Skip to content

Commit 72db91b

Browse files
hvitvedhvitved
committed
temp
1 parent 56d1cc4 commit 72db91b

4 files changed

Lines changed: 39 additions & 471 deletions

File tree

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 39 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -873,6 +873,10 @@ private predicate nodeCand2(
873873
read = false
874874
or
875875
nodeCandFwd2(node, _, _, unbindBool(read), unbind(config)) and
876+
// not exists(LTDF::LibraryTypeDataFlow ltdf, LTDF::CallableFlowSource source, Call call |
877+
// ltdf.clearsContent(source, _, call.getTarget().getSourceDeclaration()) and
878+
// node.asExpr() = source.getSource(call)
879+
// ) and
876880
(
877881
exists(Node mid |
878882
localFlowStepNodeCand1(node, mid, config) and
@@ -1198,17 +1202,26 @@ private predicate flowCandFwd(
11981202
) {
11991203
flowCandFwd0(node, fromArg, argApf, apf, config) and
12001204
not apf.isClearedAt(node) and
1205+
// not exists(LTDF::LibraryTypeDataFlow ltdf, LTDF::CallableFlowSource source, Call call |
1206+
// ltdf.clearsContent(source, _, call.getTarget().getSourceDeclaration()) and
1207+
// node.asExpr() = source.getSource(call)
1208+
// ) and
12011209
if node instanceof CastingNode
12021210
then compatibleTypes(getErasedNodeTypeBound(node), apf.getType())
12031211
else any()
12041212
}
12051213

12061214
import csharp
1207-
private predicate sdfflowCandFwd(
1208-
Node node, AccessPathFront apf, Method clear
1209-
) {
1215+
import semmle.code.csharp.dataflow.LibraryTypeDataFlow as LTDF
1216+
1217+
private predicate sdfflowCandFwd(Node node, AccessPathFront apf, Content c) {
12101218
flowCandFwd(node, _, _, apf, _) and
1211-
node.asExpr() = any(MethodCall mc | mc.getTarget() = clear and clear.hasName("Clear")).getQualifier()
1219+
//node.asExpr() = any(MethodCall mc | mc.getTarget() = clear and clear.hasName("Clear")).getQualifier() and
1220+
//clearsContent(node, c)
1221+
exists(LTDF::LibraryTypeDataFlow ltdf, LTDF::CallableFlowSource source, Call call |
1222+
ltdf.clearsContent(source, c, call.getTarget().getSourceDeclaration()) and
1223+
node.asExpr() = source.getSource(call)
1224+
)
12121225
}
12131226

12141227
pragma[nomagic]
@@ -2996,73 +3009,62 @@ module ZipSlip {
29963009
import csharp
29973010

29983011
/**
2999-
* A `DataFlow::Configuration` for tracking `Strings passed to SqlConnectionStringBuilder` instances.
3000-
*/
3001-
class TaintTrackingConfiguration extends TaintTracking::Configuration {
3002-
TaintTrackingConfiguration() { this = "TaintTrackingConfiguration" }
3003-
3004-
override predicate isSource(DataFlow::Node source) {
3005-
exists(string s | s = source.asExpr().(StringLiteral).getValue().toLowerCase() |
3006-
s.matches("%encrypt=false%")
3007-
or
3008-
not s.matches("%encrypt=%")
3009-
)
3010-
}
3012+
* A `DataFlow::Configuration` for tracking `Strings passed to SqlConnectionStringBuilder` instances.
3013+
*/
3014+
class TaintTrackingConfiguration extends TaintTracking::Configuration {
3015+
TaintTrackingConfiguration() { this = "TaintTrackingConfiguration" }
30113016

3012-
override predicate isSink(DataFlow::Node sink) {
3013-
exists(ObjectCreation oc |
3014-
oc.getRuntimeArgument(0) = sink.asExpr() and
3015-
(
3016-
oc.getType().getName() = "SqlConnectionStringBuilder"
3017+
override predicate isSource(DataFlow::Node source) {
3018+
exists(string s | s = source.asExpr().(StringLiteral).getValue().toLowerCase() |
3019+
s.matches("%encrypt=false%")
30173020
or
3018-
oc.getType().getName() = "SqlConnection"
3021+
not s.matches("%encrypt=%")
30193022
)
3020-
)
3021-
}
3023+
}
30223024

3023-
override predicate isSanitizer(Node node) {
3024-
node.asExpr() = any(MethodCall mc | mc.getTarget() = any(Method clear | clear.hasName("Clear") and clear.getLocation().getFile().getStem() = ["DataTable", "RootCodeDomSerializer","HttpResponseStream","CssStyleCollection","IList"])).getQualifier()
3025+
override predicate isSink(DataFlow::Node sink) {
3026+
exists(ObjectCreation oc |
3027+
oc.getRuntimeArgument(0) = sink.asExpr() and
3028+
(
3029+
oc.getType().getName() = "SqlConnectionStringBuilder"
3030+
or
3031+
oc.getType().getName() = "SqlConnection"
3032+
)
3033+
)
3034+
}
3035+
// override predicate isSanitizer(Node node) {
3036+
// node.asExpr() = any(MethodCall mc | mc.getTarget() = any(Method clear | clear.hasName("Clear") /*and clear.getLocation().getFile().getStem() = ["DataTable", "RootCodeDomSerializer","HttpResponseStream","CssStyleCollection","IList"]*/)).getQualifier()
3037+
// }
30253038
}
3026-
}
30273039

30283040
// import semmle.code.csharp.controlflow.Guards
30293041
// import semmle.code.csharp.security.Sanitizers
3030-
30313042
// /**
30323043
// * A data flow source for unsafe zip extraction.
30333044
// */
30343045
// abstract class Source extends DataFlow::Node { }
3035-
30363046
// /**
30373047
// * A data flow sink for unsafe zip extraction.
30383048
// */
30393049
// abstract class Sink extends DataFlow::ExprNode { }
3040-
30413050
// /**
30423051
// * A sanitizer for unsafe zip extraction.
30433052
// */
30443053
// abstract class Sanitizer extends DataFlow::ExprNode { }
3045-
30463054
// /**
30473055
// * A guard for unsafe zip extraction.
30483056
// */
30493057
// abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
3050-
30513058
// /** A taint tracking configuration for Zip Slip */
30523059
// class TaintTrackingConfiguration extends TaintTracking::Configuration {
30533060
// TaintTrackingConfiguration() { this = "ZipSlipTaintTracking" }
3054-
30553061
// override predicate isSource(DataFlow::Node source) { source instanceof Source }
3056-
30573062
// override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3058-
30593063
// override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
3060-
30613064
// override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
30623065
// guard instanceof SanitizerGuard
30633066
// }
30643067
// }
3065-
30663068
// /** An access to the `FullName` property of a `ZipArchiveEntry`. */
30673069
// class ArchiveFullNameSource extends Source {
30683070
// ArchiveFullNameSource() {
@@ -3072,7 +3074,6 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
30723074
// )
30733075
// }
30743076
// }
3075-
30763077
// /** An argument to the `ExtractToFile` extension method. */
30773078
// class ExtractToFileArgSink extends Sink {
30783079
// ExtractToFileArgSink() {
@@ -3082,7 +3083,6 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
30823083
// )
30833084
// }
30843085
// }
3085-
30863086
// /** A path argument to a `File.Open`, `File.OpenWrite`, or `File.Create` method call. */
30873087
// class FileOpenArgSink extends Sink {
30883088
// FileOpenArgSink() {
@@ -3095,7 +3095,6 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
30953095
// )
30963096
// }
30973097
// }
3098-
30993098
// /** A path argument to a call to the `FileStream` constructor. */
31003099
// class FileStreamArgSink extends Sink {
31013100
// FileStreamArgSink() {
@@ -3106,7 +3105,6 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
31063105
// )
31073106
// }
31083107
// }
3109-
31103108
// /**
31113109
// * A path argument to a call to the `FileStream` constructor.
31123110
// *
@@ -3121,7 +3119,6 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
31213119
// )
31223120
// }
31233121
// }
3124-
31253122
// /**
31263123
// * A call to `GetFileName`.
31273124
// *
@@ -3134,7 +3131,6 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
31343131
// )
31353132
// }
31363133
// }
3137-
31383134
// /**
31393135
// * A call to `Substring`.
31403136
// *
@@ -3148,14 +3144,12 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
31483144
// )
31493145
// }
31503146
// }
3151-
31523147
// /**
31533148
// * A call to `String.StartsWith()` that indicates that the tainted path value is being
31543149
// * validated to ensure that it occurs within a permitted output path.
31553150
// */
31563151
// class StringCheckGuard extends SanitizerGuard, MethodCall {
31573152
// private Expr q;
3158-
31593153
// StringCheckGuard() {
31603154
// this.getTarget().hasQualifiedName("System.String", "StartsWith") and
31613155
// this.getQualifier() = q and
@@ -3166,15 +3160,12 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
31663160
// DataFlow::localExprFlow(combineCall, q)
31673161
// )
31683162
// }
3169-
31703163
// override predicate checks(Expr e, AbstractValue v) {
31713164
// e = q and
31723165
// v.(AbstractValues::BooleanValue).getValue() = true
31733166
// }
31743167
// }
3175-
31763168
// private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }
3177-
31783169
predicate qqfinal(int pns) { pns = count(PathNode pn) }
31793170

31803171
predicate qqstats(

0 commit comments

Comments
 (0)