C#: Consider FileStreams StoredFlowSources and propagate taint via StreamReader.

Author: michaelnebel

csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

@@ -383,7 +383,7 @@ module CsvValidation {
     or
     exists(string row, string kind | sourceModel(row) |
       kind = row.splitAt(";", 7) and
-      not kind = "local" and
+      not kind = ["local", "file"] and
       msg = "Invalid kind \"" + kind + "\" in source model."
     )
   }

csharp/ql/lib/semmle/code/csharp/frameworks/system/IO.qll

@@ -179,6 +179,7 @@ class SystemIOMemoryStreamClass extends SystemIOClass {
   }
 }
 
+/** Data flow for `System.IO.MemoryStream`. */
 private class SystemIOMemoryStreamFlowModelCsv extends SummaryModelCsv {
   override predicate row(string row) {
     row =
@@ -192,3 +193,17 @@ private class SystemIOMemoryStreamFlowModelCsv extends SummaryModelCsv {
       ]
   }
 }
+
+/** Sources for `System.IO.FileStream`. */
+private class SystemIOFileStreamSourceModelCsv extends SourceModelCsv {
+  override predicate row(string row) {
+    row = "System.IO;FileStream;false;FileStream;;;Argument[Qualifier];file;manual"
+  }
+}
+
+/** Data flow for `System.IO.StreamReader`. */
+private class SystemIOStreamSummaryModelCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row = "System.IO;StreamReader;false;StreamReader;;;Argument[0];Argument[Qualifier];taint;manual"
+  }
+}

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll

@@ -3,6 +3,7 @@
  */
 
 import csharp
+private import semmle.code.csharp.dataflow.ExternalFlow
 private import semmle.code.csharp.frameworks.system.data.Common
 private import semmle.code.csharp.frameworks.system.data.Entity
 private import semmle.code.csharp.frameworks.EntityFramework
@@ -55,3 +56,8 @@ class ORMMappedProperty extends StoredFlowSource {
     this instanceof NHibernate::StoredFlowSource
   }
 }
+
+/** A file stream source is considered a stored flow source. */
+class FileStreamStoredFlowSource extends StoredFlowSource {
+  FileStreamStoredFlowSource() { sourceNode(this, "file") }
+}