Skip to content

Commit 23ee048

Browse files
michaelnebelmichaelnebel
committed
C#: Add cs/sql-injection tests for APIs in Microsoft.Data.SqlClient.
1 parent bb85e24 commit 23ee048

File tree

5 files changed

+78
-0
lines changed

5 files changed

+78
-0
lines changed

‎csharp/ql/test/query-tests/Security Features/CWE-089-2/SqlInjection.cs

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
using System;
2+
3+
namespace System.Web.UI.WebControls
4+
{
5+
public class TextBox { public string Text { get; set; } }
6+
}
7+
8+
namespace Test
9+
{
10+
using Microsoft.Data;
11+
using Microsoft.Data.SqlClient;
12+
using System.Web.UI.WebControls;
13+
14+
class SqlInjection
15+
{
16+
TextBox categoryTextBox;
17+
string connectionString;
18+
19+
public void MakeSqlCommand()
20+
{
21+
// BAD: Text from a local textbox
22+
using (var connection = new SqlConnection(connectionString))
23+
{
24+
var queryString = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
25+
+ box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
26+
var cmd = new SqlCommand(queryString); // $ Alert[cs/sql-injection]
27+
var adapter = new SqlDataAdapter(cmd); // $ Alert[cs/sql-injection]
28+
}
29+
30+
// BAD: Input from the command line.
31+
using (var connection = new SqlConnection(connectionString))
32+
{
33+
var queryString = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
34+
+ Console.ReadLine() + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
35+
var cmd = new SqlCommand(queryString); // $ Alert[cs/sql-injection]
36+
var adapter = new SqlDataAdapter(cmd); // $ Alert[cs/sql-injection]
37+
}
38+
}
39+
40+
System.Windows.Forms.TextBox box1;
41+
}
42+
}

‎csharp/ql/test/query-tests/Security Features/CWE-089-2/SqlInjection.expected

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#select
2+
| SqlInjection.cs:26:42:26:52 | access to local variable queryString | SqlInjection.cs:25:21:25:29 | access to property Text : String | SqlInjection.cs:26:42:26:52 | access to local variable queryString | This query depends on $@. | SqlInjection.cs:25:21:25:29 | access to property Text : String | this TextBox text |
3+
| SqlInjection.cs:35:42:35:52 | access to local variable queryString | SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | SqlInjection.cs:35:42:35:52 | access to local variable queryString | This query depends on $@. | SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | this read from stdin |
4+
edges
5+
| SqlInjection.cs:24:21:24:31 | access to local variable queryString : String | SqlInjection.cs:26:42:26:52 | access to local variable queryString | provenance | |
6+
| SqlInjection.cs:25:21:25:29 | access to property Text : String | SqlInjection.cs:24:21:24:31 | access to local variable queryString : String | provenance | |
7+
| SqlInjection.cs:33:21:33:31 | access to local variable queryString : String | SqlInjection.cs:35:42:35:52 | access to local variable queryString | provenance | |
8+
| SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | SqlInjection.cs:33:21:33:31 | access to local variable queryString : String | provenance | Src:MaD:1 |
9+
models
10+
| 1 | Source: System; Console; false; ReadLine; ; ; ReturnValue; stdin; manual |
11+
nodes
12+
| SqlInjection.cs:24:21:24:31 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
13+
| SqlInjection.cs:25:21:25:29 | access to property Text : String | semmle.label | access to property Text : String |
14+
| SqlInjection.cs:26:42:26:52 | access to local variable queryString | semmle.label | access to local variable queryString |
15+
| SqlInjection.cs:33:21:33:31 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
16+
| SqlInjection.cs:34:21:34:38 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
17+
| SqlInjection.cs:35:42:35:52 | access to local variable queryString | semmle.label | access to local variable queryString |
18+
subpaths
19+
testFailures
20+
| SqlInjection.cs:27:56:27:83 | // ... | Missing result: Alert[cs/sql-injection] |
21+
| SqlInjection.cs:36:56:36:83 | // ... | Missing result: Alert[cs/sql-injection] |

‎csharp/ql/test/query-tests/Security Features/CWE-089-2/SqlInjection.ext.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
3+
- addsTo:
4+
pack: codeql/threat-models
5+
extensible: threatModelConfiguration
6+
data:
7+
- ["local", true, 0]

‎csharp/ql/test/query-tests/Security Features/CWE-089-2/SqlInjection.qlref

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
query: Security Features/CWE-089/SqlInjection.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎csharp/ql/test/query-tests/Security Features/CWE-089-2/options

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/Microsoft.Data.SqlClient/6.0.2/Microsoft.Data.SqlClient.csproj
3+
semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Windows.cs
4+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

0 commit comments

Comments
 (0)