C#: Blazor: Add route parameters as remote flow sources#18664
C#: Blazor: Add route parameters as remote flow sources#18664egregius313 merged 12 commits intogithub:mainfrom
Conversation
There was a problem hiding this comment.
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more
| /** Provides classes for working with `Microsoft.AspNetCore.Components` */ | ||
|
|
||
| import csharp | ||
| import semmle.code.csharp.frameworks.Microsoft |
Check warning
Code scanning / CodeQL
Redundant import Warning
csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
Fixed
Show fixed
Hide fixed
csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
Outdated
Show resolved
Hide resolved
| Property getARouteParameterProperty() { | ||
| result = this.getAParameterProperty() and | ||
| exists(string urlParamName | urlParamName = this.getARouteParameter() | | ||
| result.getName().toLowerCase() = urlParamName.toLowerCase() | ||
| ) | ||
| } | ||
| } |
There was a problem hiding this comment.
Joining on names is always a candidate for a bad join, so it is usually safer to force multi-column joins, e.g.
pragma[nomagic]
private Property getAParameterProperty(string name) {
result = this.getAProperty() and
result.getAnAttribute() instanceof MicrosoftAspNetCoreComponentsParameterAttribute and
name = result.getName().toLowerCase()
}
pragma[nomagic]
private string getARouteParameter() {
exists(string s |
s = this.getRouteAttributeUrl().splitAt("{").regexpCapture("\\*?([^:?}]+)[:?}](.*)", 1) and
result = s.toLowerCase()
)
}
Property getARouteParameterProperty() {
exists(string name |
result = this.getAParameterProperty(name) and
name = this.getARouteParameter()
)
}| @@ -0,0 +1,7 @@ | |||
| import semmle.code.csharp.security.dataflow.flowsources.Remote | |||
There was a problem hiding this comment.
What is the motivation for using integration tests instead of normal QL tests? I find it quite difficult to run
(specific) integration tests locally...
There was a problem hiding this comment.
This was mostly because the test was originally from Tamás's WIP PR. And I wasn't sure about testing Blazor components as a QL test (I'm unsure if I'll need to have a full project). I'll experiment with moving it.
You are correct about the integration test being a more complicated way to run the test locally.
There was a problem hiding this comment.
If it's not easy to do, then let's do only the integration test.
| from RemoteFlowSource source, File f | ||
| where | ||
| source.getLocation().getFile() = f and | ||
| (f.fromSource() or f.getExtension() = "razor") |
There was a problem hiding this comment.
Looks like the f.getExtension() = "razor" disjunct can be removed?
Adds the variables parsed from the
@pagedirective of a Blazor component as remote flow sources