diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll index 721ee1b70621..c00df1fa85f8 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll @@ -217,23 +217,17 @@ class PathCheck extends Sanitizer { Guard g; PathCheck() { -<<<<<<< HEAD // This expression is structurally replicated in a dominating guard - exists(AbstractValues::BooleanValue v | g = this.(GuardedDataFlowNode).getAGuard(_, v)) + exists(GuardValue v | + g = this.(GuardedDataFlowNode).getAGuard(_, v) and + exists(v.asBooleanValue()) + ) } override predicate isBarrier(TaintedPathConfig::FlowState state) { g.(WeakGuard).isBarrier(state) or not g instanceof WeakGuard -======= - // This expression is structurally replicated in a dominating guard which is not a "weak" check - exists(Guard g, GuardValue v | - g = this.(GuardedDataFlowNode).getAGuard(_, v) and - exists(v.asBooleanValue()) and - not g instanceof WeakGuard - ) ->>>>>>> codeql-cli/latest } } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll index 81b730b83112..87c146e6afbd 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll @@ -20,16 +20,17 @@ class PathCombinerViaMethodCall extends UnsanitizedPathCombiner { } } -class PathCombinerViaStringInterpolation extends UnsanitizedPathCombiner instanceof InterpolatedStringExpr {} +class PathCombinerViaStringInterpolation extends UnsanitizedPathCombiner instanceof InterpolatedStringExpr +{ } class PathCombinerViaStringConcatenation extends UnsanitizedPathCombiner instanceof AddExpr { - PathCombinerViaStringConcatenation() { - this.getAnOperand() instanceof StringLiteral - } + PathCombinerViaStringConcatenation() { this.getAnOperand() instanceof StringLiteral } } class MethodCallGetFullPath extends MethodCall { - MethodCallGetFullPath() { this.getTarget().hasFullyQualifiedName("System.IO.Path", "GetFullPath") } + MethodCallGetFullPath() { + this.getTarget().hasFullyQualifiedName("System.IO.Path", "GetFullPath") + } } /** @@ -51,19 +52,17 @@ private module GetFullPathToQualifierTaintTrackingConfiguration implements DataF } } -class ZipArchiveEntryClass extends Class{ - ZipArchiveEntryClass(){ - this.hasFullyQualifiedName("System.IO.Compression", "ZipArchiveEntry") - } +class ZipArchiveEntryClass extends Class { + ZipArchiveEntryClass() { this.hasFullyQualifiedName("System.IO.Compression", "ZipArchiveEntry") } } /** * The `FullName` property of `System.IO.Compression.ZipArchiveEntry`. */ -class ZipArchiveEntryFullNameAccess extends Property{ - ZipArchiveEntryFullNameAccess(){ - this.getDeclaringType() instanceof ZipArchiveEntryClass and - this.getName() = "FullName" +class ZipArchiveEntryFullNameAccess extends Property { + ZipArchiveEntryFullNameAccess() { + this.getDeclaringType() instanceof ZipArchiveEntryClass and + this.getName() = "FullName" } } @@ -185,18 +184,17 @@ module SanitizedGuardTT = TaintTracking::Global; -======= module ZipSlip = TaintTracking::Global; -/** An access to the `FullName` property of a `ZipArchiveEntry`. */ -class ArchiveFullNameSource extends Source { - ArchiveFullNameSource() { - exists(PropertyAccess pa | this.asExpr() = pa | - pa.getTarget() - .getDeclaringType() - .hasFullyQualifiedName("System.IO.Compression", "ZipArchiveEntry") and - pa.getTarget().getName() = "FullName" - ) - } -} - -/** An argument to the `ExtractToFile` extension method. */ -class ExtractToFileArgSink extends Sink { - ExtractToFileArgSink() { - exists(MethodCall mc | - mc.getTarget() - .hasFullyQualifiedName("System.IO.Compression", "ZipFileExtensions", "ExtractToFile") and - this.asExpr() = mc.getArgumentForName("destinationFileName") - ) - } -} - /** A path argument to a `File.Open`, `File.OpenWrite`, or `File.Create` method call. */ class FileOpenArgSink extends Sink { FileOpenArgSink() { @@ -604,24 +580,3 @@ class SubstringSanitizer extends Sanitizer { ) } } - -private predicate stringCheckGuard(Guard g, Expr e, GuardValue v) { - g.(MethodCall).getTarget().hasFullyQualifiedName("System", "String", "StartsWith") and - g.(MethodCall).getQualifier() = e and - // A StartsWith check against Path.Combine is not sufficient, because the ".." elements have - // not yet been resolved. - not exists(MethodCall combineCall | - combineCall.getTarget().hasFullyQualifiedName("System.IO", "Path", "Combine") and - DataFlow::localExprFlow(combineCall, e) - ) and - v.asBooleanValue() = true -} - -/** - * A call to `String.StartsWith()` that indicates that the tainted path value is being - * validated to ensure that it occurs within a permitted output path. - */ -class StringCheckSanitizer extends Sanitizer { - StringCheckSanitizer() { this = DataFlow::BarrierGuard::getABarrierNode() } -} ->>>>>>> codeql-cli/latest