Merge pull request #5316 from tamasvajk/feature/roslyn3.9

tamasvajk · web-flow · commit 8d6b8359eb86 · 2021-03-16T11:44:42.000+01:00
C#: Upgrade Roslyn dependencies to 3.9
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Semmle.Extraction.CSharp.csproj b/csharp/extractor/Semmle.Extraction.CSharp/Semmle.Extraction.CSharp.csproj
@@ -22,7 +22,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="3.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="3.9.0" />
   </ItemGroup>
 
 </Project>
diff --git a/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj b/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj
@@ -15,7 +15,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis" Version="3.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis" Version="3.9.0" />
     <PackageReference Include="GitInfo" Version="2.0.20">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
diff --git a/csharp/ql/test/library-tests/controlflow/guards/Assert.cs b/csharp/ql/test/library-tests/controlflow/guards/Assert.cs
@@ -1,7 +1,7 @@
 using System;
 using System.Diagnostics;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
-
+#nullable enable
 class AssertTests
 {
     void M1(bool b)
diff --git a/csharp/ql/test/library-tests/controlflow/guards/Collections.cs b/csharp/ql/test/library-tests/controlflow/guards/Collections.cs
@@ -4,7 +4,7 @@
 using System.Collections.Generic;
 using System.Collections.Specialized;
 using System.Linq;
-
+#nullable enable
 public class Collections
 {
     void M1(string[] args)
diff --git a/csharp/ql/test/library-tests/controlflow/guards/Guards.cs b/csharp/ql/test/library-tests/controlflow/guards/Guards.cs
@@ -1,5 +1,5 @@
 using System;
-
+#nullable enable
 public class Guards
 {
     public string? Field;
diff --git a/csharp/ql/test/library-tests/controlflow/guards/Splitting.cs b/csharp/ql/test/library-tests/controlflow/guards/Splitting.cs
@@ -1,6 +1,6 @@
 using System;
 using System.Diagnostics;
-
+#nullable enable
 /// <summary>
 /// Tests related to CFG splitting.
 /// </summary>
diff --git a/csharp/ql/test/library-tests/csharp8/NullableRefTypes.expected b/csharp/ql/test/library-tests/csharp8/NullableRefTypes.expected
@@ -207,7 +207,7 @@ returnTypes
 | NullableRefTypes.cs:215:10:215:20 | ElementTest | Void! |
 | NullableRefTypes.cs:223:48:223:54 | GetSelf | TestNullableFlowStates? |
 methodTypeArguments
-| NameResolutionSuppressNullable.cs:10:21:10:40 | EnsureInitialized | 0 | WaitCallback? |
+| NameResolutionSuppressNullable.cs:10:21:10:40 | EnsureInitialized | 0 | WaitCallback |
 | NullableRefTypes.cs:51:12:51:15 | Q | 0 | MyClass! |
 | NullableRefTypes.cs:51:12:51:15 | Q | 0 | MyClass? |
 | NullableRefTypes.cs:67:10:67:21 | GenericFn | 0 | MyClass! |
@@ -326,11 +326,11 @@ expressionTypes
 | NullableRefTypes.cs:113:36:113:43 | access to field Property | MyClass? |
 | NullableRefTypes.cs:113:36:113:43 | this access | RefTypes |
 | NullableRefTypes.cs:113:36:113:44 | ...! | MyClass? |
-| NullableRefTypes.cs:157:18:157:30 | object creation of type MyClass | MyClass! |
-| NullableRefTypes.cs:160:17:160:17 | access to local variable a | MyClass! |
-| NullableRefTypes.cs:160:17:160:21 | MyClass a = ... | MyClass! |
-| NullableRefTypes.cs:160:21:160:21 | access to parameter p | MyClass! |
-| NullableRefTypes.cs:161:16:161:16 | access to local variable a | MyClass! |
+| NullableRefTypes.cs:157:18:157:30 | object creation of type MyClass | MyClass |
+| NullableRefTypes.cs:160:17:160:17 | access to local variable a | MyClass |
+| NullableRefTypes.cs:160:17:160:21 | MyClass a = ... | MyClass |
+| NullableRefTypes.cs:160:21:160:21 | access to parameter p | MyClass |
+| NullableRefTypes.cs:161:16:161:16 | access to local variable a | MyClass |
 | NullableRefTypes.cs:181:17:181:17 | access to local variable x | string! |
 | NullableRefTypes.cs:181:17:181:31 | String x = ... | string! |
 | NullableRefTypes.cs:181:21:181:31 | call to method MaybeNull | string? |
@@ -444,9 +444,6 @@ exprFlowState
 | NullableRefTypes.cs:110:64:110:67 | null | Maybe null |
 | NullableRefTypes.cs:113:36:113:43 | access to field Property | Not null |
 | NullableRefTypes.cs:113:36:113:44 | ...! | Not null |
-| NullableRefTypes.cs:157:18:157:30 | object creation of type MyClass | Not null |
-| NullableRefTypes.cs:160:21:160:21 | access to parameter p | Not null |
-| NullableRefTypes.cs:161:16:161:16 | access to local variable a | Not null |
 | NullableRefTypes.cs:181:21:181:31 | call to method MaybeNull | Maybe null |
 | NullableRefTypes.cs:183:9:183:16 | call to method Check | Not null |
 | NullableRefTypes.cs:183:15:183:15 | access to local variable x | Maybe null |
diff --git a/csharp/ql/test/library-tests/csharp9/record.ql b/csharp/ql/test/library-tests/csharp9/record.ql
@@ -1,14 +1,17 @@
 import csharp
 
 query predicate records(Record t, string i, RecordCloneMethod clone) {
-  t.getABaseInterface().toStringWithTypes() = i and clone = t.getCloneMethod()
+  t.getABaseInterface().toStringWithTypes() = i and
+  clone = t.getCloneMethod() and
+  t.fromSource()
 }
 
 private string getMemberName(Member m) {
   result = m.getDeclaringType().getQualifiedName() + "." + m.toStringWithTypes()
 }
 
 query predicate members(Record t, string ms, string l) {
+  t.fromSource() and
   exists(Member m | t.hasMember(m) |
     ms = getMemberName(m) and
     if m.fromSource() then l = m.getLocation().toString() else l = "no location"
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypass.cs b/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypass.cs
@@ -17,8 +17,10 @@ public Test1(string v)
     [OnDeserializing]
     public void Deserialize()
     {
-        f = $"invalid";  // BAD
+        f = GetString();  // BAD, non-constant and non-object creation expr
     }
+
+    string GetString() { throw null; }
 }
 
 [Serializable]
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksbypass.expected b/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksbypass.expected
@@ -1,4 +1,4 @@
-| RuntimeChecksBypass.cs:20:13:20:22 | $"..." | This write to $@ may be circumventing a $@. | RuntimeChecksBypass.cs:7:19:7:19 | f | f | RuntimeChecksBypass.cs:11:9:14:9 | if (...) ... | check |
-| RuntimeChecksBypass.cs:124:15:124:34 | call to method GetInt32 | This write to $@ may be circumventing a $@. | RuntimeChecksBypass.cs:112:16:112:18 | Age | Age | RuntimeChecksBypass.cs:116:9:117:53 | if (...) ... | check |
-| RuntimeChecksBypass.cs:168:15:168:17 | access to local variable age | This write to $@ may be circumventing a $@. | RuntimeChecksBypass.cs:153:16:153:18 | Age | Age | RuntimeChecksBypass.cs:157:9:158:53 | if (...) ... | check |
+| RuntimeChecksBypass.cs:20:13:20:23 | call to method GetString | This write to $@ may be circumventing a $@. | RuntimeChecksBypass.cs:7:19:7:19 | f | f | RuntimeChecksBypass.cs:11:9:14:9 | if (...) ... | check |
+| RuntimeChecksBypass.cs:126:15:126:34 | call to method GetInt32 | This write to $@ may be circumventing a $@. | RuntimeChecksBypass.cs:114:16:114:18 | Age | Age | RuntimeChecksBypass.cs:118:9:119:53 | if (...) ... | check |
+| RuntimeChecksBypass.cs:170:15:170:17 | access to local variable age | This write to $@ may be circumventing a $@. | RuntimeChecksBypass.cs:155:16:155:18 | Age | Age | RuntimeChecksBypass.cs:159:9:160:53 | if (...) ... | check |
 | RuntimeChecksBypassBad.cs:19:15:19:34 | call to method GetInt32 | This write to $@ may be circumventing a $@. | RuntimeChecksBypassBad.cs:7:16:7:18 | Age | Age | RuntimeChecksBypassBad.cs:11:9:12:53 | if (...) ... | check |

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`using System;`
`2`	`2`	`using System.Diagnostics;`
`3`	`3`	`using Microsoft.VisualStudio.TestTools.UnitTesting;`
`4`		`-`
	`4`	`+#nullable enable`
`5`	`5`	`class AssertTests`
`6`	`6`	`{`
`7`	`7`	`void M1(bool b)`
Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@`
`4`	`4`	`using System.Collections.Generic;`
`5`	`5`	`using System.Collections.Specialized;`
`6`	`6`	`using System.Linq;`
`7`		`-`
	`7`	`+#nullable enable`
`8`	`8`	`public class Collections`
`9`	`9`	`{`
`10`	`10`	`void M1(string[] args)`
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`using System;`
`2`		`-`
	`2`	`+#nullable enable`
`3`	`3`	`public class Guards`
`4`	`4`	`{`
`5`	`5`	`public string? Field;`
Original file line number	Diff line number	Diff line change
`@@ -17,8 +17,10 @@ public Test1(string v)`
`17`	`17`	`[OnDeserializing]`
`18`	`18`	`public void Deserialize()`
`19`	`19`	`{`
`20`		`- f = $"invalid"; // BAD`
	`20`	`+ f = GetString(); // BAD, non-constant and non-object creation expr`
`21`	`21`	`}`
	`22`	`+`
	`23`	`+ string GetString() { throw null; }`
`22`	`24`	`}`
`23`	`25`
`24`	`26`	`[Serializable]`