Skip to content

Commit b1ab77f

Browse files
michaelnebelmichaelnebel
committed
C#: Add a copy of all experimental query tests (as is).
1 parent 13b2a0c commit b1ab77f

File tree

125 files changed

+1931
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

125 files changed

+1931
-0
lines changed

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/CookieBuilder/HttpOnly.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| Program.cs:13:33:13:37 | false | Cookie attribute 'HttpOnly' is not set to true. |
2+
| Program.cs:20:39:20:43 | false | Cookie attribute 'HttpOnly' is not set to true. |

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/CookieBuilder/HttpOnly.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/CookieBuilder/Program.cs

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
using Microsoft.AspNetCore.Builder;
2+
using Microsoft.AspNetCore.Hosting;
3+
using Microsoft.Extensions.DependencyInjection;
4+
using Microsoft.AspNetCore.Http;
5+
using Microsoft.AspNetCore.Authentication;
6+
7+
public class Startup
8+
{
9+
public void ConfigureServices(IServiceCollection services)
10+
{
11+
services.AddAuthentication().AddCookie(o =>
12+
{
13+
o.Cookie.HttpOnly = false;
14+
o.Cookie.SecurePolicy = Microsoft.AspNetCore.Http.CookieSecurePolicy.None;
15+
});
16+
17+
services.AddSession(options =>
18+
{
19+
options.Cookie.SecurePolicy = Microsoft.AspNetCore.Http.CookieSecurePolicy.None;
20+
options.Cookie.HttpOnly = false;
21+
});
22+
}
23+
}

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/NoPolicy/HttpOnly.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| Program.cs:25:34:25:38 | false | Cookie attribute 'HttpOnly' is not set to true. |
2+
| Program.cs:38:88:38:92 | false | Cookie attribute 'HttpOnly' is not set to true. |
3+
| Program.cs:61:34:61:34 | access to local variable v | Cookie attribute 'HttpOnly' is not set to true. |
4+
| Program.cs:68:88:68:88 | access to local variable v | Cookie attribute 'HttpOnly' is not set to true. |

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/NoPolicy/HttpOnly.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/NoPolicy/Program.cs

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
public class MyController : Microsoft.AspNetCore.Mvc.Controller
2+
{
3+
public void CookieDelete()
4+
{
5+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
6+
Response.Cookies.Delete("auth", cookieOptions); // GOOD: Delete call
7+
}
8+
9+
void CookieDirectTrue()
10+
{
11+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
12+
cookieOptions.HttpOnly = true;
13+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD
14+
}
15+
16+
void CookieDirectTrueInitializer()
17+
{
18+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions() { HttpOnly = true };
19+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD
20+
}
21+
22+
void CookieDirectFalse()
23+
{
24+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
25+
cookieOptions.HttpOnly = false;
26+
Response.Cookies.Append("auth", "secret", cookieOptions); // BAD
27+
}
28+
29+
void CookieDirectFalseForgery()
30+
{
31+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
32+
cookieOptions.HttpOnly = false;
33+
Response.Cookies.Append("antiforgerytoken", "secret", cookieOptions); // GOOD: not an auth cookie
34+
}
35+
36+
void CookieDirectFalseInitializer()
37+
{
38+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions() { HttpOnly = false };
39+
Response.Cookies.Append("auth", "secret", cookieOptions); // BAD
40+
}
41+
42+
void CookieIntermediateTrue()
43+
{
44+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
45+
bool v = true;
46+
cookieOptions.HttpOnly = v;
47+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD: should track local data flow
48+
}
49+
50+
void CookieIntermediateTrueInitializer()
51+
{
52+
bool v = true;
53+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions() { HttpOnly = v };
54+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD: should track local data flow
55+
}
56+
57+
void CookieIntermediateFalse()
58+
{
59+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
60+
bool v = false;
61+
cookieOptions.HttpOnly = v;
62+
Response.Cookies.Append("auth", "secret", cookieOptions); // BAD
63+
}
64+
65+
void CookieIntermediateFalseInitializer()
66+
{
67+
bool v = false;
68+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions() { HttpOnly = v };
69+
Response.Cookies.Append("auth", "secret", cookieOptions); // BAD
70+
}
71+
}

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/UseCookiePolicyCallback/HttpOnly.expected

Whitespace-only changes.

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/UseCookiePolicyCallback/HttpOnly.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/UseCookiePolicyCallback/Program.cs

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
using Microsoft.AspNetCore.Builder;
2+
using Microsoft.AspNetCore.Hosting;
3+
using Microsoft.Extensions.DependencyInjection;
4+
using Microsoft.AspNetCore.Http;
5+
6+
public class MyController : Microsoft.AspNetCore.Mvc.Controller
7+
{
8+
public void CookieDefault()
9+
{
10+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
11+
cookieOptions.HttpOnly = false;
12+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD: HttpOnly is set in callback
13+
}
14+
}
15+
16+
public class Startup
17+
{
18+
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
19+
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
20+
{
21+
app.UseCookiePolicy();
22+
}
23+
24+
public void ConfigureServices(IServiceCollection services)
25+
{
26+
services.Configure<CookiePolicyOptions>(options =>
27+
{
28+
options.OnAppendCookie = cookieContext => SetCookies(cookieContext.CookieOptions);
29+
});
30+
}
31+
32+
private void SetCookies(CookieOptions options)
33+
{
34+
options.Secure = true;
35+
options.HttpOnly = true;
36+
}
37+
}

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseAspNetCore/options

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
3+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseSystemWeb/HttpOnly.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| Program.cs:23:27:23:31 | false | Cookie attribute 'HttpOnly' is not set to true. |
2+
| Program.cs:28:74:28:78 | false | Cookie attribute 'HttpOnly' is not set to true. |
3+
| Program.cs:48:27:48:27 | access to local variable v | Cookie attribute 'HttpOnly' is not set to true. |
4+
| Program.cs:54:74:54:74 | access to local variable v | Cookie attribute 'HttpOnly' is not set to true. |

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseSystemWeb/HttpOnly.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseSystemWeb/Program.cs

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
class Program
2+
{
3+
void CookieDirectTrue()
4+
{
5+
var cookie = new System.Web.HttpCookie("sessionID");
6+
cookie.HttpOnly = true; // GOOD
7+
}
8+
9+
void CookieDirectTrueInitializer()
10+
{
11+
var cookie = new System.Web.HttpCookie("sessionID") { HttpOnly = true }; // GOOD
12+
}
13+
14+
void CookieForgeryDirectFalse()
15+
{
16+
var cookie = new System.Web.HttpCookie("antiforgerytoken");
17+
cookie.HttpOnly = false; // GOOD: not an auth cookie
18+
}
19+
20+
void CookieDirectFalse()
21+
{
22+
var cookie = new System.Web.HttpCookie("sessionID");
23+
cookie.HttpOnly = false; // BAD
24+
}
25+
26+
void CookieDirectFalseInitializer()
27+
{
28+
var cookie = new System.Web.HttpCookie("sessionID") { HttpOnly = false }; // BAD
29+
}
30+
31+
void CookieIntermediateTrue()
32+
{
33+
var cookie = new System.Web.HttpCookie("sessionID");
34+
bool v = true;
35+
cookie.HttpOnly = v; // GOOD: should track local data flow
36+
}
37+
38+
void CookieIntermediateTrueInitializer()
39+
{
40+
bool v = true;
41+
var cookie = new System.Web.HttpCookie("sessionID") { HttpOnly = v }; // GOOD: should track local data flow
42+
}
43+
44+
void CookieIntermediateFalse()
45+
{
46+
var cookie = new System.Web.HttpCookie("sessionID");
47+
bool v = false;
48+
cookie.HttpOnly = v; // BAD
49+
}
50+
51+
void CookieIntermediateFalseInitializer()
52+
{
53+
bool v = false;
54+
var cookie = new System.Web.HttpCookie("sessionID") { HttpOnly = v }; // BAD
55+
}
56+
}

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseSystemWeb/Web.config

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<configuration>
3+
<system.web>
4+
<httpCookies />
5+
</system.web>
6+
</configuration>

‎csharp/test/security/CWE-1004/CookieHttpOnlyFalseSystemWeb/options

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
3+
semmle-extractor-options: ${testdir}/../../../../resources/stubs/System.Web.cs

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/NoPolicy/HttpOnly.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| Program.cs:5:9:5:49 | call to method Append | Cookie attribute 'HttpOnly' is not set to true. |
2+
| Program.cs:15:29:15:73 | object creation of type CookieOptions | Cookie attribute 'HttpOnly' is not set to true. |

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/NoPolicy/HttpOnly.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/NoPolicy/Program.cs

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
public class MyController : Microsoft.AspNetCore.Mvc.Controller
2+
{
3+
public void CookieDefault()
4+
{
5+
Response.Cookies.Append("auth", "secret"); // BAD: HttpOnly is set to false by default
6+
}
7+
8+
public void CookieDefaultForgery()
9+
{
10+
Response.Cookies.Append("antiforgerytoken", "secret"); // GOOD: not an auth cookie
11+
}
12+
13+
public void CookieDefault2()
14+
{
15+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
16+
Response.Cookies.Append("auth", "secret", cookieOptions); // BAD: HttpOnly is set to false by default
17+
}
18+
19+
public void CookieDelete()
20+
{
21+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
22+
Response.Cookies.Delete("auth", cookieOptions); // GOOD: Delete call
23+
}
24+
25+
void CookieDirectTrue()
26+
{
27+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
28+
cookieOptions.HttpOnly = true;
29+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD
30+
}
31+
32+
void CookieDirectTrueInitializer()
33+
{
34+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions() { HttpOnly = true };
35+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD
36+
}
37+
38+
void CookieIntermediateTrue()
39+
{
40+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
41+
bool v = true;
42+
cookieOptions.HttpOnly = v;
43+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD: should track local data flow
44+
}
45+
46+
void CookieIntermediateTrueInitializer()
47+
{
48+
bool v = true;
49+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions() { HttpOnly = v };
50+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD: should track local data flow
51+
}
52+
}

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/UseCookiePolicyAlways/HttpOnly.expected

Whitespace-only changes.

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/UseCookiePolicyAlways/HttpOnly.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/UseCookiePolicyAlways/Program.cs

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
using Microsoft.AspNetCore.Builder;
2+
using Microsoft.AspNetCore.Hosting;
3+
4+
public class MyController : Microsoft.AspNetCore.Mvc.Controller
5+
{
6+
public void CookieDefault()
7+
{
8+
Response.Cookies.Append("auth", "secret"); // GOOD: HttpOnly is set in policy
9+
}
10+
11+
public void CookieDefault2()
12+
{
13+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
14+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD: HttpOnly is set in policy
15+
}
16+
}
17+
18+
public class Startup
19+
{
20+
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
21+
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
22+
{
23+
app.UseCookiePolicy(new CookiePolicyOptions() { HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.Always});
24+
}
25+
}

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/UseCookiePolicyCallback/HttpOnly.expected

Whitespace-only changes.

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/UseCookiePolicyCallback/HttpOnly.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/UseCookiePolicyCallback/Program.cs

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
using Microsoft.AspNetCore.Builder;
2+
using Microsoft.AspNetCore.Hosting;
3+
using Microsoft.Extensions.DependencyInjection;
4+
using Microsoft.AspNetCore.Http;
5+
6+
public class MyController : Microsoft.AspNetCore.Mvc.Controller
7+
{
8+
public void CookieDefault()
9+
{
10+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
11+
Response.Cookies.Append("auth", "secret", cookieOptions); // GOOD: HttpOnly is set in callback
12+
}
13+
}
14+
15+
public class Startup
16+
{
17+
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
18+
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
19+
{
20+
app.UseCookiePolicy();
21+
}
22+
23+
public void ConfigureServices(IServiceCollection services)
24+
{
25+
services.Configure<CookiePolicyOptions>(options =>
26+
{
27+
options.OnAppendCookie = cookieContext => SetCookies(cookieContext.CookieOptions);
28+
});
29+
}
30+
31+
private void SetCookies(CookieOptions options)
32+
{
33+
options.Secure = true;
34+
options.HttpOnly = true;
35+
}
36+
}

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/UseCookiePolicyNone/HttpOnly.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| Program.cs:8:9:8:49 | call to method Append | Cookie attribute 'HttpOnly' is not set to true. |
2+
| Program.cs:13:29:13:73 | object creation of type CookieOptions | Cookie attribute 'HttpOnly' is not set to true. |

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/UseCookiePolicyNone/HttpOnly.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/UseCookiePolicyNone/Program.cs

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
using Microsoft.AspNetCore.Builder;
2+
using Microsoft.AspNetCore.Hosting;
3+
4+
public class MyController : Microsoft.AspNetCore.Mvc.Controller
5+
{
6+
public void CookieDefault()
7+
{
8+
Response.Cookies.Append("auth", "secret"); // Bad: HttpOnly policy set to None
9+
}
10+
11+
public void CookieDefault2()
12+
{
13+
var cookieOptions = new Microsoft.AspNetCore.Http.CookieOptions();
14+
Response.Cookies.Append("auth", "secret", cookieOptions); // Bad: HttpOnly policy set to None
15+
}
16+
}
17+
18+
public class Startup
19+
{
20+
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
21+
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
22+
{
23+
app.UseCookiePolicy(new CookiePolicyOptions() { HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.None });
24+
}
25+
}

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlyAspNetCore/options

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
3+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlySystemWeb/ConfigEmpty/HttpOnly.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| Program.cs:5:22:5:59 | object creation of type HttpCookie | Cookie attribute 'HttpOnly' is not set to true. |

‎csharp/test/security/CWE-1004/CookieWithoutHttpOnlySystemWeb/ConfigEmpty/HttpOnly.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

0 commit comments

Comments
 (0)