github / github/codeql

[C#] Taint analysis does not have flow path for non constant field of a class as its source

オープン
#9,569 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る
question
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

I have this simple Test class, where I'm trying to mimic a path problem.
with `Message1` as source and `Console.WriteLine(Message1)` as sink.

```csharp
class Test
{
private const string Message1 = "Test Message 1";
private readonly string Message2 = "Test Message 2";

public void Run()
{
Console.WriteLine(Message1);
Console.WriteLine(Message2);
}
}
```

```codeql
import csharp
import DataFlow::PathGraph

class Source extends DataFlow::Node {
Source() { this.asExpr() instanceof StringLiteral }
}

class WriteLineMethod extends Method {
WriteLineMethod() { this.hasQualifiedName("System.Console.WriteLine") }
}

class Sink extends DataFlow::Node {
Sink() {
exists(MethodCall m |
m.getTarget() instanceof WriteLineMethod and
this.asExpr() = m.getArgument(0)
)
}
}

class SimpleConfiguration extends TaintTracking::Configuration {
SimpleConfiguration() { this = "Simple configuration" }

override predicate isSource(DataFlow::Node source) { source instanceof Source }

override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

}

from DataFlow::PathNode source, DataFlow::PathNode sink, SimpleConfiguration cfg
where cfg.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "$@ is used in WriteLine method.", source.getNode(),
"String"

```

Here I did simple taint tracking analysis on above Test class using above query, for const field `private const string Message1 = "Test Message 1";` as `source` and
`Console.WriteLine(Message1);` as `sink` i'm getting correct result, But for `non const` field `private readonly string Message2 = "Test Message 2";` it doesn't seem to work.

Did i miss something here? why does taint tracking works for const field or static field in static class but not for instance field?

[![test.ql result][1]][1]

[1]: https://i.stack.imgur.com/L4HmN.png

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。