtmlSanitizer extends Sanitizer {
6363
HtmlSanitizer() { this.asExpr() instanceof HtmlSanitizedExpr }

0 commit comments

Comments
 (0)