Skip to content

Commit 43bc3e5

Browse files
michaelnebelmichaelnebel
authored
Merge pull request #17911 from michaelnebel/csharp/deprecateexperimental
C#: Deprecate experimental queries.
2 parents ab9ab0e + 9356295 commit 43bc3e5

25 files changed

+297
-233
lines changed

‎csharp/ql/src/change-notes/2024-11-05-experimental-queries.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* All *experimental* queries have been deprecated. The queries are instead available as part of the *default* query suite in [CodeQL-Community-Packs](https://github.com/GitHubSecurityLab/CodeQL-Community-Packs).

‎csharp/ql/src/experimental/CWE-099/TaintedWebClient.ql‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,16 @@
1515
*/
1616

1717
import csharp
18-
import TaintedWebClientLib
19-
import TaintedWebClient::PathGraph
18+
deprecated import TaintedWebClientLib
19+
deprecated import TaintedWebClient::PathGraph
2020

21-
from TaintedWebClient::PathNode source, TaintedWebClient::PathNode sink
22-
where TaintedWebClient::flowPath(source, sink)
23-
select sink.getNode(), source, sink, "A method of WebClient depepends on a $@.", source.getNode(),
24-
"user-provided value"
21+
deprecated query predicate problems(
22+
DataFlow::Node sinkNode, TaintedWebClient::PathNode source, TaintedWebClient::PathNode sink,
23+
string message1, DataFlow::Node sourceNode, string message2
24+
) {
25+
TaintedWebClient::flowPath(source, sink) and
26+
sinkNode = sink.getNode() and
27+
message1 = "A method of WebClient depepends on a $@." and
28+
sourceNode = source.getNode() and
29+
message2 = "user-provided value"
30+
}

‎csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
deprecated module;
2+
13
import csharp
24
import semmle.code.csharp.frameworks.system.Net
35
import semmle.code.csharp.frameworks.System

‎csharp/ql/src/experimental/CWE-918/RequestForgery.ql‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,16 @@
1111
*/
1212

1313
import csharp
14-
import RequestForgery::RequestForgery
15-
import RequestForgeryFlow::PathGraph
14+
deprecated import RequestForgery::RequestForgery
15+
deprecated import RequestForgeryFlow::PathGraph
1616

17-
from RequestForgeryFlow::PathNode source, RequestForgeryFlow::PathNode sink
18-
where RequestForgeryFlow::flowPath(source, sink)
19-
select sink.getNode(), source, sink, "The URL of this request depends on a $@.", source.getNode(),
20-
"user-provided value"
17+
deprecated query predicate problems(
18+
DataFlow::Node sinkNode, RequestForgeryFlow::PathNode source, RequestForgeryFlow::PathNode sink,
19+
string message1, DataFlow::Node sourceNode, string message2
20+
) {
21+
RequestForgeryFlow::flowPath(source, sink) and
22+
sinkNode = sink.getNode() and
23+
message1 = "The URL of this request depends on a $@." and
24+
sourceNode = source.getNode() and
25+
message2 = "user-provided value"
26+
}

‎csharp/ql/src/experimental/CWE-918/RequestForgery.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
deprecated module;
2+
13
import csharp
24

35
module RequestForgery {

‎csharp/ql/src/experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql‎

Lines changed: 76 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -17,89 +17,91 @@ import csharp
1717
import semmle.code.asp.WebConfig
1818
import semmle.code.csharp.frameworks.system.Web
1919
import semmle.code.csharp.frameworks.microsoft.AspNetCore
20-
import experimental.dataflow.flowsources.AuthCookie
20+
deprecated import experimental.dataflow.flowsources.AuthCookie
2121

22-
from Expr httpOnlySink
23-
where
24-
exists(Assignment a, Expr val |
25-
httpOnlySink = a.getRValue() and
26-
val.getValue() = "false" and
27-
(
28-
exists(ObjectCreation oc |
29-
getAValueForProp(oc, a, "HttpOnly") = val and
30-
(
31-
oc.getType() instanceof SystemWebHttpCookie and
32-
isCookieWithSensitiveName(oc.getArgument(0))
33-
or
34-
exists(MethodCall mc, MicrosoftAspNetCoreHttpResponseCookies iResponse |
35-
oc.getType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
36-
iResponse.getAppendMethod() = mc.getTarget() and
37-
isCookieWithSensitiveName(mc.getArgument(0)) and
38-
// there is no callback `OnAppendCookie` that sets `HttpOnly` to true
39-
not OnAppendCookieHttpOnlyTracking::flowTo(_) and
40-
// Passed as third argument to `IResponseCookies.Append`
41-
exists(DataFlow::Node creation, DataFlow::Node append |
42-
CookieOptionsTracking::flow(creation, append) and
43-
creation.asExpr() = oc and
44-
append.asExpr() = mc.getArgument(2)
22+
deprecated query predicate problems(Expr httpOnlySink, string message) {
23+
(
24+
exists(Assignment a, Expr val |
25+
httpOnlySink = a.getRValue() and
26+
val.getValue() = "false" and
27+
(
28+
exists(ObjectCreation oc |
29+
getAValueForProp(oc, a, "HttpOnly") = val and
30+
(
31+
oc.getType() instanceof SystemWebHttpCookie and
32+
isCookieWithSensitiveName(oc.getArgument(0))
33+
or
34+
exists(MethodCall mc, MicrosoftAspNetCoreHttpResponseCookies iResponse |
35+
oc.getType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
36+
iResponse.getAppendMethod() = mc.getTarget() and
37+
isCookieWithSensitiveName(mc.getArgument(0)) and
38+
// there is no callback `OnAppendCookie` that sets `HttpOnly` to true
39+
not OnAppendCookieHttpOnlyTracking::flowTo(_) and
40+
// Passed as third argument to `IResponseCookies.Append`
41+
exists(DataFlow::Node creation, DataFlow::Node append |
42+
CookieOptionsTracking::flow(creation, append) and
43+
creation.asExpr() = oc and
44+
append.asExpr() = mc.getArgument(2)
45+
)
4546
)
4647
)
4748
)
48-
)
49-
or
50-
exists(PropertyWrite pw |
51-
(
52-
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreHttpCookieBuilder or
53-
pw.getProperty().getDeclaringType() instanceof
54-
MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
55-
) and
56-
pw.getProperty().getName() = "HttpOnly" and
57-
a.getLValue() = pw and
58-
DataFlow::localExprFlow(val, a.getRValue())
49+
or
50+
exists(PropertyWrite pw |
51+
(
52+
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreHttpCookieBuilder or
53+
pw.getProperty().getDeclaringType() instanceof
54+
MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
55+
) and
56+
pw.getProperty().getName() = "HttpOnly" and
57+
a.getLValue() = pw and
58+
DataFlow::localExprFlow(val, a.getRValue())
59+
)
5960
)
6061
)
61-
)
62-
or
63-
exists(Call c |
64-
httpOnlySink = c and
65-
(
66-
exists(MicrosoftAspNetCoreHttpResponseCookies iResponse, MethodCall mc |
67-
// default is not configured or is not set to `Always`
68-
not getAValueForCookiePolicyProp("HttpOnly").getValue() = "1" and
69-
// there is no callback `OnAppendCookie` that sets `HttpOnly` to true
70-
not OnAppendCookieHttpOnlyTracking::flowTo(_) and
71-
iResponse.getAppendMethod() = mc.getTarget() and
72-
isCookieWithSensitiveName(mc.getArgument(0)) and
73-
(
74-
// `HttpOnly` property in `CookieOptions` passed to IResponseCookies.Append(...) wasn't set
75-
exists(ObjectCreation oc |
76-
oc = c and
77-
oc.getType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
78-
not isPropertySet(oc, "HttpOnly") and
79-
exists(DataFlow::Node creation |
80-
CookieOptionsTracking::flow(creation, _) and
81-
creation.asExpr() = oc
62+
or
63+
exists(Call c |
64+
httpOnlySink = c and
65+
(
66+
exists(MicrosoftAspNetCoreHttpResponseCookies iResponse, MethodCall mc |
67+
// default is not configured or is not set to `Always`
68+
not getAValueForCookiePolicyProp("HttpOnly").getValue() = "1" and
69+
// there is no callback `OnAppendCookie` that sets `HttpOnly` to true
70+
not OnAppendCookieHttpOnlyTracking::flowTo(_) and
71+
iResponse.getAppendMethod() = mc.getTarget() and
72+
isCookieWithSensitiveName(mc.getArgument(0)) and
73+
(
74+
// `HttpOnly` property in `CookieOptions` passed to IResponseCookies.Append(...) wasn't set
75+
exists(ObjectCreation oc |
76+
oc = c and
77+
oc.getType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
78+
not isPropertySet(oc, "HttpOnly") and
79+
exists(DataFlow::Node creation |
80+
CookieOptionsTracking::flow(creation, _) and
81+
creation.asExpr() = oc
82+
)
8283
)
84+
or
85+
// IResponseCookies.Append(String, String) was called, `HttpOnly` is set to `false` by default
86+
mc = c and
87+
mc.getNumberOfArguments() < 3
8388
)
84-
or
85-
// IResponseCookies.Append(String, String) was called, `HttpOnly` is set to `false` by default
86-
mc = c and
87-
mc.getNumberOfArguments() < 3
8889
)
89-
)
90-
or
91-
exists(ObjectCreation oc |
92-
oc = c and
93-
oc.getType() instanceof SystemWebHttpCookie and
94-
isCookieWithSensitiveName(oc.getArgument(0)) and
95-
// the property wasn't explicitly set, so a default value from config is used
96-
not isPropertySet(oc, "HttpOnly") and
97-
// the default in config is not set to `true`
98-
not exists(XmlElement element |
99-
element instanceof HttpCookiesElement and
100-
element.(HttpCookiesElement).isHttpOnlyCookies()
90+
or
91+
exists(ObjectCreation oc |
92+
oc = c and
93+
oc.getType() instanceof SystemWebHttpCookie and
94+
isCookieWithSensitiveName(oc.getArgument(0)) and
95+
// the property wasn't explicitly set, so a default value from config is used
96+
not isPropertySet(oc, "HttpOnly") and
97+
// the default in config is not set to `true`
98+
not exists(XmlElement element |
99+
element instanceof HttpCookiesElement and
100+
element.(HttpCookiesElement).isHttpOnlyCookies()
101+
)
101102
)
102103
)
103104
)
104-
)
105-
select httpOnlySink, "Cookie attribute 'HttpOnly' is not set to true."
105+
) and
106+
message = "Cookie attribute 'HttpOnly' is not set to true."
107+
}

‎csharp/ql/src/experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -68,15 +68,14 @@ predicate isExprAnAccessToSafeClientSideEncryptionVersionValue(Expr e) {
6868
)
6969
}
7070

71-
from Expr e, Class c, Assembly asm
72-
where
73-
asm = c.getLocation() and
74-
(
71+
deprecated query predicate problems(Expr e, string message) {
72+
exists(Class c, Assembly asm | asm = c.getLocation() |
7573
exists(Expr e2 |
7674
isCreatingAzureClientSideEncryptionObject(e, c, e2) and
7775
not isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(e2, asm)
7876
)
7977
or
8078
isCreatingOutdatedAzureClientSideEncryptionObject(e, c)
81-
)
82-
select e, "Unsafe usage of v1 version of Azure Storage client-side encryption."
79+
) and
80+
message = "Unsafe usage of v1 version of Azure Storage client-side encryption."
81+
}

0 commit comments

Comments
 (0)