|
1 | 1 | /** |
2 | | - * Provides classes representing data flow sources for remote user input. |
| 2 | + * DEPRECATED. |
| 3 | + * |
| 4 | + * Use `semmle.code.csharp.security.dataflow.flowsources.Remote` instead. |
3 | 5 | */ |
4 | 6 |
|
5 | | -import csharp |
6 | | -private import semmle.code.csharp.frameworks.system.Net |
7 | | -private import semmle.code.csharp.frameworks.system.Web |
8 | | -private import semmle.code.csharp.frameworks.system.web.Http |
9 | | -private import semmle.code.csharp.frameworks.system.web.Mvc |
10 | | -private import semmle.code.csharp.frameworks.system.web.Services |
11 | | -private import semmle.code.csharp.frameworks.system.web.ui.WebControls |
12 | | -private import semmle.code.csharp.frameworks.WCF |
13 | | -private import semmle.code.csharp.frameworks.microsoft.Owin |
14 | | -private import semmle.code.csharp.frameworks.microsoft.AspNetCore |
15 | | - |
16 | | -/** A data flow source of remote user input. */ |
17 | | -abstract class RemoteFlowSource extends DataFlow::Node { |
18 | | - /** Gets a string that describes the type of this remote flow source. */ |
19 | | - abstract string getSourceType(); |
20 | | -} |
21 | | - |
22 | | -/** A data flow source of remote user input (ASP.NET). */ |
23 | | -abstract class AspNetRemoteFlowSource extends RemoteFlowSource { } |
24 | | - |
25 | | -/** A member containing an ASP.NET query string. */ |
26 | | -class AspNetQueryStringMember extends Member { |
27 | | - AspNetQueryStringMember() { |
28 | | - exists(RefType t | |
29 | | - t instanceof SystemWebHttpRequestClass or |
30 | | - t instanceof SystemNetHttpListenerRequestClass or |
31 | | - t instanceof SystemWebHttpRequestBaseClass |
32 | | - | |
33 | | - this = t.getProperty(getHttpRequestFlowPropertyNames()) or |
34 | | - this.(Field).getType() = t or |
35 | | - this.(Property).getType() = t or |
36 | | - this.(Callable).getReturnType() = t |
37 | | - ) |
38 | | - } |
39 | | -} |
40 | | - |
41 | | -/** |
42 | | - * Gets the names of the properties in `HttpRequest` classes that should propagate taint out of the |
43 | | - * request. |
44 | | - */ |
45 | | -private string getHttpRequestFlowPropertyNames() { |
46 | | - result = "QueryString" or |
47 | | - result = "Headers" or |
48 | | - result = "RawUrl" or |
49 | | - result = "Url" or |
50 | | - result = "Cookies" or |
51 | | - result = "Form" or |
52 | | - result = "Params" or |
53 | | - result = "Path" or |
54 | | - result = "PathInfo" |
55 | | -} |
56 | | - |
57 | | -/** A data flow source of remote user input (ASP.NET query string). */ |
58 | | -class AspNetQueryStringRemoteFlowSource extends AspNetRemoteFlowSource, DataFlow::ExprNode { |
59 | | - AspNetQueryStringRemoteFlowSource() { |
60 | | - exists(RefType t | |
61 | | - t instanceof SystemWebHttpRequestClass or |
62 | | - t instanceof SystemNetHttpListenerRequestClass or |
63 | | - t instanceof SystemWebHttpRequestBaseClass |
64 | | - | |
65 | | - // A request object can be indexed, so taint the object as well |
66 | | - this.getExpr().getType() = t |
67 | | - ) |
68 | | - or |
69 | | - this.getExpr() = any(AspNetQueryStringMember m).getAnAccess() |
70 | | - } |
71 | | - |
72 | | - override string getSourceType() { result = "ASP.NET query string" } |
73 | | -} |
74 | | - |
75 | | -/** A data flow source of remote user input (ASP.NET unvalidated request data). */ |
76 | | -class AspNetUnvalidatedQueryStringRemoteFlowSource extends AspNetRemoteFlowSource, |
77 | | - DataFlow::ExprNode { |
78 | | - AspNetUnvalidatedQueryStringRemoteFlowSource() { |
79 | | - this.getExpr() = any(SystemWebUnvalidatedRequestValues c).getAProperty().getGetter().getACall() or |
80 | | - this.getExpr() = |
81 | | - any(SystemWebUnvalidatedRequestValuesBase c).getAProperty().getGetter().getACall() |
82 | | - } |
83 | | - |
84 | | - override string getSourceType() { result = "ASP.NET unvalidated request data" } |
85 | | -} |
86 | | - |
87 | | -/** A data flow source of remote user input (ASP.NET user input). */ |
88 | | -class AspNetUserInputRemoteFlowSource extends AspNetRemoteFlowSource, DataFlow::ExprNode { |
89 | | - AspNetUserInputRemoteFlowSource() { getType() instanceof SystemWebUIWebControlsTextBoxClass } |
90 | | - |
91 | | - override string getSourceType() { result = "ASP.NET user input" } |
92 | | -} |
93 | | - |
94 | | -/** A data flow source of remote user input (WCF based web service). */ |
95 | | -class WcfRemoteFlowSource extends RemoteFlowSource, DataFlow::ParameterNode { |
96 | | - WcfRemoteFlowSource() { exists(OperationMethod om | om.getAParameter() = this.getParameter()) } |
97 | | - |
98 | | - override string getSourceType() { result = "web service input" } |
99 | | -} |
100 | | - |
101 | | -/** A data flow source of remote user input (ASP.NET web service). */ |
102 | | -class AspNetServiceRemoteFlowSource extends RemoteFlowSource, DataFlow::ParameterNode { |
103 | | - AspNetServiceRemoteFlowSource() { |
104 | | - exists(Method m | |
105 | | - m.getAParameter() = this.getParameter() and |
106 | | - m.getAnAttribute().getType() instanceof SystemWebServicesWebMethodAttributeClass |
107 | | - ) |
108 | | - } |
109 | | - |
110 | | - override string getSourceType() { result = "ASP.NET web service input" } |
111 | | -} |
112 | | - |
113 | | -/** A data flow source of remote user input (ASP.NET request message). */ |
114 | | -class SystemNetHttpRequestMessageRemoteFlowSource extends RemoteFlowSource, DataFlow::ExprNode { |
115 | | - SystemNetHttpRequestMessageRemoteFlowSource() { |
116 | | - getType() instanceof SystemWebHttpRequestMessageClass |
117 | | - } |
118 | | - |
119 | | - override string getSourceType() { result = "ASP.NET request message" } |
120 | | -} |
121 | | - |
122 | | -/** |
123 | | - * A data flow source of remote user input (Microsoft Owin, a query, request, |
124 | | - * or path string). |
125 | | - */ |
126 | | -class MicrosoftOwinStringFlowSource extends RemoteFlowSource, DataFlow::ExprNode { |
127 | | - MicrosoftOwinStringFlowSource() { |
128 | | - this.getExpr() = any(MicrosoftOwinString owinString).getValueProperty().getGetter().getACall() |
129 | | - } |
130 | | - |
131 | | - override string getSourceType() { result = "Microsoft Owin request or query string" } |
132 | | -} |
133 | | - |
134 | | -/** A data flow source of remote user input (`Microsoft Owin IOwinRequest`). */ |
135 | | -class MicrosoftOwinRequestRemoteFlowSource extends RemoteFlowSource, DataFlow::ExprNode { |
136 | | - MicrosoftOwinRequestRemoteFlowSource() { |
137 | | - exists(Property p, MicrosoftOwinIOwinRequestClass owinRequest | |
138 | | - this.getExpr() = p.getGetter().getACall() |
139 | | - | |
140 | | - p = owinRequest.getAcceptProperty() or |
141 | | - p = owinRequest.getBodyProperty() or |
142 | | - p = owinRequest.getCacheControlProperty() or |
143 | | - p = owinRequest.getContentTypeProperty() or |
144 | | - p = owinRequest.getContextProperty() or |
145 | | - p = owinRequest.getCookiesProperty() or |
146 | | - p = owinRequest.getHeadersProperty() or |
147 | | - p = owinRequest.getHostProperty() or |
148 | | - p = owinRequest.getMediaTypeProperty() or |
149 | | - p = owinRequest.getMethodProperty() or |
150 | | - p = owinRequest.getPathProperty() or |
151 | | - p = owinRequest.getPathBaseProperty() or |
152 | | - p = owinRequest.getQueryProperty() or |
153 | | - p = owinRequest.getQueryStringProperty() or |
154 | | - p = owinRequest.getRemoteIpAddressProperty() or |
155 | | - p = owinRequest.getSchemeProperty() or |
156 | | - p = owinRequest.getURIProperty() |
157 | | - ) |
158 | | - } |
159 | | - |
160 | | - override string getSourceType() { result = "Microsoft Owin request" } |
161 | | -} |
162 | | - |
163 | | -/** A parameter to an Mvc controller action method, viewed as a source of remote user input. */ |
164 | | -class ActionMethodParameter extends RemoteFlowSource, DataFlow::ParameterNode { |
165 | | - ActionMethodParameter() { |
166 | | - exists(Parameter p | |
167 | | - p = this.getParameter() and |
168 | | - p.fromSource() |
169 | | - | |
170 | | - p = any(Controller c).getAnActionMethod().getAParameter() or |
171 | | - p = any(ApiController c).getAnActionMethod().getAParameter() |
172 | | - ) |
173 | | - } |
174 | | - |
175 | | - override string getSourceType() { result = "ASP.NET MVC action method parameter" } |
176 | | -} |
177 | | - |
178 | | -/** A data flow source of remote user input (ASP.NET Core). */ |
179 | | -abstract class AspNetCoreRemoteFlowSource extends RemoteFlowSource { } |
180 | | - |
181 | | -/** A data flow source of remote user input (ASP.NET query collection). */ |
182 | | -class AspNetCoreQueryRemoteFlowSource extends AspNetCoreRemoteFlowSource, DataFlow::ExprNode { |
183 | | - AspNetCoreQueryRemoteFlowSource() { |
184 | | - exists(ValueOrRefType t | |
185 | | - t instanceof MicrosoftAspNetCoreHttpHttpRequest or |
186 | | - t instanceof MicrosoftAspNetCoreHttpQueryCollection or |
187 | | - t instanceof MicrosoftAspNetCoreHttpQueryString |
188 | | - | |
189 | | - this.getExpr().(Call).getTarget().getDeclaringType() = t or |
190 | | - this.asExpr().(Access).getTarget().getDeclaringType() = t |
191 | | - ) |
192 | | - or |
193 | | - exists(Call c | |
194 | | - c |
195 | | - .getTarget() |
196 | | - .getDeclaringType() |
197 | | - .hasQualifiedName("Microsoft.AspNetCore.Http", "IQueryCollection") and |
198 | | - c.getTarget().getName() = "TryGetValue" and |
199 | | - this.asExpr() = c.getArgumentForName("value") |
200 | | - ) |
201 | | - } |
202 | | - |
203 | | - override string getSourceType() { result = "ASP.NET Core query string" } |
204 | | -} |
205 | | - |
206 | | -/** A parameter to a `Mvc` controller action method, viewed as a source of remote user input. */ |
207 | | -class AspNetCoreActionMethodParameter extends RemoteFlowSource, DataFlow::ParameterNode { |
208 | | - AspNetCoreActionMethodParameter() { |
209 | | - exists(Parameter p | |
210 | | - p = this.getParameter() and |
211 | | - p.fromSource() |
212 | | - | |
213 | | - p = any(MicrosoftAspNetCoreMvcController c).getAnActionMethod().getAParameter() |
214 | | - ) |
215 | | - } |
216 | | - |
217 | | - override string getSourceType() { result = "ASP.NET Core MVC action method parameter" } |
218 | | -} |
| 7 | +import semmle.code.csharp.security.dataflow.flowsources.Remote |
0 commit comments