Skip to content

Commit 9eded70

Browse files
michaelnebelmichaelnebel
committed
C#: Add MaD models for Microsoft.Data.SqlClient.
1 parent 8825428 commit 9eded70

File tree

2 files changed

+55
-7
lines changed

2 files changed

+55
-7
lines changed

‎csharp/ql/lib/ext/Microsoft.Data.SqlClient.model.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/csharp-all
4+
extensible: sinkModel
5+
data:
6+
- ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String)", "", "Argument[0]", "sql-injection", "manual"]
7+
- ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection)", "", "Argument[0]", "sql-injection", "manual"]
8+
- ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection,Microsoft.Data.SqlClient.SqlTransaction)", "", "Argument[0]", "sql-injection", "manual"]
9+
- ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection,Microsoft.Data.SqlClient.SqlTransaction,Microsoft.Data.SqlClient.SqlCommandColumnEncryptionSetting)", "", "Argument[0]", "sql-injection", "manual"]
10+
- ["Microsoft.Data.SqlClient", "SqlDataAdapter", False, "SqlDataAdapter", "(Microsoft.Data.SqlClient.SqlCommand)", "", "Argument[0]", "sql-injection", "manual"]
11+
- ["Microsoft.Data.SqlClient", "SqlDataAdapter", False, "SqlDataAdapter", "(System.String,Microsoft.Data.SqlClient.SqlConnection)", "", "Argument[0]", "sql-injection", "manual"]
12+
- ["Microsoft.Data.SqlClient", "SqlDataAdapter", False, "SqlDataAdapter", "(System.String,System.String)", "", "Argument[0]", "sql-injection", "manual"]
13+
- addsTo:
14+
pack: codeql/csharp-all
15+
extensible: summaryModel
16+
data:
17+
- ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
18+
- ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
19+
- ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection,Microsoft.Data.SqlClient.SqlTransaction)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
20+
- ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection,Microsoft.Data.SqlClient.SqlTransaction,Microsoft.Data.SqlClient.SqlCommandColumnEncryptionSetting)", "", "Argument[0]", "Argument[this]", "taint", "manual"]

‎csharp/ql/test/query-tests/Security Features/CWE-089-2/SqlInjection.expected‎

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,39 @@
11
#select
2+
| SqlInjection.cs:26:42:26:52 | access to local variable queryString | SqlInjection.cs:25:21:25:29 | access to property Text : String | SqlInjection.cs:26:42:26:52 | access to local variable queryString | This query depends on $@. | SqlInjection.cs:25:21:25:29 | access to property Text : String | this TextBox text |
3+
| SqlInjection.cs:27:50:27:52 | access to local variable cmd | SqlInjection.cs:25:21:25:29 | access to property Text : String | SqlInjection.cs:27:50:27:52 | access to local variable cmd | This query depends on $@. | SqlInjection.cs:25:21:25:29 | access to property Text : String | this TextBox text |
4+
| SqlInjection.cs:35:42:35:52 | access to local variable queryString | SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | SqlInjection.cs:35:42:35:52 | access to local variable queryString | This query depends on $@. | SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | this read from stdin |
5+
| SqlInjection.cs:36:50:36:52 | access to local variable cmd | SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | SqlInjection.cs:36:50:36:52 | access to local variable cmd | This query depends on $@. | SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | this read from stdin |
26
edges
7+
| SqlInjection.cs:24:21:24:31 | access to local variable queryString : String | SqlInjection.cs:26:42:26:52 | access to local variable queryString | provenance | Sink:MaD:1 |
8+
| SqlInjection.cs:24:21:24:31 | access to local variable queryString : String | SqlInjection.cs:26:42:26:52 | access to local variable queryString : String | provenance | |
9+
| SqlInjection.cs:25:21:25:29 | access to property Text : String | SqlInjection.cs:24:21:24:31 | access to local variable queryString : String | provenance | |
10+
| SqlInjection.cs:26:21:26:23 | access to local variable cmd : SqlCommand | SqlInjection.cs:27:50:27:52 | access to local variable cmd | provenance | Sink:MaD:2 |
11+
| SqlInjection.cs:26:27:26:53 | object creation of type SqlCommand : SqlCommand | SqlInjection.cs:26:21:26:23 | access to local variable cmd : SqlCommand | provenance | |
12+
| SqlInjection.cs:26:42:26:52 | access to local variable queryString : String | SqlInjection.cs:26:27:26:53 | object creation of type SqlCommand : SqlCommand | provenance | MaD:4 |
13+
| SqlInjection.cs:33:21:33:31 | access to local variable queryString : String | SqlInjection.cs:35:42:35:52 | access to local variable queryString | provenance | Sink:MaD:1 |
14+
| SqlInjection.cs:33:21:33:31 | access to local variable queryString : String | SqlInjection.cs:35:42:35:52 | access to local variable queryString : String | provenance | |
15+
| SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | SqlInjection.cs:33:21:33:31 | access to local variable queryString : String | provenance | Src:MaD:3 |
16+
| SqlInjection.cs:35:21:35:23 | access to local variable cmd : SqlCommand | SqlInjection.cs:36:50:36:52 | access to local variable cmd | provenance | Sink:MaD:2 |
17+
| SqlInjection.cs:35:27:35:53 | object creation of type SqlCommand : SqlCommand | SqlInjection.cs:35:21:35:23 | access to local variable cmd : SqlCommand | provenance | |
18+
| SqlInjection.cs:35:42:35:52 | access to local variable queryString : String | SqlInjection.cs:35:27:35:53 | object creation of type SqlCommand : SqlCommand | provenance | MaD:4 |
19+
models
20+
| 1 | Sink: Microsoft.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String); ; Argument[0]; sql-injection; manual |
21+
| 2 | Sink: Microsoft.Data.SqlClient; SqlDataAdapter; false; SqlDataAdapter; (Microsoft.Data.SqlClient.SqlCommand); ; Argument[0]; sql-injection; manual |
22+
| 3 | Source: System; Console; false; ReadLine; ; ; ReturnValue; stdin; manual |
23+
| 4 | Summary: Microsoft.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String); ; Argument[0]; Argument[this]; taint; manual |
324
nodes
25+
| SqlInjection.cs:24:21:24:31 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
26+
| SqlInjection.cs:25:21:25:29 | access to property Text : String | semmle.label | access to property Text : String |
27+
| SqlInjection.cs:26:21:26:23 | access to local variable cmd : SqlCommand | semmle.label | access to local variable cmd : SqlCommand |
28+
| SqlInjection.cs:26:27:26:53 | object creation of type SqlCommand : SqlCommand | semmle.label | object creation of type SqlCommand : SqlCommand |
29+
| SqlInjection.cs:26:42:26:52 | access to local variable queryString | semmle.label | access to local variable queryString |
30+
| SqlInjection.cs:26:42:26:52 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
31+
| SqlInjection.cs:27:50:27:52 | access to local variable cmd | semmle.label | access to local variable cmd |
32+
| SqlInjection.cs:33:21:33:31 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
33+
| SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
34+
| SqlInjection.cs:35:21:35:23 | access to local variable cmd : SqlCommand | semmle.label | access to local variable cmd : SqlCommand |
35+
| SqlInjection.cs:35:27:35:53 | object creation of type SqlCommand : SqlCommand | semmle.label | object creation of type SqlCommand : SqlCommand |
36+
| SqlInjection.cs:35:42:35:52 | access to local variable queryString | semmle.label | access to local variable queryString |
37+
| SqlInjection.cs:35:42:35:52 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
38+
| SqlInjection.cs:36:50:36:52 | access to local variable cmd | semmle.label | access to local variable cmd |
439
subpaths
5-
testFailures
6-
| SqlInjection.cs:25:53:25:81 | // ... | Missing result: Source[cs/sql-injection] |
7-
| SqlInjection.cs:26:56:26:83 | // ... | Missing result: Alert[cs/sql-injection] |
8-
| SqlInjection.cs:27:56:27:83 | // ... | Missing result: Alert[cs/sql-injection] |
9-
| SqlInjection.cs:34:62:34:90 | // ... | Missing result: Source[cs/sql-injection] |
10-
| SqlInjection.cs:35:56:35:83 | // ... | Missing result: Alert[cs/sql-injection] |
11-
| SqlInjection.cs:36:56:36:83 | // ... | Missing result: Alert[cs/sql-injection] |

0 commit comments

Comments
 (0)