Skip to content

Commit fa91ecb

Browse files
author
Max Schaefer
authored
Merge pull request #1952 from hvitved/merge-rc
Merge rc/1.22 into master
2 parents 9b805c0 + cf4db48 commit fa91ecb

File tree

13 files changed

+948
-732
lines changed

13 files changed

+948
-732
lines changed

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,8 @@ private module Cached {
9797
TImplicitDelegateCall(ControlFlow::Nodes::ElementNode cfn, DelegateArgumentToLibraryCallable arg) {
9898
cfn.getElement() = arg
9999
} or
100-
TTransitiveCapturedCall(ControlFlow::Nodes::ElementNode cfn) {
101-
transitiveCapturedCallTarget(cfn, _)
100+
TTransitiveCapturedCall(ControlFlow::Nodes::ElementNode cfn, Callable target) {
101+
transitiveCapturedCallTarget(cfn, target)
102102
} or
103103
TCilCall(CIL::Call call) {
104104
// No need to include calls that are compiled from source
@@ -416,10 +416,11 @@ class ImplicitDelegateDataFlowCall extends DelegateDataFlowCall, TImplicitDelega
416416
*/
417417
class TransitiveCapturedDataFlowCall extends DataFlowCall, TTransitiveCapturedCall {
418418
private ControlFlow::Nodes::ElementNode cfn;
419+
private Callable target;
419420

420-
TransitiveCapturedDataFlowCall() { this = TTransitiveCapturedCall(cfn) }
421+
TransitiveCapturedDataFlowCall() { this = TTransitiveCapturedCall(cfn, target) }
421422

422-
override Callable getARuntimeTarget() { transitiveCapturedCallTarget(cfn, result) }
423+
override Callable getARuntimeTarget() { result = target }
423424

424425
override ControlFlow::Nodes::ElementNode getControlFlowNode() { result = cfn }
425426

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -991,7 +991,7 @@ private module OutNodes {
991991
additionalCalls = false and
992992
call.(ImplicitDelegateDataFlowCall).isArgumentOf(csharpCall(_, cfn), _)
993993
or
994-
additionalCalls = true and call = TTransitiveCapturedCall(cfn)
994+
additionalCalls = true and call = TTransitiveCapturedCall(cfn, n.getEnclosingCallable())
995995
)
996996
}
997997

‎csharp/ql/test/library-tests/dataflow/global/Capture.cs‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,18 @@ void M()
4747
};
4848
};
4949
CaptureIn2NotCalled();
50+
void CaptureTest(string nonSink0, string sink39)
51+
{
52+
RunAction(() => // Check each lambda captures the correct arguments
53+
{
54+
Check(nonSink0);
55+
RunAction(() =>
56+
{
57+
Check(sink39);
58+
});
59+
});
60+
}
61+
CaptureTest("not tainted", tainted);
5062
}
5163

5264
void Out()
@@ -96,6 +108,18 @@ void M()
96108
};
97109
CaptureOut2NotCalled();
98110
Check(nonSink0);
111+
string sink40 = "";
112+
void CaptureOutMultipleLambdas()
113+
{
114+
RunAction(() => {
115+
sink40 = "taint source";
116+
});
117+
RunAction(() => {
118+
nonSink0 = "not tainted";
119+
});
120+
};
121+
CaptureOutMultipleLambdas();
122+
Check(sink40); Check(nonSink0);
99123
}
100124

101125
void Through(string tainted)
@@ -174,4 +198,9 @@ string Id(string s)
174198
}
175199

176200
static void Check<T>(T x) { }
201+
202+
static void RunAction(Action a)
203+
{
204+
a.Invoke();
205+
}
177206
}

‎csharp/ql/test/library-tests/dataflow/global/DataFlow.expected‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,17 @@
11
| Capture.cs:12:19:12:24 | access to local variable sink27 |
22
| Capture.cs:21:23:21:28 | access to local variable sink28 |
33
| Capture.cs:30:19:30:24 | access to local variable sink29 |
4-
| Capture.cs:60:15:60:20 | access to local variable sink30 |
5-
| Capture.cs:72:15:72:20 | access to local variable sink31 |
6-
| Capture.cs:81:15:81:20 | access to local variable sink32 |
7-
| Capture.cs:109:15:109:20 | access to local variable sink33 |
8-
| Capture.cs:121:15:121:20 | access to local variable sink34 |
9-
| Capture.cs:130:15:130:20 | access to local variable sink35 |
10-
| Capture.cs:137:15:137:20 | access to local variable sink36 |
11-
| Capture.cs:145:15:145:20 | access to local variable sink37 |
12-
| Capture.cs:171:15:171:20 | access to local variable sink38 |
4+
| Capture.cs:57:27:57:32 | access to parameter sink39 |
5+
| Capture.cs:72:15:72:20 | access to local variable sink30 |
6+
| Capture.cs:84:15:84:20 | access to local variable sink31 |
7+
| Capture.cs:93:15:93:20 | access to local variable sink32 |
8+
| Capture.cs:122:15:122:20 | access to local variable sink40 |
9+
| Capture.cs:133:15:133:20 | access to local variable sink33 |
10+
| Capture.cs:145:15:145:20 | access to local variable sink34 |
11+
| Capture.cs:154:15:154:20 | access to local variable sink35 |
12+
| Capture.cs:161:15:161:20 | access to local variable sink36 |
13+
| Capture.cs:169:15:169:20 | access to local variable sink37 |
14+
| Capture.cs:195:15:195:20 | access to local variable sink38 |
1315
| GlobalDataFlow.cs:18:15:18:29 | access to field SinkField0 |
1416
| GlobalDataFlow.cs:26:15:26:32 | access to property SinkProperty0 |
1517
| GlobalDataFlow.cs:44:50:44:59 | access to parameter sinkParam2 |

‎csharp/ql/test/library-tests/dataflow/global/DataFlowEdges.expected‎

Lines changed: 298 additions & 236 deletions
Large diffs are not rendered by default.

‎csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected‎

Lines changed: 86 additions & 67 deletions
Large diffs are not rendered by default.

‎csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected‎

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,35 @@
22
| Capture.cs:33:9:33:40 | call to method Select | yield return | Capture.cs:33:9:33:40 | call to method Select |
33
| Capture.cs:33:9:33:50 | call to method ToArray | return | Capture.cs:33:9:33:50 | call to method ToArray |
44
| Capture.cs:33:30:33:39 | [implicit call] access to local variable captureIn3 | return | Capture.cs:33:30:33:39 | [output] access to local variable captureIn3 |
5-
| Capture.cs:59:9:59:21 | call to local function CaptureOut1 | captured sink30 | Capture.cs:59:9:59:21 | SSA call def(sink30) |
6-
| Capture.cs:71:9:71:21 | [transitive] call to local function CaptureOut2 | captured sink31 | Capture.cs:71:9:71:21 | SSA call def(sink31) |
7-
| Capture.cs:71:9:71:21 | call to local function CaptureOut2 | captured sink31 | Capture.cs:71:9:71:21 | SSA call def(sink31) |
8-
| Capture.cs:80:9:80:41 | call to method Select | captured sink32 | Capture.cs:80:9:80:41 | SSA call def(sink32) |
9-
| Capture.cs:80:9:80:41 | call to method Select | return | Capture.cs:80:9:80:41 | call to method Select |
10-
| Capture.cs:80:9:80:41 | call to method Select | yield return | Capture.cs:80:9:80:41 | call to method Select |
11-
| Capture.cs:80:9:80:51 | call to method ToArray | return | Capture.cs:80:9:80:51 | call to method ToArray |
12-
| Capture.cs:80:30:80:40 | [implicit call] access to local variable captureOut3 | captured sink32 | Capture.cs:80:9:80:41 | SSA call def(sink32) |
13-
| Capture.cs:80:30:80:40 | [implicit call] access to local variable captureOut3 | return | Capture.cs:80:30:80:40 | [output] access to local variable captureOut3 |
14-
| Capture.cs:108:9:108:25 | call to local function CaptureThrough1 | captured sink33 | Capture.cs:108:9:108:25 | SSA call def(sink33) |
15-
| Capture.cs:120:9:120:25 | [transitive] call to local function CaptureThrough2 | captured sink34 | Capture.cs:120:9:120:25 | SSA call def(sink34) |
16-
| Capture.cs:120:9:120:25 | call to local function CaptureThrough2 | captured sink34 | Capture.cs:120:9:120:25 | SSA call def(sink34) |
17-
| Capture.cs:129:9:129:45 | call to method Select | captured sink35 | Capture.cs:129:9:129:45 | SSA call def(sink35) |
18-
| Capture.cs:129:9:129:45 | call to method Select | return | Capture.cs:129:9:129:45 | call to method Select |
19-
| Capture.cs:129:9:129:45 | call to method Select | yield return | Capture.cs:129:9:129:45 | call to method Select |
20-
| Capture.cs:129:9:129:55 | call to method ToArray | return | Capture.cs:129:9:129:55 | call to method ToArray |
21-
| Capture.cs:129:30:129:44 | [implicit call] access to local variable captureThrough3 | captured sink35 | Capture.cs:129:9:129:45 | SSA call def(sink35) |
22-
| Capture.cs:129:30:129:44 | [implicit call] access to local variable captureThrough3 | return | Capture.cs:129:30:129:44 | [output] access to local variable captureThrough3 |
23-
| Capture.cs:136:22:136:38 | call to local function CaptureThrough4 | return | Capture.cs:136:22:136:38 | call to local function CaptureThrough4 |
24-
| Capture.cs:144:9:144:32 | call to local function CaptureThrough5 | captured sink37 | Capture.cs:144:9:144:32 | SSA call def(sink37) |
25-
| Capture.cs:167:20:167:22 | call to local function M | return | Capture.cs:167:20:167:22 | call to local function M |
26-
| Capture.cs:170:22:170:32 | call to local function Id | return | Capture.cs:170:22:170:32 | call to local function Id |
27-
| Capture.cs:172:20:172:25 | call to local function Id | return | Capture.cs:172:20:172:25 | call to local function Id |
5+
| Capture.cs:71:9:71:21 | call to local function CaptureOut1 | captured sink30 | Capture.cs:71:9:71:21 | SSA call def(sink30) |
6+
| Capture.cs:83:9:83:21 | [transitive] call to local function CaptureOut2 | captured sink31 | Capture.cs:83:9:83:21 | SSA call def(sink31) |
7+
| Capture.cs:83:9:83:21 | call to local function CaptureOut2 | captured sink31 | Capture.cs:83:9:83:21 | SSA call def(sink31) |
8+
| Capture.cs:92:9:92:41 | call to method Select | captured sink32 | Capture.cs:92:9:92:41 | SSA call def(sink32) |
9+
| Capture.cs:92:9:92:41 | call to method Select | return | Capture.cs:92:9:92:41 | call to method Select |
10+
| Capture.cs:92:9:92:41 | call to method Select | yield return | Capture.cs:92:9:92:41 | call to method Select |
11+
| Capture.cs:92:9:92:51 | call to method ToArray | return | Capture.cs:92:9:92:51 | call to method ToArray |
12+
| Capture.cs:92:30:92:40 | [implicit call] access to local variable captureOut3 | captured sink32 | Capture.cs:92:9:92:41 | SSA call def(sink32) |
13+
| Capture.cs:92:30:92:40 | [implicit call] access to local variable captureOut3 | return | Capture.cs:92:30:92:40 | [output] access to local variable captureOut3 |
14+
| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
15+
| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
16+
| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:121:9:121:35 | SSA call def(sink40) |
17+
| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:121:9:121:35 | SSA call def(sink40) |
18+
| Capture.cs:121:9:121:35 | call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
19+
| Capture.cs:121:9:121:35 | call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:121:9:121:35 | SSA call def(sink40) |
20+
| Capture.cs:132:9:132:25 | call to local function CaptureThrough1 | captured sink33 | Capture.cs:132:9:132:25 | SSA call def(sink33) |
21+
| Capture.cs:144:9:144:25 | [transitive] call to local function CaptureThrough2 | captured sink34 | Capture.cs:144:9:144:25 | SSA call def(sink34) |
22+
| Capture.cs:144:9:144:25 | call to local function CaptureThrough2 | captured sink34 | Capture.cs:144:9:144:25 | SSA call def(sink34) |
23+
| Capture.cs:153:9:153:45 | call to method Select | captured sink35 | Capture.cs:153:9:153:45 | SSA call def(sink35) |
24+
| Capture.cs:153:9:153:45 | call to method Select | return | Capture.cs:153:9:153:45 | call to method Select |
25+
| Capture.cs:153:9:153:45 | call to method Select | yield return | Capture.cs:153:9:153:45 | call to method Select |
26+
| Capture.cs:153:9:153:55 | call to method ToArray | return | Capture.cs:153:9:153:55 | call to method ToArray |
27+
| Capture.cs:153:30:153:44 | [implicit call] access to local variable captureThrough3 | captured sink35 | Capture.cs:153:9:153:45 | SSA call def(sink35) |
28+
| Capture.cs:153:30:153:44 | [implicit call] access to local variable captureThrough3 | return | Capture.cs:153:30:153:44 | [output] access to local variable captureThrough3 |
29+
| Capture.cs:160:22:160:38 | call to local function CaptureThrough4 | return | Capture.cs:160:22:160:38 | call to local function CaptureThrough4 |
30+
| Capture.cs:168:9:168:32 | call to local function CaptureThrough5 | captured sink37 | Capture.cs:168:9:168:32 | SSA call def(sink37) |
31+
| Capture.cs:191:20:191:22 | call to local function M | return | Capture.cs:191:20:191:22 | call to local function M |
32+
| Capture.cs:194:22:194:32 | call to local function Id | return | Capture.cs:194:22:194:32 | call to local function Id |
33+
| Capture.cs:196:20:196:25 | call to local function Id | return | Capture.cs:196:20:196:25 | call to local function Id |
2834
| GlobalDataFlow.cs:25:9:25:26 | access to property SinkProperty0 | return | GlobalDataFlow.cs:25:9:25:26 | access to property SinkProperty0 |
2935
| GlobalDataFlow.cs:26:15:26:32 | access to property SinkProperty0 | return | GlobalDataFlow.cs:26:15:26:32 | access to property SinkProperty0 |
3036
| GlobalDataFlow.cs:29:9:29:29 | access to property NonSinkProperty0 | return | GlobalDataFlow.cs:29:9:29:29 | access to property NonSinkProperty0 |

‎csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,17 @@
11
| Capture.cs:12:19:12:24 | access to local variable sink27 |
22
| Capture.cs:21:23:21:28 | access to local variable sink28 |
33
| Capture.cs:30:19:30:24 | access to local variable sink29 |
4-
| Capture.cs:60:15:60:20 | access to local variable sink30 |
5-
| Capture.cs:72:15:72:20 | access to local variable sink31 |
6-
| Capture.cs:81:15:81:20 | access to local variable sink32 |
7-
| Capture.cs:109:15:109:20 | access to local variable sink33 |
8-
| Capture.cs:121:15:121:20 | access to local variable sink34 |
9-
| Capture.cs:130:15:130:20 | access to local variable sink35 |
10-
| Capture.cs:137:15:137:20 | access to local variable sink36 |
11-
| Capture.cs:145:15:145:20 | access to local variable sink37 |
12-
| Capture.cs:171:15:171:20 | access to local variable sink38 |
4+
| Capture.cs:57:27:57:32 | access to parameter sink39 |
5+
| Capture.cs:72:15:72:20 | access to local variable sink30 |
6+
| Capture.cs:84:15:84:20 | access to local variable sink31 |
7+
| Capture.cs:93:15:93:20 | access to local variable sink32 |
8+
| Capture.cs:122:15:122:20 | access to local variable sink40 |
9+
| Capture.cs:133:15:133:20 | access to local variable sink33 |
10+
| Capture.cs:145:15:145:20 | access to local variable sink34 |
11+
| Capture.cs:154:15:154:20 | access to local variable sink35 |
12+
| Capture.cs:161:15:161:20 | access to local variable sink36 |
13+
| Capture.cs:169:15:169:20 | access to local variable sink37 |
14+
| Capture.cs:195:15:195:20 | access to local variable sink38 |
1315
| GlobalDataFlow.cs:18:15:18:29 | access to field SinkField0 |
1416
| GlobalDataFlow.cs:26:15:26:32 | access to property SinkProperty0 |
1517
| GlobalDataFlow.cs:44:50:44:59 | access to parameter sinkParam2 |

0 commit comments

Comments
 (0)