Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

C#: Add sanitizer to cs/log-forging. #17815

Merged
merged 4 commits into from
Oct 22, 2024
Merged

C#: Add sanitizer to cs/log-forging. #17815

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0b8e83d
C#: Add log forging false positive example using ReplaceLineEndings.
michaelnebel Oct 21, 2024
b2b1a3e
C#: Consider string.ReplaceLineEndings(string) as a sanitizer for log…
michaelnebel Oct 21, 2024
191658f
C#: Update expected test output.
michaelnebel Oct 21, 2024
1217c55
C#: Add change note.
michaelnebel Oct 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions csharp/ql/lib/semmle/code/csharp/frameworks/System.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -354,6 +354,14 @@ class SystemStringClass extends StringType {
result.getReturnType() instanceof StringType
}

/** Gets the `ReplaceLineEndings(string) method. */
Method getReplaceLineEndingsMethod() {
result.getDeclaringType() = this and
result.hasName("ReplaceLineEndings") and
result.getNumberOfParameters() = 1 and
result.getReturnType() instanceof StringType
}

/** Gets a `Format(...)` method. */
Method getFormatMethod() {
result.getDeclaringType() = this and
Expand Down
4 changes: 3 additions & 1 deletion csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,9 @@ private class ExternalLoggingExprSink extends Sink {
private class StringReplaceSanitizer extends Sanitizer {
StringReplaceSanitizer() {
exists(Method m |
exists(SystemStringClass s | m = s.getReplaceMethod() or m = s.getRemoveMethod())
exists(SystemStringClass s |
m = s.getReplaceMethod() or m = s.getRemoveMethod() or m = s.getReplaceLineEndingsMethod()
)
or
m = any(SystemTextRegularExpressionsRegexClass r).getAReplaceMethod()
|
Expand Down
4 changes: 4 additions & 0 deletions csharp/ql/src/change-notes/2024-10-21-log-forging-replacelineendings.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* C#: The method `string.ReplaceLineEndings(string)` is now considered a sanitizer for the `cs/log-forging` query.
2 changes: 2 additions & 0 deletions csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ public void ProcessRequest(HttpContext ctx)
logger.Warn(username.Replace(Environment.NewLine, "") + " logged in");
// GOOD: New-lines removed
logger.Warn(username.Replace(Environment.NewLine, "", StringComparison.InvariantCultureIgnoreCase) + " logged in");
// GOOD: New-lines replaced
logger.Warn(username.ReplaceLineEndings("") + " logged in");
// GOOD: Html encoded
logger.Warn(WebUtility.HtmlEncode(username) + " logged in");
// BAD: Logged as-is to TraceSource
Expand Down
12 changes: 6 additions & 6 deletions csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
#select
| LogForging.cs:21:21:21:43 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:21:21:21:43 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
| LogForging.cs:29:50:29:72 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:29:50:29:72 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
| LogForging.cs:33:26:33:33 | access to local variable username | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:33:26:33:33 | access to local variable username | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
| LogForging.cs:31:50:31:72 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:31:50:31:72 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
| LogForging.cs:35:26:35:33 | access to local variable username | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:35:26:35:33 | access to local variable username | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value |
| LogForgingAsp.cs:12:21:12:43 | ... + ... | LogForgingAsp.cs:8:32:8:39 | username : String | LogForgingAsp.cs:12:21:12:43 | ... + ... | This log entry depends on a $@. | LogForgingAsp.cs:8:32:8:39 | username | user-provided value |
edges
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:21:21:21:43 | ... + ... | provenance | |
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:29:50:29:72 | ... + ... | provenance | |
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:33:26:33:33 | access to local variable username | provenance | |
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:31:50:31:72 | ... + ... | provenance | |
| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:35:26:35:33 | access to local variable username | provenance | |
| LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:18:16:18:23 | access to local variable username : String | provenance | |
| LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:18:27:18:61 | access to indexer : String | provenance | MaD:1 |
| LogForging.cs:18:27:18:61 | access to indexer : String | LogForging.cs:18:16:18:23 | access to local variable username : String | provenance | |
Expand All @@ -18,8 +18,8 @@ nodes
| LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
| LogForging.cs:18:27:18:61 | access to indexer : String | semmle.label | access to indexer : String |
| LogForging.cs:21:21:21:43 | ... + ... | semmle.label | ... + ... |
| LogForging.cs:29:50:29:72 | ... + ... | semmle.label | ... + ... |
| LogForging.cs:33:26:33:33 | access to local variable username | semmle.label | access to local variable username |
| LogForging.cs:31:50:31:72 | ... + ... | semmle.label | ... + ... |
| LogForging.cs:35:26:35:33 | access to local variable username | semmle.label | access to local variable username |
| LogForgingAsp.cs:8:32:8:39 | username : String | semmle.label | username : String |
| LogForgingAsp.cs:12:21:12:43 | ... + ... | semmle.label | ... + ... |
subpaths
Loading