Skip to content

Commit c5728b2

Browse files
michaelnebelmichaelnebel
authored
Merge pull request #7389 from michaelnebel/csharp-mad-io
C#: Convert flow summaries to CSV for System.IO.*
2 parents 80b9ccf + b921fc6 commit c5728b2

File tree

6 files changed

+194
-205
lines changed

6 files changed

+194
-205
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ private module Frameworks {
9999
private import semmle.code.csharp.frameworks.system.web.ui.WebControls
100100
private import semmle.code.csharp.frameworks.JsonNET
101101
private import semmle.code.csharp.frameworks.system.IO
102+
private import semmle.code.csharp.frameworks.system.io.Compression
102103
}
103104

104105
/**

‎csharp/ql/lib/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll

Lines changed: 0 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@ import csharp
66
private import semmle.code.csharp.frameworks.System
77
private import semmle.code.csharp.frameworks.system.Collections
88
private import semmle.code.csharp.frameworks.system.collections.Generic
9-
private import semmle.code.csharp.frameworks.system.IO
10-
private import semmle.code.csharp.frameworks.system.io.Compression
119
private import semmle.code.csharp.frameworks.system.linq.Expressions
1210
private import semmle.code.csharp.frameworks.system.Net
1311
private import semmle.code.csharp.frameworks.system.Text
@@ -1779,74 +1777,6 @@ library class SystemTextEncodingFlow extends LibraryTypeDataFlow, SystemTextEnco
17791777
}
17801778
}
17811779

1782-
/** Data flow for `System.IO.MemoryStream`. */
1783-
library class SystemIOMemoryStreamFlow extends LibraryTypeDataFlow, SystemIOMemoryStreamClass {
1784-
override predicate callableFlow(
1785-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
1786-
boolean preservesValue
1787-
) {
1788-
(
1789-
this.constructorFlow(source, sink, c)
1790-
or
1791-
c = this.getToArrayMethod().getAnOverrider*() and
1792-
source = TCallableFlowSourceQualifier() and
1793-
sink = TCallableFlowSinkReturn()
1794-
) and
1795-
preservesValue = false
1796-
}
1797-
1798-
private predicate constructorFlow(CallableFlowSource source, CallableFlowSink sink, Constructor c) {
1799-
c = this.getAMember() and
1800-
c.getParameter(0).getType().(ArrayType).getElementType() instanceof ByteType and
1801-
source = TCallableFlowSourceArg(0) and
1802-
sink = TCallableFlowSinkReturn()
1803-
}
1804-
}
1805-
1806-
/** Data flow for `System.IO.Stream`. */
1807-
class SystemIOStreamFlow extends LibraryTypeDataFlow, SystemIOStreamClass {
1808-
override predicate callableFlow(
1809-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
1810-
boolean preservesValue
1811-
) {
1812-
(
1813-
c = this.getAReadMethod().getAnOverrider*() and
1814-
c.getParameter(0).getType().(ArrayType).getElementType() instanceof ByteType and
1815-
sink = TCallableFlowSinkArg(0) and
1816-
source = TCallableFlowSourceQualifier()
1817-
or
1818-
c = this.getAWriteMethod().getAnOverrider*() and
1819-
c.getParameter(0).getType().(ArrayType).getElementType() instanceof ByteType and
1820-
source = TCallableFlowSourceArg(0) and
1821-
sink = TCallableFlowSinkQualifier()
1822-
or
1823-
c = any(Method m | m = this.getAMethod() and m.getName().matches("CopyTo%")).getAnOverrider*() and
1824-
c.getParameter(0).getType() instanceof SystemIOStreamClass and
1825-
source = TCallableFlowSourceQualifier() and
1826-
sink = TCallableFlowSinkArg(0)
1827-
) and
1828-
preservesValue = false
1829-
}
1830-
}
1831-
1832-
/** Data flow for `System.IO.Compression.DeflateStream`. */
1833-
class SystemIOCompressionDeflateStreamFlow extends LibraryTypeDataFlow,
1834-
SystemIOCompressionDeflateStream {
1835-
override predicate callableFlow(
1836-
CallableFlowSource source, CallableFlowSink sink, SourceDeclarationCallable c,
1837-
boolean preservesValue
1838-
) {
1839-
this.constructorFlow(source, sink, c) and
1840-
preservesValue = false
1841-
}
1842-
1843-
private predicate constructorFlow(CallableFlowSource source, CallableFlowSink sink, Constructor c) {
1844-
c = this.getAMember() and
1845-
source = TCallableFlowSourceArg(0) and
1846-
sink = TCallableFlowSinkReturn()
1847-
}
1848-
}
1849-
18501780
/** Data flow for `System.Xml.XmlReader`. */
18511781
class SystemXmlXmlReaderFlow extends LibraryTypeDataFlow, SystemXmlXmlReaderClass {
18521782
override predicate callableFlow(
@@ -1908,31 +1838,6 @@ class SystemXmlXmlNamedNodeMapFlow extends LibraryTypeDataFlow, SystemXmlXmlName
19081838
}
19091839
}
19101840

1911-
/** Data flow for `System.IO.Path`. */
1912-
class SystemIOPathFlow extends LibraryTypeDataFlow, SystemIOPathClass {
1913-
override predicate callableFlow(
1914-
CallableFlowSource source, AccessPath sourceAp, CallableFlowSink sink, AccessPath sinkAp,
1915-
SourceDeclarationCallable c, boolean preservesValue
1916-
) {
1917-
c = this.getAMethod("Combine") and
1918-
source = getFlowSourceArg(c, _, sourceAp) and
1919-
sink = TCallableFlowSinkReturn() and
1920-
sinkAp = AccessPath::empty() and
1921-
preservesValue = false
1922-
or
1923-
exists(Parameter p |
1924-
c = this.getAMethod() and
1925-
c.getName().matches("Get%") and
1926-
p = c.getAParameter() and
1927-
p.hasName("path") and
1928-
source = getFlowSourceArg(c, p.getPosition(), sourceAp) and
1929-
sink = TCallableFlowSinkReturn() and
1930-
sinkAp = AccessPath::empty() and
1931-
preservesValue = false
1932-
)
1933-
}
1934-
}
1935-
19361841
/**
19371842
* Custom flow through `StringValues` library class.
19381843
*/

‎csharp/ql/lib/semmle/code/csharp/frameworks/system/IO.qll

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,38 @@ class SystemIOPathClass extends SystemIOClass {
4242
SystemIOPathClass() { this.hasName("Path") }
4343
}
4444

45+
/** Data flow for `System.IO.Path`. */
46+
private class SystemIOPathFlowModelCsv extends SummaryModelCsv {
47+
override predicate row(string row) {
48+
row =
49+
[
50+
"System.IO;Path;false;Combine;(System.String,System.String);;Argument[0];ReturnValue;taint",
51+
"System.IO;Path;false;Combine;(System.String,System.String);;Argument[1];ReturnValue;taint",
52+
"System.IO;Path;false;Combine;(System.String,System.String,System.String);;Argument[0];ReturnValue;taint",
53+
"System.IO;Path;false;Combine;(System.String,System.String,System.String);;Argument[1];ReturnValue;taint",
54+
"System.IO;Path;false;Combine;(System.String,System.String,System.String);;Argument[2];ReturnValue;taint",
55+
"System.IO;Path;false;Combine;(System.String,System.String,System.String,System.String);;Argument[0];ReturnValue;taint",
56+
"System.IO;Path;false;Combine;(System.String,System.String,System.String,System.String);;Argument[1];ReturnValue;taint",
57+
"System.IO;Path;false;Combine;(System.String,System.String,System.String,System.String);;Argument[2];ReturnValue;taint",
58+
"System.IO;Path;false;Combine;(System.String,System.String,System.String,System.String);;Argument[3];ReturnValue;taint",
59+
"System.IO;Path;false;Combine;(System.String[]);;Element of Argument[0];ReturnValue;taint",
60+
"System.IO;Path;false;GetDirectoryName;(System.ReadOnlySpan<System.Char>);;Element of Argument[0];ReturnValue;taint",
61+
"System.IO;Path;false;GetDirectoryName;(System.String);;Argument[0];ReturnValue;taint",
62+
"System.IO;Path;false;GetExtension;(System.ReadOnlySpan<System.Char>);;Element of Argument[0];ReturnValue;taint",
63+
"System.IO;Path;false;GetExtension;(System.String);;Argument[0];ReturnValue;taint",
64+
"System.IO;Path;false;GetFileName;(System.ReadOnlySpan<System.Char>);;Element of Argument[0];ReturnValue;taint",
65+
"System.IO;Path;false;GetFileName;(System.String);;Argument[0];ReturnValue;taint",
66+
"System.IO;Path;false;GetFileNameWithoutExtension;(System.ReadOnlySpan<System.Char>);;Element of Argument[0];ReturnValue;taint",
67+
"System.IO;Path;false;GetFileNameWithoutExtension;(System.String);;Argument[0];ReturnValue;taint",
68+
"System.IO;Path;false;GetFullPath;(System.String);;Argument[0];ReturnValue;taint",
69+
"System.IO;Path;false;GetFullPath;(System.String,System.String);;Argument[0];ReturnValue;taint",
70+
"System.IO;Path;false;GetPathRoot;(System.ReadOnlySpan<System.Char>);;Element of Argument[0];ReturnValue;taint",
71+
"System.IO;Path;false;GetPathRoot;(System.String);;Argument[0];ReturnValue;taint",
72+
"System.IO;Path;false;GetRelativePath;(System.String,System.String);;Argument[1];ReturnValue;taint"
73+
]
74+
}
75+
}
76+
4577
/** Data flow for `System.IO.TextReader`. */
4678
private class SystemIOTextReaderFlowModelCsv extends SummaryModelCsv {
4779
override predicate row(string row) {
@@ -112,6 +144,29 @@ class SystemIOStreamClass extends SystemIOClass {
112144
}
113145
}
114146

147+
/** Data flow for `System.IO.Stream`. */
148+
private class SystemIOStreamFlowModelCsv extends SummaryModelCsv {
149+
override predicate row(string row) {
150+
row =
151+
[
152+
"System.IO;Stream;false;CopyTo;(System.IO.Stream);;Argument[-1];Argument[0];taint",
153+
"System.IO;Stream;false;CopyToAsync;(System.IO.Stream);;Argument[-1];Argument[0];taint",
154+
"System.IO;Stream;false;CopyToAsync;(System.IO.Stream,System.Int32);;Argument[-1];Argument[0];taint",
155+
"System.IO;Stream;false;CopyToAsync;(System.IO.Stream,System.Threading.CancellationToken);;Argument[-1];Argument[0];taint",
156+
"System.IO;Stream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32);;Argument[-1];Element of Argument[0];taint",
157+
"System.IO;Stream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32);;Element of Argument[0];Argument[-1];taint",
158+
"System.IO;Stream;true;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[-1];Element of Argument[0];taint",
159+
"System.IO;Stream;true;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Element of Argument[0];Argument[-1];taint",
160+
"System.IO;Stream;true;CopyTo;(System.IO.Stream,System.Int32);;Argument[-1];Argument[0];taint",
161+
"System.IO;Stream;true;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);;Argument[-1];Argument[0];taint",
162+
"System.IO;Stream;true;Read;(System.Byte[],System.Int32,System.Int32);;Argument[-1];Element of Argument[0];taint",
163+
"System.IO;Stream;true;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[-1];Element of Argument[0];taint",
164+
"System.IO;Stream;true;Write;(System.Byte[],System.Int32,System.Int32);;Element of Argument[0];Argument[-1];taint",
165+
"System.IO;Stream;true;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Element of Argument[0];Argument[-1];taint"
166+
]
167+
}
168+
}
169+
115170
/** The `System.IO.MemoryStream` class. */
116171
class SystemIOMemoryStreamClass extends SystemIOClass {
117172
SystemIOMemoryStreamClass() { this.hasName("MemoryStream") }
@@ -122,3 +177,17 @@ class SystemIOMemoryStreamClass extends SystemIOClass {
122177
result.hasName("ToArray")
123178
}
124179
}
180+
181+
private class SystemIOMemoryStreamFlowModelCsv extends SummaryModelCsv {
182+
override predicate row(string row) {
183+
row =
184+
[
185+
"System.IO;MemoryStream;false;MemoryStream;(System.Byte[]);;Argument[0];ReturnValue;taint",
186+
"System.IO;MemoryStream;false;MemoryStream;(System.Byte[],System.Boolean);;Element of Argument[0];ReturnValue;taint",
187+
"System.IO;MemoryStream;false;MemoryStream;(System.Byte[],System.Int32,System.Int32);;Element of Argument[0];ReturnValue;taint",
188+
"System.IO;MemoryStream;false;MemoryStream;(System.Byte[],System.Int32,System.Int32,System.Boolean);;Element of Argument[0];ReturnValue;taint",
189+
"System.IO;MemoryStream;false;MemoryStream;(System.Byte[],System.Int32,System.Int32,System.Boolean,System.Boolean);;Element of Argument[0];ReturnValue;taint",
190+
"System.IO;MemoryStream;false;ToArray;();;Argument[-1];ReturnValue;taint"
191+
]
192+
}
193+
}

‎csharp/ql/lib/semmle/code/csharp/frameworks/system/io/Compression.qll

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import csharp
44
private import semmle.code.csharp.frameworks.system.IO
5+
private import semmle.code.csharp.dataflow.ExternalFlow
56

67
/** The `System.IO.Compression` namespace. */
78
class SystemIOCompressionNamespace extends Namespace {
@@ -20,3 +21,16 @@ class SystemIOCompressionClass extends Class {
2021
class SystemIOCompressionDeflateStream extends SystemIOCompressionClass {
2122
SystemIOCompressionDeflateStream() { this.hasName("DeflateStream") }
2223
}
24+
25+
/** Data flow for `System.IO.Compression.DeflateStream`. */
26+
private class SystemIOCompressionDeflateStreamFlowModelCsv extends SummaryModelCsv {
27+
override predicate row(string row) {
28+
row =
29+
[
30+
"System.IO.Compression;DeflateStream;false;DeflateStream;(System.IO.Stream,System.IO.Compression.CompressionLevel);;Argument[0];ReturnValue;taint",
31+
"System.IO.Compression;DeflateStream;false;DeflateStream;(System.IO.Stream,System.IO.Compression.CompressionLevel,System.Boolean);;Argument[0];ReturnValue;taint",
32+
"System.IO.Compression;DeflateStream;false;DeflateStream;(System.IO.Stream,System.IO.Compression.CompressionMode);;Argument[0];ReturnValue;taint",
33+
"System.IO.Compression;DeflateStream;false;DeflateStream;(System.IO.Stream,System.IO.Compression.CompressionMode,System.Boolean);;Argument[0];ReturnValue;taint"
34+
]
35+
}
36+
}

0 commit comments

Comments
 (0)