Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

C#: Correctly parse operator names in MaD #14678

Merged
merged 4 commits into from
Nov 7, 2023
Merged

C#: Correctly parse operator names in MaD #14678

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
aa521ec
C#: Include more libraries in flow summaries test
hvitved Nov 3, 2023
2a33a86
C#: Merge `ExternalFlow.qll` and `ExternalFlowExtensions.qll`, and mo…
hvitved Nov 3, 2023
3e3ea51
C#: Correctly parse operator names in MaD
hvitved Nov 3, 2023
af7b295
Address review comments
hvitved Nov 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 0 additions & 34 deletions csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlowExtensions.qll
View file
Open in desktop

This file was deleted.

63 changes: 44 additions & 19 deletions ...mle/code/csharp/dataflow/ExternalFlow.qll → ...csharp/dataflow/internal/ExternalFlow.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,27 +87,45 @@
*/

import csharp
private import ExternalFlowExtensions as Extensions
private import internal.AccessPathSyntax
private import internal.DataFlowDispatch
private import internal.DataFlowPrivate
private import internal.DataFlowPublic
private import internal.FlowSummaryImpl::Public
private import internal.FlowSummaryImpl::Private::External
private import internal.FlowSummaryImplSpecific
private import AccessPathSyntax
private import DataFlowDispatch
private import DataFlowPrivate
private import DataFlowPublic
private import FlowSummaryImpl::Public
private import FlowSummaryImpl::Private::External
private import FlowSummaryImplSpecific
private import codeql.mad.ModelValidation as SharedModelVal

/** Holds if a source model exists for the given parameters. */
predicate sourceModel = Extensions::sourceModel/9;
/**
* Holds if a source model exists for the given parameters.
*/
extensible predicate sourceModel(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we keep this in the ExternalFlowExtensions file instead - to make sure this is streamlined with other languages (for java - the model related predicates in ExternalFlow are not just aliases)?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That means those predicates are exposed; do we really want/need that?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe then move the entire ExternalFlowExtensions file as well (also for Java)?

string namespace, string type, boolean subtypes, string name, string signature, string ext,
string output, string kind, string provenance
);

/** Holds if a sink model exists for the given parameters. */
predicate sinkModel = Extensions::sinkModel/9;
/**
* Holds if a sink model exists for the given parameters.
*/
extensible predicate sinkModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
string input, string kind, string provenance
);

/** Holds if a summary model exists for the given parameters. */
predicate summaryModel = Extensions::summaryModel/10;
/**
* Holds if a summary model exists for the given parameters.
*/
extensible predicate summaryModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
string input, string output, string kind, string provenance
);

/** Holds if a neutral model exists for the given parameters. */
predicate neutralModel = Extensions::neutralModel/6;
/**
* Holds if a neutral model exists for the given parameters.
*/
extensible predicate neutralModel(
string namespace, string type, string name, string signature, string kind, string provenance
);

private predicate relevantNamespace(string namespace) {
sourceModel(namespace, _, _, _, _, _, _, _, _) or
Expand Down Expand Up @@ -310,10 +328,17 @@ class UnboundCallable extends Callable {
}
}

private predicate hasName(Declaration d, string name) {
d.(Operator).getFunctionName() = name
or
not d instanceof Operator and
d.hasName(name)
}

pragma[nomagic]
private predicate callableSpecInfo(Callable c, string namespace, string type, string name) {
c.getDeclaringType().hasQualifiedName(namespace, type) and
c.getName() = name
hasName(c, name)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🙀 So was it the case, that even though the models existed they were not applied correctly to the operator?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes.

}

pragma[nomagic]
Expand All @@ -326,7 +351,7 @@ private predicate subtypeSpecCandidate(string name, UnboundValueOrRefType t) {

pragma[nomagic]
private predicate callableInfo(Callable c, string name, UnboundValueOrRefType decl) {
name = c.getName() and
hasName(c, name) and
decl = c.getDeclaringType()
}

Expand Down Expand Up @@ -387,7 +412,7 @@ private Element interpretElement0(
subtypes = true and result.(UnboundCallable).overridesOrImplementsUnbound(m)
) and
m.getDeclaringType() = t and
m.hasName(name)
hasName(m, name)
|
signature = ""
or
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ private import DataFlowImplCommon
private import FlowSummaryImpl::Private
private import FlowSummaryImpl::Public
private import semmle.code.csharp.Unification
private import semmle.code.csharp.dataflow.ExternalFlow
private import ExternalFlow
private import semmle.code.csharp.dataflow.FlowSummary as FlowSummary

/**
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/cryptography/HardcodedSymmetricEncryptionKey.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
*/

import csharp
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

module HardcodedSymmetricEncryptionKey {
private import semmle.code.csharp.frameworks.system.security.cryptography.SymmetricAlgorithm
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ private import semmle.code.csharp.security.dataflow.flowsources.Remote
private import semmle.code.csharp.security.dataflow.flowsources.Local
private import semmle.code.csharp.frameworks.system.codedom.Compiler
private import semmle.code.csharp.security.Sanitizers
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

/**
* A data flow source for user input treated as code vulnerabilities.
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ import csharp
private import semmle.code.csharp.security.dataflow.flowsources.Remote
private import semmle.code.csharp.frameworks.system.Diagnostics
private import semmle.code.csharp.security.Sanitizers
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

/**
* A source specific to command injection vulnerabilities.
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ private import semmle.code.csharp.security.dataflow.flowsources.Remote
private import semmle.code.csharp.frameworks.system.DirectoryServices
private import semmle.code.csharp.frameworks.system.directoryservices.Protocols
private import semmle.code.csharp.security.Sanitizers
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

/**
* A data flow source for unvalidated user input that is used to construct LDAP queries.
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ private import semmle.code.csharp.frameworks.System
private import semmle.code.csharp.frameworks.system.text.RegularExpressions
private import semmle.code.csharp.security.Sanitizers
private import semmle.code.csharp.security.dataflow.flowsinks.ExternalLocationSink
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

/**
* A data flow source for untrusted user input used in log entries.
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ private import semmle.code.csharp.security.dataflow.flowsources.Remote
private import semmle.code.csharp.security.dataflow.flowsources.Local
private import semmle.code.csharp.frameworks.Sql
private import semmle.code.csharp.security.Sanitizers
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

/**
* A source specific to SQL injection vulnerabilities.
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ private import semmle.code.csharp.frameworks.system.Web
private import semmle.code.csharp.frameworks.system.web.Mvc
private import semmle.code.csharp.security.Sanitizers
private import semmle.code.csharp.frameworks.microsoft.AspNetCore
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

/**
* A data flow source for unvalidated URL redirect vulnerabilities.
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSSinks.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ private import semmle.code.csharp.frameworks.system.Web
private import semmle.code.csharp.frameworks.system.web.UI
private import semmle.code.csharp.security.dataflow.flowsinks.Html
private import semmle.code.csharp.security.dataflow.flowsinks.Remote
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.csharp.frameworks.ServiceStack::XSS

/**
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ private import Remote
private import semmle.code.csharp.commons.Loggers
private import semmle.code.csharp.frameworks.system.Web
private import semmle.code.csharp.frameworks.system.IO
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

/**
* An external location sink.
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Html.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ private import semmle.code.csharp.frameworks.system.web.UI
private import semmle.code.csharp.frameworks.system.web.ui.WebControls
private import semmle.code.csharp.frameworks.system.windows.Forms
private import semmle.code.csharp.security.dataflow.flowsources.Remote
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.asp.AspNet

/**
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

import csharp
private import semmle.code.csharp.frameworks.system.windows.Forms
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

/** A data flow source of local data. */
abstract class LocalFlowSource extends DataFlow::Node {
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ private import semmle.code.csharp.frameworks.system.web.ui.WebControls
private import semmle.code.csharp.frameworks.WCF
private import semmle.code.csharp.frameworks.microsoft.Owin
private import semmle.code.csharp.frameworks.microsoft.AspNetCore
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow

/** A data flow source of remote user input. */
abstract class RemoteFlowSource extends DataFlow::Node {
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
*/

import csharp
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.csharp.frameworks.system.data.Common
private import semmle.code.csharp.frameworks.system.data.Entity
private import semmle.code.csharp.frameworks.EntityFramework
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/Metrics/Summaries/FrameworkCoverage.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
*/

import csharp
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow

from string namespaceAndType, int rows
where
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/Telemetry/ExternalApi.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@

private import csharp
private import semmle.code.csharp.dispatch.Dispatch
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.FlowSummary
private import semmle.code.csharp.dataflow.internal.DataFlowPrivate
private import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlowDispatch
private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
private import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate
private import semmle.code.csharp.security.dataflow.flowsources.Remote
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/meta/frameworks/Coverage.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
*/

import csharp
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow

from string namespace, int pkgs, string kind, string part, int n
where modelCoverage(namespace, pkgs, kind, part, n)
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/utils/modelconverter/ExtractNeutrals.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
*/

import csharp
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow

from string package, string type, string name, string signature, string kind, string provenance
where
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/utils/modelconverter/ExtractSinks.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
*/

import csharp
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow

from
string namespace, string type, boolean subtypes, string name, string signature, string ext,
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/utils/modelconverter/ExtractSources.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
*/

import csharp
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow

from
string namespace, string type, boolean subtypes, string name, string signature, string ext,
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/utils/modelconverter/ExtractSummaries.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
*/

import csharp
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow

from
string namespace, string type, boolean subtypes, string name, string signature, string ext,
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/utils/modeleditor/ApplicationModeEndpointsQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
private import csharp
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlowDispatch
private import semmle.code.csharp.dataflow.internal.DataFlowPrivate
private import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/utils/modeleditor/FrameworkModeEndpointsQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
private import csharp
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.csharp.frameworks.Test
private import ModelEditor

Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/utils/modelgenerator/internal/CaptureModelsSpecific.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ private import semmle.code.csharp.commons.Util as Util
private import semmle.code.csharp.commons.Collections as Collections
private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
private import semmle.code.csharp.frameworks.system.linq.Expressions
import semmle.code.csharp.dataflow.ExternalFlow as ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow as ExternalFlow
import semmle.code.csharp.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
import semmle.code.csharp.dataflow.internal.DataFlowPrivate as DataFlowPrivate

Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
*/

import csharp
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow
import Taint::PathGraph
import ModelValidation

Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/test/library-tests/dataflow/external-models/sinks.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import csharp
import DataFlow
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow
import ModelValidation

from DataFlow::Node node, string kind
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/test/library-tests/dataflow/external-models/srcs.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import csharp
import DataFlow
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow
import ModelValidation

from DataFlow::Node node, string kind
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/test/library-tests/dataflow/external-models/steps.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import csharp
import DataFlow
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow
import ModelValidation
import semmle.code.csharp.dataflow.FlowSummary
import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlowDispatch
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/test/library-tests/dataflow/external-models/validatemodels.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
import csharp
import semmle.code.csharp.dataflow.ExternalFlow
import semmle.code.csharp.dataflow.internal.ExternalFlow
import semmle.code.csharp.dataflow.internal.AccessPathSyntax
import ModelValidation

Expand Down
Loading