-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
C#: Blazor: Add route parameters as remote flow sources #18664
base: main
Are you sure you want to change the base?
C#: Blazor: Add route parameters as remote flow sources #18664
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more
/** Provides classes for working with `Microsoft.AspNetCore.Components` */ | ||
|
||
import csharp | ||
import semmle.code.csharp.frameworks.Microsoft |
Check warning
Code scanning / CodeQL
Redundant import Warning
semmle.code.csharp.frameworks.microsoft.AspNetCore
csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
Fixed
Show fixed
Hide fixed
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
Outdated
Show resolved
Hide resolved
Property getARouteParameterProperty() { | ||
result = this.getAParameterProperty() and | ||
exists(string urlParamName | urlParamName = this.getARouteParameter() | | ||
result.getName().toLowerCase() = urlParamName.toLowerCase() | ||
) | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Joining on names is always a candidate for a bad join, so it is usually safer to force multi-column joins, e.g.
pragma[nomagic]
private Property getAParameterProperty(string name) {
result = this.getAProperty() and
result.getAnAttribute() instanceof MicrosoftAspNetCoreComponentsParameterAttribute and
name = result.getName().toLowerCase()
}
pragma[nomagic]
private string getARouteParameter() {
exists(string s |
s = this.getRouteAttributeUrl().splitAt("{").regexpCapture("\\*?([^:?}]+)[:?}](.*)", 1) and
result = s.toLowerCase()
)
}
Property getARouteParameterProperty() {
exists(string name |
result = this.getAParameterProperty(name) and
name = this.getARouteParameter()
)
}
@@ -0,0 +1,7 @@ | |||
import semmle.code.csharp.security.dataflow.flowsources.Remote |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is the motivation for using integration tests instead of normal QL tests? I find it quite difficult to run
(specific) integration tests locally...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This was mostly because the test was originally from Tamás's WIP PR. And I wasn't sure about testing Blazor components as a QL test (I'm unsure if I'll need to have a full project). I'll experiment with moving it.
You are correct about the integration test being a more complicated way to run the test locally.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If it's not easy to do, then let's do only the integration test.
Adds the variables parsed from the
@page
directive of a Blazor component as remote flow sources