Skip to content

Commit f2258aa

Browse files
Sim4n6Sim4n6
authored
Merge branch 'GitHubSecurityLab:main' into main
2 parents f9cd60d + 641f907 commit f2258aa

26 files changed

+488
-252
lines changed

‎csharp/lib/codeql-pack.lock.yml

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,23 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/controlflow:
5-
version: 0.0.3
5+
version: 0.1.16
66
codeql/csharp-all:
7-
version: 0.7.4
7+
version: 0.10.1
88
codeql/dataflow:
9-
version: 0.0.3
9+
version: 0.2.7
1010
codeql/mad:
11-
version: 0.1.4
11+
version: 0.2.16
1212
codeql/ssa:
13-
version: 0.1.4
13+
version: 0.2.16
14+
codeql/threat-models:
15+
version: 0.0.15
1416
codeql/tutorial:
15-
version: 0.1.4
17+
version: 0.2.16
18+
codeql/typetracking:
19+
version: 0.2.16
1620
codeql/util:
17-
version: 0.1.4
21+
version: 0.2.16
22+
codeql/xml:
23+
version: 0.0.3
1824
compiled: false

‎csharp/lib/ghsl/Cryptography.qll

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ module Cryptography {
3636
class CryptoRfc2898DeriveBytes extends HashingAlgorithms {
3737
CryptoRfc2898DeriveBytes() {
3838
exists(ObjectCreation object |
39-
object.getType().getQualifiedName() = "System.Security.Cryptography.Rfc2898DeriveBytes" and
39+
object.getType().hasFullyQualifiedName("System.Security.Cryptography", "Rfc2898DeriveBytes") and
4040
this.asExpr() = object
4141
)
4242
}
@@ -67,7 +67,7 @@ module Cryptography {
6767
exists(ObjectCreation object |
6868
object
6969
.getType()
70-
.hasQualifiedName("System.Security.Cryptography", "DSACryptoServiceProvider") and
70+
.hasFullyQualifiedName("System.Security.Cryptography", "DSACryptoServiceProvider") and
7171
this.asExpr() = object
7272
)
7373
}
@@ -90,7 +90,7 @@ module Cryptography {
9090
exists(ObjectCreation object |
9191
object
9292
.getType()
93-
.hasQualifiedName("System.Security.Cryptography", "RC2CryptoServiceProvider") and
93+
.hasFullyQualifiedName("System.Security.Cryptography", "RC2CryptoServiceProvider") and
9494
this.asExpr() = object
9595
)
9696
}
@@ -113,12 +113,13 @@ module Cryptography {
113113
exists(ObjectCreation object |
114114
object
115115
.getType()
116-
.hasQualifiedName("System.Security.Cryptography", ["RSACryptoServiceProvider", "RSACng"]) and
116+
.hasFullyQualifiedName("System.Security.Cryptography",
117+
["RSACryptoServiceProvider", "RSACng"]) and
117118
this.asExpr() = object
118119
)
119120
or
120121
exists(MethodCall call |
121-
call.getType().hasQualifiedName("System.Security.Cryptography", ["RSA"]) and
122+
call.getType().hasFullyQualifiedName("System.Security.Cryptography", ["RSA"]) and
122123
call.getTarget().hasName("Create") and
123124
this.asExpr() = call
124125
)
@@ -152,7 +153,7 @@ module Cryptography {
152153
exists(ObjectCreation object |
153154
object
154155
.getType()
155-
.hasQualifiedName("System.Security.Cryptography",
156+
.hasFullyQualifiedName("System.Security.Cryptography",
156157
["HMACMD5", "HMACSHA1", "HMACSHA256", "HMACSHA384", "HMACSHA512", "HMACRIPEMD160"]) and
157158
this.asExpr() = object
158159
)

‎csharp/lib/ghsl/HardcodedCredentials.qll

Lines changed: 63 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
private import csharp
32
private import semmle.code.csharp.frameworks.Moq
43
private import semmle.code.csharp.frameworks.System
@@ -25,10 +24,10 @@ abstract class Sanitizer extends DataFlow::ExprNode { }
2524
class NonEmptyStringLiteral extends Source {
2625
NonEmptyStringLiteral() {
2726
exists(StringLiteral literal |
28-
this.getExpr() = literal
29-
and literal.getValue().length() > 1
30-
and literal.fromSource()
31-
and not literal.getValue().matches("${%}")
27+
this.getExpr() = literal and
28+
literal.getValue().length() > 1 and
29+
literal.fromSource() and
30+
not literal.getValue().matches("${%}")
3231
)
3332
}
3433
}
@@ -42,8 +41,8 @@ class ByteArrayLiteral extends Source {
4241
any(ArrayCreation ac |
4342
ac.getArrayType().getElementType() instanceof ByteType and
4443
ac.hasInitializer()
45-
)
46-
and this.getExpr().fromSource()
44+
) and
45+
this.getExpr().fromSource()
4746
}
4847
}
4948

@@ -56,71 +55,70 @@ class CharArrayLiteral extends Source {
5655
any(ArrayCreation ac |
5756
ac.getArrayType().getElementType() instanceof CharType and
5857
ac.hasInitializer()
59-
)
60-
and this.getExpr().fromSource()
58+
) and
59+
this.getExpr().fromSource()
6160
}
6261
}
6362

6463
// taint from a string literal to the constructor of a SymmetricSecurityKey
65-
class LiteralToSecurityKeyConfig extends TaintTracking::Configuration {
66-
LiteralToSecurityKeyConfig() { this = "LiteralToSecurityKeyConfig" }
64+
module LiteralToSecurityKeyConfig implements DataFlow::ConfigSig {
65+
predicate isSource(DataFlow::Node source) { source instanceof Source }
6766

68-
override predicate isSource(DataFlow::Node source) { source instanceof Source }
67+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
6968

70-
override predicate isSink(DataFlow::Node sink) {
71-
sink instanceof Sink
72-
}
73-
74-
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
69+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
7570
}
7671

72+
module LiteralToSecurityKeyFlow = TaintTracking::Global<LiteralToSecurityKeyConfig>;
73+
7774
class SymmetricSecurityKey extends Sink {
7875
SymmetricSecurityKey() {
7976
exists(ObjectCreation securityKey |
8077
securityKey.getAnArgument() = this.getExpr() and
81-
securityKey.getType().getQualifiedName() in [
82-
"Microsoft.IdentityModel.Tokens.SymmetricSecurityKey",
83-
"System.IdentityModel.Tokens.SymmetricSecurityKey"
84-
]
78+
securityKey
79+
.getType()
80+
.hasFullyQualifiedName(["Microsoft.IdentityModel.Tokens", "System.IdentityModel.Tokens"],
81+
"SymmetricSecurityKey")
8582
)
8683
}
8784
}
8885

89-
90-
/**
86+
/**
9187
* A result from a mock interface
9288
* Ignore values that are ultimately returned by mocks, as they don't represent "real" credentials.
93-
*/
89+
*/
9490
class MockSanitizer extends Sanitizer {
9591
MockSanitizer() {
96-
exists(ReturnedByMockObject mock|
97-
mock.getAMemberInitializationValue() = this.asExpr()
98-
or mock.getAnArgument() = this.asExpr()
92+
exists(ReturnedByMockObject mock |
93+
mock.getAMemberInitializationValue() = this.asExpr() or
94+
mock.getAnArgument() = this.asExpr()
9995
)
10096
}
10197
}
10298

103-
/**
99+
/**
104100
* A result from a mock interface
105101
* The function is not itself marked as a mock, but all uses of it are in mocks.
106-
*/
102+
*/
107103
class MockSanitizer2 extends Sanitizer {
108104
MockSanitizer2() {
109105
exists(Method method, ReturnedByMockObject mock |
110106
exists(Call call |
111-
call = method.getACall() and method.getAChild*() = this.asExpr() and
107+
call = method.getACall() and
108+
method.getAChild*() = this.asExpr() and
112109
(
113-
mock.getAMemberInitializationValue().getAChild*() = call
114-
or mock.getAnArgument().getAChild*() = call
110+
mock.getAMemberInitializationValue().getAChild*() = call or
111+
mock.getAnArgument().getAChild*() = call
115112
)
116-
)
117-
and not exists(Call call |
118-
call = method.getACall() and method.getAChild*() = this.asExpr() and
113+
) and
114+
not exists(Call call |
115+
call = method.getACall() and
116+
method.getAChild*() = this.asExpr() and
119117
not (
120-
mock.getAMemberInitializationValue().getAChild*() = call
121-
or mock.getAnArgument().getAChild*() = call
122-
)
118+
mock.getAMemberInitializationValue().getAChild*() = call or
119+
mock.getAnArgument().getAChild*() = call
123120
)
121+
)
124122
)
125123
}
126124
}
@@ -161,11 +159,12 @@ class ToStringSanitizer extends Sanitizer {
161159
class ConfigurationSanitizer extends Sanitizer {
162160
ConfigurationSanitizer() {
163161
exists(Access configuration, MethodCall call |
164-
configuration.getType().getQualifiedName() in [
165-
"Microsoft.Extensions.Configuration.IConfiguration", "Microsoft.Extensions.Configuration.ConfigurationManager"
166-
]
167-
and call.getQualifier() = configuration
168-
and call.getAnArgument() = this.getExpr()
162+
configuration
163+
.getType()
164+
.hasFullyQualifiedName("Microsoft.Extensions.Configuration",
165+
["IConfiguration", "ConfigurationManager"]) and
166+
call.getQualifier() = configuration and
167+
call.getAnArgument() = this.getExpr()
169168
)
170169
}
171170
}
@@ -175,9 +174,14 @@ class ConfigurationSanitizer extends Sanitizer {
175174
*/
176175
class FileSanitizer extends Sanitizer {
177176
FileSanitizer() {
178-
exists(Call c | c.getTarget().hasQualifiedName("System.IO.File", [
179-
"ReadAllBytes", "ReadAllText", "Open", "OpenText", "OpenRead", "OpenHandle", "ReadAllTextAsync", "ReadAllBytesAsync", "ReadAllLines", "ReadAllLinesAsync", "ReadLines", "ReadLinesAsync", "OpenTextAsync"
180-
]) and
177+
exists(Call c |
178+
c.getTarget()
179+
.hasFullyQualifiedName("System.IO.File",
180+
[
181+
"ReadAllBytes", "ReadAllText", "Open", "OpenText", "OpenRead", "OpenHandle",
182+
"ReadAllTextAsync", "ReadAllBytesAsync", "ReadAllLines", "ReadAllLinesAsync",
183+
"ReadLines", "ReadLinesAsync", "OpenTextAsync"
184+
]) and
181185
c.getAnArgument() = this.getExpr()
182186
)
183187
}
@@ -207,7 +211,8 @@ class TestClassSanitizer extends Sanitizer {
207211
*/
208212
class TestNamespaceSanitizer extends Sanitizer {
209213
TestNamespaceSanitizer() {
210-
exists(Namespace n | n.getName().matches(["Test%", "%Test", "%Tests", "Mock%", "%Mocks", "%Mock", "Fake%"]) and
214+
exists(Namespace n |
215+
n.getName().matches(["Test%", "%Test", "%Tests", "Mock%", "%Mocks", "%Mock", "Fake%"]) and
211216
(
212217
this.getExpr() = n.getAClass().getAMethod().getAChild*() or
213218
this.getExpr() = n.getAClass().getAField().getAChild*() or
@@ -222,13 +227,17 @@ class TestNamespaceSanitizer extends Sanitizer {
222227
*/
223228
class DebugSanitizer extends Sanitizer {
224229
DebugSanitizer() {
225-
exists(IfDirective if_d, EndifDirective endif_d, Location if_loc, Location endif_loc, Location loc |
230+
exists(
231+
IfDirective if_d, EndifDirective endif_d, Location if_loc, Location endif_loc, Location loc
232+
|
226233
loc = this.getLocation() and
227-
if_d.getCondition().toString() = "DEBUG" and if_d.getEndifDirective() = endif_d
228-
and if_d.getLocation() = if_loc and endif_d.getLocation() = endif_loc
229-
and loc.getStartLine() > if_loc.getEndLine()
230-
and loc.getEndLine() < endif_loc.getStartLine()
231-
and loc.getFile() = if_loc.getFile()
234+
if_d.getCondition().toString() = "DEBUG" and
235+
if_d.getEndifDirective() = endif_d and
236+
if_d.getLocation() = if_loc and
237+
endif_d.getLocation() = endif_loc and
238+
loc.getStartLine() > if_loc.getEndLine() and
239+
loc.getEndLine() < endif_loc.getStartLine() and
240+
loc.getFile() = if_loc.getFile()
232241
)
233242
}
234-
}
243+
}

‎csharp/lib/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@ library: true
22
name: githubsecuritylab/codeql-csharp-libs
33
version: 0.0.1
44
dependencies:
5-
codeql/csharp-all: '*'
5+
codeql/csharp-all: 0.10.1

‎csharp/src/codeql-pack.lock.yml

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,27 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/controlflow:
5-
version: 0.0.3
5+
version: 0.1.16
66
codeql/csharp-all:
7-
version: 0.7.4
7+
version: 0.10.1
88
codeql/csharp-queries:
9-
version: 0.7.4
9+
version: 0.8.16
1010
codeql/dataflow:
11-
version: 0.0.3
11+
version: 0.2.7
1212
codeql/mad:
13-
version: 0.1.4
13+
version: 0.2.16
1414
codeql/ssa:
15-
version: 0.1.4
15+
version: 0.2.16
1616
codeql/suite-helpers:
17-
version: 0.6.4
17+
version: 0.7.16
18+
codeql/threat-models:
19+
version: 0.0.15
1820
codeql/tutorial:
19-
version: 0.1.4
21+
version: 0.2.16
22+
codeql/typetracking:
23+
version: 0.2.16
2024
codeql/util:
21-
version: 0.1.4
25+
version: 0.2.16
26+
codeql/xml:
27+
version: 0.0.3
2228
compiled: false

0 commit comments

Comments
 (0)