Skip to content

Commit 504160f

Browse files
michaelnebelmichaelnebel
committed
C#: Update expected file for Sql injection and Second Order sql injection (note that this is already a second order sql injection).
1 parent 5c47ae3 commit 504160f

File tree

2 files changed

+39
-23
lines changed

2 files changed

+39
-23
lines changed

‎csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.expected

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,13 @@ edges
77
| SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String |
88
| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String |
99
| SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql |
10+
| SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | SqlInjectionSqlite.cs:51:59:51:60 | access to local variable fs : FileStream |
11+
| SqlInjectionSqlite.cs:51:42:51:76 | object creation of type StreamReader : StreamReader | SqlInjectionSqlite.cs:54:35:54:36 | access to local variable sr : StreamReader |
12+
| SqlInjectionSqlite.cs:51:59:51:60 | access to local variable fs : FileStream | SqlInjectionSqlite.cs:51:42:51:76 | object creation of type StreamReader : StreamReader |
13+
| SqlInjectionSqlite.cs:54:35:54:36 | access to local variable sr : StreamReader | SqlInjectionSqlite.cs:54:35:54:47 | call to method ReadLine : String |
14+
| SqlInjectionSqlite.cs:54:35:54:47 | call to method ReadLine : String | SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String |
15+
| SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String |
16+
| SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql |
1017
nodes
1118
| SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | semmle.label | ... + ... |
1219
| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | semmle.label | call to method GetString : String |
@@ -18,7 +25,16 @@ nodes
1825
| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | semmle.label | access to local variable sql : String |
1926
| SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | semmle.label | call to method Trim : String |
2027
| SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | semmle.label | access to local variable sql |
28+
| SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | semmle.label | object creation of type FileStream : FileStream |
29+
| SqlInjectionSqlite.cs:51:42:51:76 | object creation of type StreamReader : StreamReader | semmle.label | object creation of type StreamReader : StreamReader |
30+
| SqlInjectionSqlite.cs:51:59:51:60 | access to local variable fs : FileStream | semmle.label | access to local variable fs : FileStream |
31+
| SqlInjectionSqlite.cs:54:35:54:36 | access to local variable sr : StreamReader | semmle.label | access to local variable sr : StreamReader |
32+
| SqlInjectionSqlite.cs:54:35:54:47 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
33+
| SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | semmle.label | access to local variable sql : String |
34+
| SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | semmle.label | call to method Trim : String |
35+
| SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | semmle.label | access to local variable sql |
2136
subpaths
2237
#select
2338
| SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | $@ flows to here and is used in an SQL query. | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString | Stored user-provided value |
2439
| SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | $@ flows to here and is used in an SQL query. | SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream | Stored user-provided value |
40+
| SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | $@ flows to here and is used in an SQL query. | SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream | Stored user-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ edges
1616
| SqlInjectionDapper.cs:57:86:57:94 | access to property Text : String | SqlInjectionDapper.cs:58:42:58:46 | access to local variable query |
1717
| SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | SqlInjectionDapper.cs:67:42:67:46 | access to local variable query |
1818
| SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | SqlInjectionDapper.cs:77:52:77:56 | access to local variable query |
19-
| SqlInjectionSqlite.cs:17:51:17:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:17:51:17:68 | access to property Text |
20-
| SqlInjectionSqlite.cs:22:23:22:71 | object creation of type SQLiteCommand : SQLiteCommand | SqlInjectionSqlite.cs:42:45:42:47 | access to local variable cmd |
21-
| SqlInjectionSqlite.cs:22:41:22:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:22:41:22:58 | access to property Text |
22-
| SqlInjectionSqlite.cs:22:41:22:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:22:41:22:58 | access to property Text : String |
23-
| SqlInjectionSqlite.cs:22:41:22:58 | access to property Text : String | SqlInjectionSqlite.cs:22:23:22:71 | object creation of type SQLiteCommand : SQLiteCommand |
24-
| SqlInjectionSqlite.cs:31:49:31:61 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:31:49:31:66 | access to property Text |
25-
| SqlInjectionSqlite.cs:37:45:37:57 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:37:45:37:62 | access to property Text |
19+
| SqlInjectionSqlite.cs:19:51:19:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:19:51:19:68 | access to property Text |
20+
| SqlInjectionSqlite.cs:24:23:24:71 | object creation of type SQLiteCommand : SQLiteCommand | SqlInjectionSqlite.cs:44:45:44:47 | access to local variable cmd |
21+
| SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:24:41:24:58 | access to property Text |
22+
| SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:24:41:24:58 | access to property Text : String |
23+
| SqlInjectionSqlite.cs:24:41:24:58 | access to property Text : String | SqlInjectionSqlite.cs:24:23:24:71 | object creation of type SQLiteCommand : SQLiteCommand |
24+
| SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:33:49:33:66 | access to property Text |
25+
| SqlInjectionSqlite.cs:39:45:39:57 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:39:45:39:62 | access to property Text |
2626
nodes
2727
| SqlInjection.cs:33:21:33:35 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
2828
| SqlInjection.cs:33:21:33:40 | access to property Text : String | semmle.label | access to property Text : String |
@@ -52,17 +52,17 @@ nodes
5252
| SqlInjectionDapper.cs:67:42:67:46 | access to local variable query | semmle.label | access to local variable query |
5353
| SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | semmle.label | access to property Text : String |
5454
| SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | semmle.label | access to local variable query |
55-
| SqlInjectionSqlite.cs:17:51:17:63 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
56-
| SqlInjectionSqlite.cs:17:51:17:68 | access to property Text | semmle.label | access to property Text |
57-
| SqlInjectionSqlite.cs:22:23:22:71 | object creation of type SQLiteCommand : SQLiteCommand | semmle.label | object creation of type SQLiteCommand : SQLiteCommand |
58-
| SqlInjectionSqlite.cs:22:41:22:53 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
59-
| SqlInjectionSqlite.cs:22:41:22:58 | access to property Text | semmle.label | access to property Text |
60-
| SqlInjectionSqlite.cs:22:41:22:58 | access to property Text : String | semmle.label | access to property Text : String |
61-
| SqlInjectionSqlite.cs:31:49:31:61 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
62-
| SqlInjectionSqlite.cs:31:49:31:66 | access to property Text | semmle.label | access to property Text |
63-
| SqlInjectionSqlite.cs:37:45:37:57 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
64-
| SqlInjectionSqlite.cs:37:45:37:62 | access to property Text | semmle.label | access to property Text |
65-
| SqlInjectionSqlite.cs:42:45:42:47 | access to local variable cmd | semmle.label | access to local variable cmd |
55+
| SqlInjectionSqlite.cs:19:51:19:63 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
56+
| SqlInjectionSqlite.cs:19:51:19:68 | access to property Text | semmle.label | access to property Text |
57+
| SqlInjectionSqlite.cs:24:23:24:71 | object creation of type SQLiteCommand : SQLiteCommand | semmle.label | object creation of type SQLiteCommand : SQLiteCommand |
58+
| SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
59+
| SqlInjectionSqlite.cs:24:41:24:58 | access to property Text | semmle.label | access to property Text |
60+
| SqlInjectionSqlite.cs:24:41:24:58 | access to property Text : String | semmle.label | access to property Text : String |
61+
| SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
62+
| SqlInjectionSqlite.cs:33:49:33:66 | access to property Text | semmle.label | access to property Text |
63+
| SqlInjectionSqlite.cs:39:45:39:57 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
64+
| SqlInjectionSqlite.cs:39:45:39:62 | access to property Text | semmle.label | access to property Text |
65+
| SqlInjectionSqlite.cs:44:45:44:47 | access to local variable cmd | semmle.label | access to local variable cmd |
6666
subpaths
6767
#select
6868
| SqlInjection.cs:34:50:34:55 | access to local variable query1 | SqlInjection.cs:33:21:33:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:34:50:34:55 | access to local variable query1 | Query might include code from $@. | SqlInjection.cs:33:21:33:35 | access to field categoryTextBox : TextBox | this ASP.NET user input |
@@ -78,8 +78,8 @@ subpaths
7878
| SqlInjectionDapper.cs:58:42:58:46 | access to local variable query | SqlInjectionDapper.cs:57:86:57:94 | access to property Text : String | SqlInjectionDapper.cs:58:42:58:46 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:57:86:57:94 | access to property Text : String | this TextBox text |
7979
| SqlInjectionDapper.cs:67:42:67:46 | access to local variable query | SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | SqlInjectionDapper.cs:67:42:67:46 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | this TextBox text |
8080
| SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | this TextBox text |
81-
| SqlInjectionSqlite.cs:17:51:17:68 | access to property Text | SqlInjectionSqlite.cs:17:51:17:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:17:51:17:68 | access to property Text | Query might include code from $@. | SqlInjectionSqlite.cs:17:51:17:63 | access to field untrustedData : TextBox | this ASP.NET user input |
82-
| SqlInjectionSqlite.cs:22:41:22:58 | access to property Text | SqlInjectionSqlite.cs:22:41:22:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:22:41:22:58 | access to property Text | Query might include code from $@. | SqlInjectionSqlite.cs:22:41:22:53 | access to field untrustedData : TextBox | this ASP.NET user input |
83-
| SqlInjectionSqlite.cs:31:49:31:66 | access to property Text | SqlInjectionSqlite.cs:31:49:31:61 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:31:49:31:66 | access to property Text | Query might include code from $@. | SqlInjectionSqlite.cs:31:49:31:61 | access to field untrustedData : TextBox | this ASP.NET user input |
84-
| SqlInjectionSqlite.cs:37:45:37:62 | access to property Text | SqlInjectionSqlite.cs:37:45:37:57 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:37:45:37:62 | access to property Text | Query might include code from $@. | SqlInjectionSqlite.cs:37:45:37:57 | access to field untrustedData : TextBox | this ASP.NET user input |
85-
| SqlInjectionSqlite.cs:42:45:42:47 | access to local variable cmd | SqlInjectionSqlite.cs:22:41:22:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:42:45:42:47 | access to local variable cmd | Query might include code from $@. | SqlInjectionSqlite.cs:22:41:22:53 | access to field untrustedData : TextBox | this ASP.NET user input |
81+
| SqlInjectionSqlite.cs:19:51:19:68 | access to property Text | SqlInjectionSqlite.cs:19:51:19:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:19:51:19:68 | access to property Text | Query might include code from $@. | SqlInjectionSqlite.cs:19:51:19:63 | access to field untrustedData : TextBox | this ASP.NET user input |
82+
| SqlInjectionSqlite.cs:24:41:24:58 | access to property Text | SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:24:41:24:58 | access to property Text | Query might include code from $@. | SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | this ASP.NET user input |
83+
| SqlInjectionSqlite.cs:33:49:33:66 | access to property Text | SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:33:49:33:66 | access to property Text | Query might include code from $@. | SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | this ASP.NET user input |
84+
| SqlInjectionSqlite.cs:39:45:39:62 | access to property Text | SqlInjectionSqlite.cs:39:45:39:57 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:39:45:39:62 | access to property Text | Query might include code from $@. | SqlInjectionSqlite.cs:39:45:39:57 | access to field untrustedData : TextBox | this ASP.NET user input |
85+
| SqlInjectionSqlite.cs:44:45:44:47 | access to local variable cmd | SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:44:45:44:47 | access to local variable cmd | Query might include code from $@. | SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | this ASP.NET user input |

0 commit comments

Comments
 (0)