Skip to content

Commit e7bfd7d

Browse files
michaelnebelmichaelnebel
committed
C#: Take more sources and sinks into account when reporting in the telemetry queries.
1 parent 543032a commit e7bfd7d

File tree

3 files changed

+165
-5
lines changed

3 files changed

+165
-5
lines changed

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/AllSinks.qll

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
/** Provides classes representing various flow sinks for data flow / taint tracking. */
2+
3+
private import semmle.code.csharp.dataflow.internal.ExternalFlow
4+
5+
/**
6+
* Module that adds all sinks to `SinkNode`, excluding sinks for cryptography based
7+
* queries, and queries where sinks are not succifiently explicit.
8+
*/
9+
private module AllSinks {
10+
private import ParallelSink as ParallelSink
11+
private import Remote as Remote
12+
private import semmle.code.csharp.security.dataflow.CodeInjectionQuery as CodeInjectionQuery
13+
private import semmle.code.csharp.security.dataflow.ConditionalBypassQuery as ConditionalBypassQuery
14+
private import semmle.code.csharp.security.dataflow.ExposureOfPrivateInformationQuery as ExposureOfPrivateInformationQuery
15+
private import semmle.code.csharp.security.dataflow.HardcodedCredentialsQuery as HardcodedCredentialsQuery
16+
private import semmle.code.csharp.security.dataflow.LDAPInjectionQuery as LdapInjectionQuery
17+
private import semmle.code.csharp.security.dataflow.LogForgingQuery as LogForgingQuery
18+
private import semmle.code.csharp.security.dataflow.MissingXMLValidationQuery as MissingXmlValidationQuery
19+
private import semmle.code.csharp.security.dataflow.ReDoSQuery as ReDosQuery
20+
private import semmle.code.csharp.security.dataflow.RegexInjectionQuery as RegexInjectionQuery
21+
private import semmle.code.csharp.security.dataflow.ResourceInjectionQuery as ResourceInjectionQuery
22+
private import semmle.code.csharp.security.dataflow.SqlInjectionQuery as SqlInjectionQuery
23+
private import semmle.code.csharp.security.dataflow.TaintedPathQuery as TaintedPathQuery
24+
private import semmle.code.csharp.security.dataflow.UnsafeDeserializationQuery as UnsafeDeserializationQuery
25+
private import semmle.code.csharp.security.dataflow.UrlRedirectQuery as UrlRedirectQuery
26+
private import semmle.code.csharp.security.dataflow.XMLEntityInjectionQuery as XmlEntityInjectionQuery
27+
private import semmle.code.csharp.security.dataflow.XPathInjectionQuery as XpathInjectionQuery
28+
private import semmle.code.csharp.security.dataflow.XSSSinks as XssSinks
29+
private import semmle.code.csharp.security.dataflow.ZipSlipQuery as ZipSlipQuery
30+
31+
private class ParallelSink extends SinkNode instanceof ParallelSink::ParallelSink { }
32+
33+
private class RemoteSinkFlowSinks extends SinkNode instanceof Remote::RemoteFlowSink { }
34+
35+
private class CodeInjectionSink extends SinkNode instanceof CodeInjectionQuery::Sink { }
36+
37+
private class ConditionalBypassSink extends SinkNode instanceof ConditionalBypassQuery::Sink { }
38+
39+
private class ExposureOfPrivateInformationSink extends SinkNode instanceof ExposureOfPrivateInformationQuery::Sink
40+
{ }
41+
42+
private class HardcodedCredentialsSink extends SinkNode instanceof HardcodedCredentialsQuery::Sink
43+
{ }
44+
45+
private class LdapInjectionSink extends SinkNode instanceof LdapInjectionQuery::Sink { }
46+
47+
private class LogForgingSink extends SinkNode instanceof LogForgingQuery::Sink { }
48+
49+
private class MissingXmlValidationSink extends SinkNode instanceof MissingXmlValidationQuery::Sink
50+
{ }
51+
52+
private class ReDosSink extends SinkNode instanceof ReDosQuery::Sink { }
53+
54+
private class RegexInjectionSink extends SinkNode instanceof RegexInjectionQuery::Sink { }
55+
56+
private class ResourceInjectionSink extends SinkNode instanceof ResourceInjectionQuery::Sink { }
57+
58+
private class SqlInjectionSink extends SinkNode instanceof SqlInjectionQuery::Sink { }
59+
60+
private class TaintedPathSink extends SinkNode instanceof TaintedPathQuery::Sink { }
61+
62+
private class UnsafeDeserializationSink extends SinkNode instanceof UnsafeDeserializationQuery::Sink
63+
{ }
64+
65+
private class UrlRedirectSink extends SinkNode instanceof UrlRedirectQuery::Sink { }
66+
67+
private class XmlEntityInjectionSink extends SinkNode instanceof XmlEntityInjectionQuery::Sink { }
68+
69+
private class XpathInjectionSink extends SinkNode instanceof XpathInjectionQuery::Sink { }
70+
71+
private class XssSink extends SinkNode instanceof XssSinks::Sink { }
72+
73+
/**
74+
* Add all models as data sinks.
75+
*/
76+
private class SinkNodeExternal extends SinkNode {
77+
SinkNodeExternal() { sinkNode(this, _) }
78+
}
79+
}
80+
81+
/**
82+
* A data flow sink node.
83+
*/
84+
abstract class SinkNode extends DataFlow::Node { }

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/AllSources.qll

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
/** Provides classes representing various flow sources for data flow / taint tracking. */
2+
3+
private import semmle.code.csharp.dataflow.internal.ExternalFlow
4+
5+
/**
6+
* Module that adds all sources to `SourceNode`, excluding source for cryptography based
7+
* queries, and queries where sources are not succifiently explicit or mainly hardcoded constants.
8+
*/
9+
private module AllSources {
10+
private import FlowSources as FlowSources
11+
private import semmle.code.csharp.security.cryptography.HardcodedSymmetricEncryptionKey
12+
private import semmle.code.csharp.security.dataflow.CleartextStorageQuery as CleartextStorageQuery
13+
private import semmle.code.csharp.security.dataflow.CodeInjectionQuery as CodeInjectionQuery
14+
private import semmle.code.csharp.security.dataflow.ConditionalBypassQuery as ConditionalBypassQuery
15+
private import semmle.code.csharp.security.dataflow.ExposureOfPrivateInformationQuery as ExposureOfPrivateInformationQuery
16+
private import semmle.code.csharp.security.dataflow.HardcodedCredentialsQuery as HardcodedCredentialsQuery
17+
private import semmle.code.csharp.security.dataflow.LDAPInjectionQuery as LdapInjectionQuery
18+
private import semmle.code.csharp.security.dataflow.LogForgingQuery as LogForgingQuery
19+
private import semmle.code.csharp.security.dataflow.MissingXMLValidationQuery as MissingXmlValidationQuery
20+
private import semmle.code.csharp.security.dataflow.ReDoSQuery as ReDosQuery
21+
private import semmle.code.csharp.security.dataflow.RegexInjectionQuery as RegexInjectionQuery
22+
private import semmle.code.csharp.security.dataflow.ResourceInjectionQuery as ResourceInjectionQuery
23+
private import semmle.code.csharp.security.dataflow.SqlInjectionQuery as SqlInjectionQuery
24+
private import semmle.code.csharp.security.dataflow.TaintedPathQuery as TaintedPathQuery
25+
private import semmle.code.csharp.security.dataflow.UnsafeDeserializationQuery as UnsafeDeserializationQuery
26+
private import semmle.code.csharp.security.dataflow.UrlRedirectQuery as UrlRedirectQuery
27+
private import semmle.code.csharp.security.dataflow.XMLEntityInjectionQuery as XmlEntityInjectionQuery
28+
private import semmle.code.csharp.security.dataflow.XPathInjectionQuery as XpathInjectionQuery
29+
private import semmle.code.csharp.security.dataflow.ZipSlipQuery as ZipSlipQuery
30+
31+
private class FlowSourcesSources extends SourceNode instanceof FlowSources::SourceNode { }
32+
33+
private class CodeInjectionSource extends SourceNode instanceof CodeInjectionQuery::Source { }
34+
35+
private class ConditionalBypassSource extends SourceNode instanceof ConditionalBypassQuery::Source
36+
{ }
37+
38+
private class LdapInjectionSource extends SourceNode instanceof LdapInjectionQuery::Source { }
39+
40+
private class LogForgingSource extends SourceNode instanceof LogForgingQuery::Source { }
41+
42+
private class MissingXmlValidationSource extends SourceNode instanceof MissingXmlValidationQuery::Source
43+
{ }
44+
45+
private class ReDosSource extends SourceNode instanceof ReDosQuery::Source { }
46+
47+
private class RegexInjectionSource extends SourceNode instanceof RegexInjectionQuery::Source { }
48+
49+
private class ResourceInjectionSource extends SourceNode instanceof ResourceInjectionQuery::Source
50+
{ }
51+
52+
private class SqlInjectionSource extends SourceNode instanceof SqlInjectionQuery::Source { }
53+
54+
private class TaintedPathSource extends SourceNode instanceof TaintedPathQuery::Source { }
55+
56+
private class UnsafeDeserializationSource extends SourceNode instanceof UnsafeDeserializationQuery::Source
57+
{ }
58+
59+
private class UrlRedirectSource extends SourceNode instanceof UrlRedirectQuery::Source { }
60+
61+
private class XmlEntityInjectionSource extends SourceNode instanceof XmlEntityInjectionQuery::Source
62+
{ }
63+
64+
private class XpathInjectionSource extends SourceNode instanceof XpathInjectionQuery::Source { }
65+
66+
/**
67+
* Add all models as data sources.
68+
*/
69+
private class SourceNodeExternal extends SourceNode {
70+
SourceNodeExternal() { sourceNode(this, _) }
71+
}
72+
}
73+
74+
/**
75+
* A data flow source node.
76+
*/
77+
abstract class SourceNode extends DataFlow::Node { }

‎csharp/ql/src/Telemetry/ExternalApi.qll

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@ private import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlow
88
private import semmle.code.csharp.dataflow.internal.ExternalFlow
99
private import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
1010
private import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate
11-
private import semmle.code.csharp.security.dataflow.flowsources.Remote
11+
private import semmle.code.csharp.security.dataflow.flowsources.AllSources
12+
private import semmle.code.csharp.security.dataflow.flowsinks.AllSinks
1213
private import TestLibrary
1314

1415
/** Holds if the given callable is not worth supporting. */
@@ -84,13 +85,11 @@ class ExternalApi extends Callable {
8485

8586
/** Holds if this API is a known source. */
8687
pragma[nomagic]
87-
predicate isSource() {
88-
this.getAnOutput() instanceof RemoteFlowSource or sourceNode(this.getAnOutput(), _)
89-
}
88+
predicate isSource() { this.getAnOutput() instanceof SourceNode }
9089

9190
/** Holds if this API is a known sink. */
9291
pragma[nomagic]
93-
predicate isSink() { sinkNode(this.getAnInput(), _) }
92+
predicate isSink() { this.getAnInput() instanceof SinkNode }
9493

9594
/** Holds if this API is a known neutral. */
9695
pragma[nomagic]

0 commit comments

Comments
 (0)