@@ -28,27 +28,51 @@ The following changes in version 1.25 affect C# analysis in all applications.
2828 such as ` A<int>.B ` , no longer are considered unbound generics. (Such nested types do,
2929 however, still have relevant ` .getSourceDeclaration() ` s, for example ` A<>.B ` .)
3030* The data-flow library has been improved, which affects most security queries by potentially
31- adding more results. Flow through methods now takes nested field reads/writes into account.
32- For example, the library is able to track flow from ` "taint" ` to ` Sink() ` via the method
33- ` GetF2F1() ` in
34- ``` csharp
35- class C1
36- {
37- string F1 ;
38- }
39-
40- class C2
41- {
42- C1 F2 ;
43-
44- string GetF2F1 () => F2 .F1 ; // Nested field read
45-
46- void M ()
47- {
48- F2 = new C1 () { F1 = " taint"
49- Sink (GetF2F1 ()); // NEW: "taint" reaches here
50-
51- }
52- ```
31+ adding more results:
32+ - Flow through methods now takes nested field reads/writes into account.
33+ For example, the library is able to track flow from ` "taint" ` to ` Sink() ` via the method
34+ ` GetF2F1() ` in
35+ ``` csharp
36+ class C1
37+ {
38+ string F1 ;
39+ }
40+
41+ class C2
42+ {
43+ C1 F2 ;
44+
45+ string GetF2F1 () => F2 .F1 ; // Nested field read
46+
47+ void M ()
48+ {
49+ F2 = new C1 () { F1 = " taint"
50+ Sink (GetF2F1 ()); // NEW: "taint" reaches here
51+
52+ }
53+ ```
54+ - Flow through collections is now modeled precisely . For example , instead of modeling an array
55+ store `a [i ] = x ` as a taint - step from `x ` to `a `, we now model it as a data - flow step that
56+ stores `x ` into `a `. To get the value back out , a matching read step must be taken .
57+
58+ For source - code based data - flow analysis , the following constructs are modeled as stores into
59+ collections :
60+ - Direct array assignments , `a [i ] = x `.
61+ - Array initializers , `new [] { x }`.
62+ - C # 6 - style array initializers , `new C () { Array = { [i ] = x } }`.
63+ - Call arguments that match a `params ` parameter , where the C # compiler creates an array under - the - hood .
64+ - `yield return ` statements .
65+
66+ The following source - code constructs read from a collection :
67+ - Direct array reads , `a [i ]`.
68+ - `foreach ` statements .
69+
70+ For calls out to library code , existing flow summaries have been refined to precisely
71+ capture how they interact with collection contents . For example , a call to
72+ `System .Collections .Generic .List <T >.Add (T )` stores the value of the argument into the
73+ qualifier , and a call to `System .Collections .Generic .List <T >.get_Item (int )` (that is , an
74+ indexer call ) reads contents out of the qualifier . Moreover , the effect of
75+ collection - clearing methods such as `System .Collections .Generic .List <T >.Clear ()` is now
76+ also modeled .
5377
5478## Changes to autobuilder
0 commit comments