C#: Convert cs/uncontrolled-format-string tests to use test inline expectations.

Author: michaelnebel

csharp/ql/test/query-tests/Security Features/CWE-134/ConsoleUncontrolledFormatString.cs

@@ -5,9 +5,9 @@ public class Program
 {
     public static void Main()
     {
-        var format = Console.ReadLine();
+        var format = Console.ReadLine(); // $ Source
 
         // BAD: Uncontrolled format string.
-        var x = string.Format(format, 1, 2);
+        var x = string.Format(format, 1, 2); // $ Alert
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.cs

@@ -6,13 +6,13 @@ public class TaintedPathHandler : IHttpHandler
 {
     public void ProcessRequest(HttpContext ctx)
     {
-        String path = ctx.Request.QueryString["page"];
+        String path = ctx.Request.QueryString["page"]; // $ Source
 
         // BAD: Uncontrolled format string.
-        String.Format(path, "Do not do this");
+        String.Format(path, "Do not do this"); // $ Alert
 
         // BAD: Using an IFormatProvider.
-        String.Format((IFormatProvider)null, path, "Do not do this");
+        String.Format((IFormatProvider)null, path, "Do not do this"); // $ Alert
 
         // GOOD: Not the format string.
         String.Format("Do not do this", path);
@@ -29,6 +29,6 @@ public void ProcessRequest(HttpContext ctx)
     void OnButtonClicked()
     {
         // BAD: Uncontrolled format string.
-        String.Format(box1.Text, "Do not do this");
+        String.Format(box1.Text, "Do not do this"); // $ Alert
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.qlref

@@ -1,2 +1,4 @@
 query: Security Features/CWE-134/UncontrolledFormatString.ql
-postprocess: utils/test/PrettyPrintModels.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatStringBad.cs

@@ -6,9 +6,9 @@ public class HttpHandler : IHttpHandler
 
     public void ProcessRequest(HttpContext ctx)
     {
-        string format = ctx.Request.QueryString["nameformat"];
+        string format = ctx.Request.QueryString["nameformat"]; // $ Source
 
         // BAD: Uncontrolled format string.
-        FormattedName = string.Format(format, Surname, Forenames);
+        FormattedName = string.Format(format, Surname, Forenames); // $ Alert
     }
 }