Skip to content

Commit 4467faa

Browse files
joefarebrotherjoefarebrother
committed
Add tests for insecure cookie using system.web
1 parent 0b643e1 commit 4467faa

File tree

15 files changed

+105
-24
lines changed

15 files changed

+105
-24
lines changed

‎csharp/ql/test/experimental/Security Features/CWE-614/RequireSSLSystemWeb/FormsTrue/Program.cs‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -4,28 +4,4 @@ void CookieDefault()
44
{
55
var cookie = new System.Web.HttpCookie("cookieName"); // GOOD: requireSSL is set to true in config
66
}
7-
8-
void CookieDirectTrue()
9-
{
10-
var cookie = new System.Web.HttpCookie("cookieName");
11-
cookie.Secure = true; // GOOD
12-
}
13-
14-
void CookieDirectTrueInitializer()
15-
{
16-
var cookie = new System.Web.HttpCookie("cookieName") { Secure = true }; // GOOD
17-
}
18-
19-
void CookieIntermediateTrue()
20-
{
21-
var cookie = new System.Web.HttpCookie("cookieName");
22-
bool v = true;
23-
cookie.Secure = v; // GOOD: should track local data flow
24-
}
25-
26-
void CookieIntermediateTrueInitializer()
27-
{
28-
bool v = true;
29-
var cookie = new System.Web.HttpCookie("cookieName") { Secure = v }; // GOOD: should track local data flow
30-
}
317
}

‎csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLFalse/CookieWithoutSecure.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| Program.cs:5:22:5:60 | object creation of type HttpCookie | Cookie attribute 'Secure' is not set to true. |
2+
| Program.cs:34:22:34:60 | object creation of type HttpCookie | Cookie attribute 'Secure' is not set to true. |
3+
| Program.cs:40:22:40:79 | object creation of type HttpCookie | Cookie attribute 'Secure' is not set to true. |

‎csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLFalse/CookieWithoutSecure.qlref‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
query: Security Features/CWE-614/CookieWithoutSecure.ql
2+
postprocess: utils/test/InlineExpectationsTestQuery.ql

‎csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLFalse/Program.cs‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
class Program
2+
{
3+
void CookieDefault()
4+
{
5+
var cookie = new System.Web.HttpCookie("cookieName"); // $Alert // BAD: requireSSL is set to false by default
6+
}
7+
8+
void CookieDirectTrue()
9+
{
10+
var cookie = new System.Web.HttpCookie("cookieName");
11+
cookie.Secure = true; // GOOD
12+
}
13+
14+
void CookieDirectTrueInitializer()
15+
{
16+
var cookie = new System.Web.HttpCookie("cookieName") { Secure = true }; // GOOD
17+
}
18+
19+
void CookieIntermediateTrue()
20+
{
21+
var cookie = new System.Web.HttpCookie("cookieName");
22+
bool v = true;
23+
cookie.Secure = v; // GOOD: should track local data flow
24+
}
25+
26+
void CookieIntermediateTrueInitializer()
27+
{
28+
bool v = true;
29+
var cookie = new System.Web.HttpCookie("cookieName") { Secure = v }; // GOOD: should track local data flow
30+
}
31+
32+
void CookieDirectFalse()
33+
{
34+
var cookie = new System.Web.HttpCookie("cookieName"); // $Alert
35+
cookie.Secure = false; // BAD
36+
}
37+
38+
void CookieDirectFalseInitializer()
39+
{
40+
var cookie = new System.Web.HttpCookie("cookieName") { Secure = false }; // $Alert // BAD
41+
}
42+
43+
void CookieIntermediateFalse()
44+
{
45+
var cookie = new System.Web.HttpCookie("cookieName"); // $MISSING:Alert
46+
bool v = false;
47+
cookie.Secure = v; // BAD, but not detected
48+
}
49+
50+
void CookieIntermediateFalseInitializer()
51+
{
52+
bool v = false;
53+
var cookie = new System.Web.HttpCookie("cookieName") { Secure = v }; // $MISSING:Alert // BAD, but not detected
54+
}
55+
}

‎csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLFalse/Web.config‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<configuration>
3+
<system.web>
4+
<httpCookies />
5+
</system.web>
6+
</configuration>

‎csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLFalse/options‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
3+
semmle-extractor-options: ${testdir}/../../../../../../resources/stubs/System.Web.cs

‎csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLTrue/FormsTrue/CookieWithoutSecure.expected‎

Whitespace-only changes.

‎csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLTrue/FormsTrue/CookieWithoutSecure.qlref‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
query: Security Features/CWE-614/CookieWithoutSecure.ql
2+
postprocess: utils/test/InlineExpectationsTestQuery.ql

‎csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLTrue/FormsTrue/Program.cs‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
class Program
2+
{
3+
void CookieDefault()
4+
{
5+
var cookie = new System.Web.HttpCookie("cookieName"); // GOOD: requireSSL is set to true in config
6+
}
7+
}

‎csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLTrue/FormsTrue/Web.config‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<configuration>
3+
<system.web>
4+
<authentication>
5+
<forms requireSSL=" True "/>
6+
</authentication>
7+
<httpCookies />
8+
</system.web>
9+
</configuration>

0 commit comments

Comments
 (0)