Skip to content

Commit 9a975f3

Browse files
asgerfasgerf
committed
C#: mass enable diff-informed data flow
1 parent 772b972 commit 9a975f3

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+243
-0
lines changed

‎csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ private module DapperCommandDefitionMethodCallSqlConfig implements DataFlow::Con
6868
node.asExpr() = mc.getArgumentForName("command")
6969
)
7070
}
71+
72+
predicate observeDiffInformedIncrementalMode() {
73+
// TODO(diff-informed): Manually verify if config can be diff-informed.
74+
// csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll:54: Flow call outside 'select' clause
75+
none()
76+
}
7177
}
7278

7379
private module DapperCommandDefinitionMethodCallSql =

‎csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,12 @@ private module SettingsDataFlowConfig implements DataFlow::ConfigSig {
167167
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof XmlReaderSettingsCreation }
168168

169169
predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof XmlReaderSettingsInstance }
170+
171+
predicate observeDiffInformedIncrementalMode() {
172+
// TODO(diff-informed): Manually verify if config can be diff-informed.
173+
// csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll:190: Flow call outside 'select' clause
174+
none()
175+
}
170176
}
171177

172178
private module SettingsDataFlow = DataFlow::Global<SettingsDataFlowConfig>;

‎csharp/ql/lib/semmle/code/csharp/security/cryptography/EncryptionKeyDataFlowQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,8 @@ private module SymmetricKeyConfig implements DataFlow::ConfigSig {
7070

7171
/** Holds if the node is a key sanitizer. */
7272
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof KeySanitizer }
73+
74+
predicate observeDiffInformedIncrementalMode() { any() }
7375
}
7476

7577
/**

‎csharp/ql/lib/semmle/code/csharp/security/cryptography/HardcodedSymmetricEncryptionKey.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ module HardcodedSymmetricEncryptionKey {
8282
succ.asExpr() = mc
8383
)
8484
}
85+
86+
predicate observeDiffInformedIncrementalMode() { any() }
8587
}
8688

8789
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/CleartextStorageQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ private module ClearTextStorageConfig implements DataFlow::ConfigSig {
3232
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3333

3434
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
35+
36+
predicate observeDiffInformedIncrementalMode() { any() }
3537
}
3638

3739
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
3333
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3434

3535
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
36+
37+
predicate observeDiffInformedIncrementalMode() { any() }
3638
}
3739

3840
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ module CommandInjectionConfig implements DataFlow::ConfigSig {
4242
* `node` from the data flow graph.
4343
*/
4444
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
45+
46+
predicate observeDiffInformedIncrementalMode() { any() }
4547
}
4648

4749
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ private module ConditionalBypassConfig implements DataFlow::ConfigSig {
3939
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
4040

4141
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
42+
43+
predicate observeDiffInformedIncrementalMode() { any() }
4244
}
4345

4446
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ private module ExposureOfPrivateInformationConfig implements DataFlow::ConfigSig
3232
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3333

3434
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
35+
36+
predicate observeDiffInformedIncrementalMode() { any() }
3537
}
3638

3739
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,13 @@ private module RemoteSourceToExternalApiConfig implements DataFlow::ConfigSig {
7878
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
7979

8080
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
81+
82+
predicate observeDiffInformedIncrementalMode() {
83+
// TODO(diff-informed): Manually verify if config can be diff-informed.
84+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll:88: Flow call outside 'select' clause
85+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll:91: Flow call outside 'select' clause
86+
none()
87+
}
8188
}
8289

8390
/** A module for tracking flow from `ActiveThreatModelSource`s to `ExternalApiDataNode`s. */

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ module LdapInjectionConfig implements DataFlow::ConfigSig {
4545
* `node` from the data flow graph.
4646
*/
4747
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
48+
49+
predicate observeDiffInformedIncrementalMode() { any() }
4850
}
4951

5052
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ private module LogForgingConfig implements DataFlow::ConfigSig {
3535
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3636

3737
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
38+
39+
predicate observeDiffInformedIncrementalMode() { any() }
3840
}
3941

4042
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ private module MissingXmlValidationConfig implements DataFlow::ConfigSig {
3939
predicate isSink(DataFlow::Node sink) { exists(sink.(Sink).getReason()) }
4040

4141
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
42+
43+
predicate observeDiffInformedIncrementalMode() { any() }
4244
}
4345

4446
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ private module ReDoSConfig implements DataFlow::ConfigSig {
3333
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3434

3535
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
36+
37+
predicate observeDiffInformedIncrementalMode() { any() }
3638
}
3739

3840
/**
@@ -77,6 +79,12 @@ private module ExponentialRegexDataFlowConfig implements DataFlow::ConfigSig {
7779
predicate isSource(DataFlow::Node s) { isExponentialRegex(s.asExpr()) }
7880

7981
predicate isSink(DataFlow::Node s) { s.asExpr() = any(RegexOperation c).getPattern() }
82+
83+
predicate observeDiffInformedIncrementalMode() {
84+
// TODO(diff-informed): Manually verify if config can be diff-informed.
85+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll:92: Flow call outside 'select' clause
86+
none()
87+
}
8088
}
8189

8290
module ExponentialRegexDataFlow = DataFlow::Global<ExponentialRegexDataFlowConfig>;

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ private module RegexInjectionConfig implements DataFlow::ConfigSig {
3333
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3434

3535
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
36+
37+
predicate observeDiffInformedIncrementalMode() { any() }
3638
}
3739

3840
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ private module ResourceInjectionConfig implements DataFlow::ConfigSig {
3232
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3333

3434
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
35+
36+
predicate observeDiffInformedIncrementalMode() { any() }
3537
}
3638

3739
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
4343
* `node` from the data flow graph.
4444
*/
4545
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
46+
47+
predicate observeDiffInformedIncrementalMode() { any() }
4648
}
4749

4850
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ private module TaintedPathConfig implements DataFlow::ConfigSig {
3535
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3636

3737
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
38+
39+
predicate observeDiffInformedIncrementalMode() { any() }
3840
}
3941

4042
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,8 @@ private module TaintToObjectMethodTrackingConfig implements DataFlow::ConfigSig
5959
predicate isSink(DataFlow::Node sink) { sink instanceof InstanceMethodSink }
6060

6161
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
62+
63+
predicate observeDiffInformedIncrementalMode() { any() }
6264
}
6365

6466
/**
@@ -77,6 +79,15 @@ private module JsonConvertTrackingConfig implements DataFlow::ConfigSig {
7779
}
7880

7981
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
82+
83+
predicate observeDiffInformedIncrementalMode() {
84+
// TODO(diff-informed): Manually verify if config can be diff-informed.
85+
// csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 1 does not select a source or sink originating from the flow call on line 55
86+
// csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 2 does not select a source or sink originating from the flow call on line 55
87+
// csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 3 does not select a source or sink originating from the flow call on line 55
88+
// csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:60: Column 5 does not select a source or sink originating from the flow call on line 55
89+
none()
90+
}
8091
}
8192

8293
/**
@@ -133,6 +144,15 @@ private module TypeNameTrackingConfig implements DataFlow::ConfigSig {
133144
)
134145
)
135146
}
147+
148+
predicate observeDiffInformedIncrementalMode() {
149+
// TODO(diff-informed): Manually verify if config can be diff-informed.
150+
// csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 1 does not select a source or sink originating from the flow call on line 56
151+
// csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 2 does not select a source or sink originating from the flow call on line 56
152+
// csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 3 does not select a source or sink originating from the flow call on line 56
153+
// csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:60: Column 5 does not select a source or sink originating from the flow call on line 56
154+
none()
155+
}
136156
}
137157

138158
/**
@@ -149,6 +169,8 @@ private module TaintToConstructorOrStaticMethodTrackingConfig implements DataFlo
149169
predicate isSink(DataFlow::Node sink) { sink instanceof ConstructorOrStaticMethodSink }
150170

151171
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
172+
173+
predicate observeDiffInformedIncrementalMode() { any() }
152174
}
153175

154176
/**
@@ -186,6 +208,8 @@ private module TaintToObjectTypeTrackingConfig implements DataFlow::ConfigSig {
186208
oc.getObjectType() instanceof StrongTypeDeserializer
187209
)
188210
}
211+
212+
predicate observeDiffInformedIncrementalMode() { any() }
189213
}
190214

191215
/**
@@ -210,6 +234,8 @@ private module WeakTypeCreationToUsageTrackingConfig implements DataFlow::Config
210234
sink.asExpr() = mc.getQualifier()
211235
)
212236
}
237+
238+
predicate observeDiffInformedIncrementalMode() { any() }
213239
}
214240

215241
/**
@@ -342,6 +368,12 @@ private module DataContractJsonSafeConstructorTrackingConfig implements DataFlow
342368
mc.getQualifier() = sink.asExpr()
343369
)
344370
}
371+
372+
predicate observeDiffInformedIncrementalMode() {
373+
// TODO(diff-informed): Manually verify if config can be diff-informed.
374+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:28: Flow call outside 'select' clause
375+
none()
376+
}
345377
}
346378

347379
private module DataContractJsonSafeConstructorTracking =
@@ -389,6 +421,12 @@ private module JavaScriptSerializerSafeConstructorTrackingConfig implements Data
389421
mc.getQualifier() = sink.asExpr()
390422
)
391423
}
424+
425+
predicate observeDiffInformedIncrementalMode() {
426+
// TODO(diff-informed): Manually verify if config can be diff-informed.
427+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:29: Flow call outside 'select' clause
428+
none()
429+
}
392430
}
393431

394432
private module JavaScriptSerializerSafeConstructorTracking =
@@ -434,6 +472,12 @@ private module XmlObjectSerializerDerivedConstructorTrackingConfig implements Da
434472
mc.getQualifier() = sink.asExpr()
435473
)
436474
}
475+
476+
predicate observeDiffInformedIncrementalMode() {
477+
// TODO(diff-informed): Manually verify if config can be diff-informed.
478+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:30: Flow call outside 'select' clause
479+
none()
480+
}
437481
}
438482

439483
private module XmlObjectSerializerDerivedConstructorTracking =
@@ -476,6 +520,12 @@ private module XmlSerializerSafeConstructorTrackingConfig implements DataFlow::C
476520
mc.getQualifier() = sink.asExpr()
477521
)
478522
}
523+
524+
predicate observeDiffInformedIncrementalMode() {
525+
// TODO(diff-informed): Manually verify if config can be diff-informed.
526+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:31: Flow call outside 'select' clause
527+
none()
528+
}
479529
}
480530

481531
private module XmlSerializerSafeConstructorTracking =
@@ -522,6 +572,12 @@ private module DataContractSerializerSafeConstructorTrackingConfig implements Da
522572
mc.getQualifier() = sink.asExpr()
523573
)
524574
}
575+
576+
predicate observeDiffInformedIncrementalMode() {
577+
// TODO(diff-informed): Manually verify if config can be diff-informed.
578+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:32: Flow call outside 'select' clause
579+
none()
580+
}
525581
}
526582

527583
private module DataContractSerializerSafeConstructorTracking =
@@ -564,6 +620,12 @@ private module XmlMessageFormatterSafeConstructorTrackingConfig implements DataF
564620
mc.getQualifier() = sink.asExpr()
565621
)
566622
}
623+
624+
predicate observeDiffInformedIncrementalMode() {
625+
// TODO(diff-informed): Manually verify if config can be diff-informed.
626+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:33: Flow call outside 'select' clause
627+
none()
628+
}
567629
}
568630

569631
private module XmlMessageFormatterSafeConstructorTracking =

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ private module UrlRedirectConfig implements DataFlow::ConfigSig {
3737
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3838

3939
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
40+
41+
predicate observeDiffInformedIncrementalMode() { any() }
4042
}
4143

4244
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ module XpathInjectionConfig implements DataFlow::ConfigSig {
4343
* `node` from the data flow graph.
4444
*/
4545
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
46+
47+
predicate observeDiffInformedIncrementalMode() { any() }
4648
}
4749

4850
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSQuery.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,12 @@ module XssTrackingConfig implements DataFlow::ConfigSig {
158158
* `node` from the data flow graph.
159159
*/
160160
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
161+
162+
predicate observeDiffInformedIncrementalMode() {
163+
// TODO(diff-informed): Manually verify if config can be diff-informed.
164+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSQuery.qll:22: Flow call outside 'select' clause
165+
none()
166+
}
161167
}
162168

163169
module XssTracking = TaintTracking::Global<XssTrackingConfig>;

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ private module ZipSlipConfig implements DataFlow::ConfigSig {
3030
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3131

3232
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
33+
34+
predicate observeDiffInformedIncrementalMode() { any() }
3335
}
3436

3537
/**

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,12 @@ private module LocalFileOutputStreamConfig implements DataFlow::ConfigSig {
111111
oc.getObjectType() instanceof SystemIOStreamWriterClass
112112
)
113113
}
114+
115+
predicate observeDiffInformedIncrementalMode() {
116+
// TODO(diff-informed): Manually verify if config can be diff-informed.
117+
// csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll:124: Flow call outside 'select' clause
118+
none()
119+
}
114120
}
115121

116122
private module LocalFileOutputStreamFlow = DataFlow::Global<LocalFileOutputStreamConfig>;

0 commit comments

Comments
 (0)