C#: Add SecondOrder SQL injection example, where reading from a file.

michaelnebel · michaelnebel · commit 2b51e0322373 · 2022-08-10T11:08:27.000+02:00
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.cs
@@ -4,10 +4,14 @@
 namespace Test
 {
 
+    using System.Data.SQLite;
+    using System.IO;
+    using System.Text;
+
     class SecondOrderSqlInjection
     {
 
-        public void processRequest()
+        public void ProcessRequest()
         {
             using (SqlConnection connection = new SqlConnection(""))
             {
@@ -23,5 +27,28 @@ public void processRequest()
                 customerReader.Close();
             }
         }
+
+        public void RunSQLFromFile()
+        {
+            using (FileStream fs = new FileStream("myfile.txt", FileMode.Open))
+            {
+                using (StreamReader sr = new StreamReader(fs, Encoding.UTF8))
+                {
+                    var sql = String.Empty;
+                    while ((sql = sr.ReadLine()) != null)
+                    {
+                        sql = sql.Trim();
+                        if (sql.StartsWith("--"))
+                            continue;
+                        using (var connection = new SQLiteConnection(""))
+                        {
+                            var cmd = new SQLiteCommand(sql, connection);
+                            cmd.ExecuteScalar();
+                        }
+                    }
+                }
+            }
+        }
+
     }
 }
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.expected
@@ -1,8 +1,8 @@
 edges
-| SecondOrderSqlInjection.cs:21:119:21:145 | call to method GetString : String | SecondOrderSqlInjection.cs:21:71:21:145 | ... + ... |
+| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... |
 nodes
-| SecondOrderSqlInjection.cs:21:71:21:145 | ... + ... | semmle.label | ... + ... |
-| SecondOrderSqlInjection.cs:21:119:21:145 | call to method GetString : String | semmle.label | call to method GetString : String |
+| SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | semmle.label | ... + ... |
+| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | semmle.label | call to method GetString : String |
 subpaths
 #select
-| SecondOrderSqlInjection.cs:21:71:21:145 | ... + ... | SecondOrderSqlInjection.cs:21:119:21:145 | call to method GetString : String | SecondOrderSqlInjection.cs:21:71:21:145 | ... + ... | $@ flows to here and is used in an SQL query. | SecondOrderSqlInjection.cs:21:119:21:145 | call to method GetString | Stored user-provided value |
+| SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | $@ flows to here and is used in an SQL query. | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString | Stored user-provided value |

Original file line number	Diff line number	Diff line change
`@@ -4,10 +4,14 @@`
`4`	`4`	`namespace Test`
`5`	`5`	`{`
`6`	`6`
	`7`	`+ using System.Data.SQLite;`
	`8`	`+ using System.IO;`
	`9`	`+ using System.Text;`
	`10`	`+`
`7`	`11`	`class SecondOrderSqlInjection`
`8`	`12`	`{`
`9`	`13`
`10`		`- public void processRequest()`
	`14`	`+ public void ProcessRequest()`
`11`	`15`	`{`
`12`	`16`	`using (SqlConnection connection = new SqlConnection(""))`
`13`	`17`	`{`
`@@ -23,5 +27,28 @@ public void processRequest()`
`23`	`27`	`customerReader.Close();`
`24`	`28`	`}`
`25`	`29`	`}`
	`30`	`+`
	`31`	`+ public void RunSQLFromFile()`
	`32`	`+ {`
	`33`	`+ using (FileStream fs = new FileStream("myfile.txt", FileMode.Open))`
	`34`	`+ {`
	`35`	`+ using (StreamReader sr = new StreamReader(fs, Encoding.UTF8))`
	`36`	`+ {`
	`37`	`+ var sql = String.Empty;`
	`38`	`+ while ((sql = sr.ReadLine()) != null)`
	`39`	`+ {`
	`40`	`+ sql = sql.Trim();`
	`41`	`+ if (sql.StartsWith("--"))`
	`42`	`+ continue;`
	`43`	`+ using (var connection = new SQLiteConnection(""))`
	`44`	`+ {`
	`45`	`+ var cmd = new SQLiteCommand(sql, connection);`
	`46`	`+ cmd.ExecuteScalar();`
	`47`	`+ }`
	`48`	`+ }`
	`49`	`+ }`
	`50`	`+ }`
	`51`	`+ }`
	`52`	`+`
`26`	`53`	`}`
`27`	`54`	`}`