Skip to content

Commit ef0a3d0

Browse files
committed
C#: Add testcase for controller parameter types tainted members.
1 parent 93007f8 commit ef0a3d0

File tree

4 files changed

+37
-0
lines changed

4 files changed

+37
-0
lines changed
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
using Microsoft.AspNetCore.Mvc;
2+
3+
namespace Testing
4+
{
5+
6+
public class ViewModel
7+
{
8+
public string RequestId { get; set; }
9+
10+
public object Query;
11+
}
12+
13+
public class TestController : Controller
14+
{
15+
public object MyAction(ViewModel viewModel)
16+
{
17+
throw null;
18+
}
19+
}
20+
}
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
remoteFlowSourceMembers
2+
| AspRemoteFlowSource.cs:8:23:8:31 | RequestId |
3+
| AspRemoteFlowSource.cs:10:23:10:27 | Query |
4+
remoteFlowSources
5+
| AspRemoteFlowSource.cs:15:42:15:50 | viewModel |
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
import csharp
2+
import semmle.code.csharp.security.dataflow.flowsources.Remote
3+
4+
query predicate remoteFlowSourceMembers(TaintTracking::TaintedMember m) { m.fromSource() }
5+
6+
query predicate remoteFlowSources(AspNetCoreRemoteFlowSource s) {
7+
s.getEnclosingCallable().fromSource()
8+
}
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
3+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/Microsoft.Extensions.Primitives/6.0.0/Microsoft.Extensions.Primitives.csproj
4+
semmle-extractor-options: ${testdir}/../../../../resources/stubs/AspNetCore.cs

0 commit comments

Comments
 (0)