Skip to content

C#: Sources and sinks for ASP.NET Core#359

Merged
hvitved merged 13 commits into
github:masterfrom
calumgrant:cs/with-stubs
Nov 5, 2018
Merged

C#: Sources and sinks for ASP.NET Core#359
hvitved merged 13 commits into
github:masterfrom
calumgrant:cs/with-stubs

Conversation

@calumgrant

@calumgrant calumgrant commented Oct 24, 2018

Copy link
Copy Markdown
Contributor

This is based on #66, with the following changes:

  1. Added auto-generated stubs for the third-party code.
  2. Fixed other test output.
  3. A small code tidy.
  4. Fixed a performance problem in the RemoteFlowSource CP found when testing on a large snapshot.

@calumgrant calumgrant added the C# label Oct 24, 2018
@calumgrant calumgrant requested review from hvitved and lcartey October 24, 2018 12:14
@calumgrant calumgrant requested a review from a team as a code owner October 24, 2018 12:14
@calumgrant calumgrant mentioned this pull request Oct 24, 2018
Closed
hvitved
hvitved requested changes Oct 30, 2018
View reviewed changes

@hvitved hvitved left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really great to finally have ASP.NET Core definitions. There are quite a few whitespace/indentation issues, perhaps you could try to apply the new QL autoformatter?

Comment thread csharp/ql/src/semmle/code/csharp/dataflow/flowsources/Remote.qll Outdated
Comment thread csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll
Comment thread csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll Outdated
Comment thread csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll Outdated
Comment thread csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll Outdated
Comment thread ...rp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect.ASPNetClassic/UrlRedirect.qlref Outdated
Comment thread csharp/ql/test/query-tests/Security Features/CWE-079/XSSFlowAspNetCore/XSS.cs Outdated
Comment thread csharp/ql/test/query-tests/Security Features/CWE-079/XSSFlowAspNetCore/XSS.cs Outdated
Comment thread csharp/ql/test/query-tests/Security Features/CWE-079/XSSFlowAspNetCore/XSS.cs
Comment thread csharp/ql/test/query-tests/Security Features/CWE-079/XSSFlowAspNetCore/XSS.cs
Denis Levin and others added 13 commits November 2, 2018 16:45
@calumgrant
cs: Adding sources and sinks for ASPNET.Core
ba9cb5e 
Inintial query checkin.
Note: tests require Nuget packages with ASPNET and ASPNETCore in Packages directory, and won't compile without them.
The packages.config should include this:
  <package id="Microsoft.AspNet.Mvc" version="5.2.3" targetFramework="net461" />
  <package id="Microsoft.AspNet.WebPages" version="3.2.3" targetFramework="net461" />
  <package id="Microsoft.AspNetCore.Antiforgery" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Authorization" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Cors" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Cryptography.Internal" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.DataProtection" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.DataProtection.Abstractions" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Diagnostics" version="1.1.2" targetFramework="net452" />
  <package id="Microsoft.AspNetCore.Diagnostics.Abstractions" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Hosting" version="1.1.3" targetFramework="net452" />
  <package id="Microsoft.AspNetCore.Hosting.Abstractions" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Hosting.Server.Abstractions" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Html.Abstractions" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Http" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Http.Abstractions" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Http.Extensions" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Http.Features" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.HttpOverrides" version="1.1.2" targetFramework="net452" />
  <package id="Microsoft.AspNetCore.JsonPatch" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Localization" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.Abstractions" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.ApiExplorer" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.Core" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.Cors" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.DataAnnotations" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.Formatters.Json" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.Localization" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.Razor" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.Razor.Host" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.TagHelpers" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Mvc.ViewFeatures" version="1.1.3" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Razor" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Razor.Runtime" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.ResponseCaching" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.ResponseCaching.Abstractions" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.ResponseCompression" version="1.0.2" targetFramework="net452" />
  <package id="Microsoft.AspNetCore.Rewrite" version="1.0.2" targetFramework="net452" />
  <package id="Microsoft.AspNetCore.Routing" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Routing.Abstractions" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.AspNetCore.Server.Kestrel" version="1.1.2" targetFramework="net452" />
  <package id="Microsoft.AspNetCore.Server.Kestrel.Https" version="1.1.2" targetFramework="net452" />
  <package id="Microsoft.AspNetCore.Server.WebListener" version="1.1.4" targetFramework="net452" />
  <package id="Microsoft.AspNetCore.StaticFiles" version="1.1.2" targetFramework="net452" />
  <package id="Microsoft.AspNetCore.WebUtilities" version="1.1.2" targetFramework="net451" />
  <package id="Microsoft.Extensions.DependencyInjection.Abstractions" version="1.1.1" targetFramework="net451" />
  <package id="Microsoft.Extensions.Primitives" version="2.1.0" targetFramework="net451" />
  <package id="Microsoft.NETCore.App" version="2.0.0" />
  <package id="Microsoft.AspNetCore.Mvc" version="2.1.0" />
  <package id="Microsoft.AspNetCore.Mvc.Core" version="2.1.0" />
  <package id="Microsoft.AspNetCore.Mvc.Abstractions" version="2.1.0" />
  <package id="Microsoft.AspNetCore.Http.Extensions" version="2.1.0" />
  <package id="Microsoft.AspNetCore.Http.Abstractions" version="2.1.0" />
  <package id="Microsoft.AspNetCore.Http.Features" version="2.1.0" />
@calumgrant
C#: Add auto-generated stubs.
8b8d2f9
@calumgrant
C#: Stubs for XSSFlowASPNetCore test.
4655aca
@calumgrant
C#: qltest stubs for UrlRedirect.ASPNETCore
d6e6ae6
@calumgrant
C#: Move test into subdirectory.
697e66e
@calumgrant
C#: Tidy up tests.
2090d69
@calumgrant
C#: Tidy up code and fix performance of remote flow sources.
62fb693
@calumgrant
C#: Tidy up whitespace.
aff47c9
@calumgrant
C#: Update analysis change notes.
13f0a40
@calumgrant
C#: Address review comments.
ae96b34
@calumgrant
C#: Merge tests.
7fa442d
@calumgrant
C#: Mark false-negatives.
29df7f5
@calumgrant
C#: Add missing file.
c003150
@hvitved hvitved merged commit 2846d80 into github:master Nov 5, 2018
aibaars pushed a commit that referenced this pull request Oct 20, 2021
@nickrolfe
Merge pull request #359 from github/explicit_this
1920cd1 
Add explicit `this` qualifiers in generated code
smowton pushed a commit to smowton/codeql that referenced this pull request Apr 16, 2022
@igfoo
Merge pull request github#359 from github/igfoo/upgrade
bab3322 
Java: Add an upgrade script
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hvitved hvitved hvitved approved these changes
@lcartey lcartey Awaiting requested review from lcartey

Assignees

No one assigned

Labels

C#

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@calumgrant @hvitved