Skip to content

C#: Add implicit System.Collections.Generic.KeyValuePair2.Value reads at taint sinks #21024

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MathiasVP merged 3 commits into from
Dec 12, 2025
+2,271 −13
Merged

C#: Add implicit System.Collections.Generic.KeyValuePair2.Value reads at taint sinks #21024

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b499661
C#: Slightly refactor 'CollectionFlow' tests to add a taint-flow test.
MathiasVP Dec 12, 2025
f30ebab
C#: Add implicit reads of System.Collections.Generic.KeyValuePair`2.V…
MathiasVP Dec 12, 2025
2720f57
C#: Add change note.
MathiasVP Dec 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
C#: Add implicit reads of System.Collections.Generic.KeyValuePair`2.V… 
…alue at taint sinks.
  • Loading branch information
@MathiasVP
MathiasVP committed Dec 12, 2025
commit f30ebab52850c2984e7cd281ec475beb7c453eaa
2 changes: 1 addition & 1 deletion csharp/ql/test/library-tests/dataflow/collections/CollectionFlow.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -554,6 +554,6 @@ public void ReadOnlySpanConstructorFlow()
public void ImplicitMapValueRead(Dictionary<int, A> dict) {
var a = new A();
dict[0] = a;
Sink(dict); // no taint flow
Sink(dict); // taint flow
}
}
10 changes: 10 additions & 0 deletions csharp/ql/test/library-tests/dataflow/collections/CollectionTaintFlow.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -631,6 +631,10 @@ edges
| CollectionFlow.cs:550:60:550:60 | access to local variable a : A | CollectionFlow.cs:550:58:550:62 | { ..., ... } : null [element] : A | provenance | |
| CollectionFlow.cs:551:14:551:17 | access to local variable span : ReadOnlySpan<A> | CollectionFlow.cs:551:14:551:20 | access to indexer | provenance | MaD:24 |
| CollectionFlow.cs:551:14:551:17 | access to local variable span : ReadOnlySpan<T> [element] : A | CollectionFlow.cs:551:14:551:20 | access to indexer | provenance | MaD:24 |
| CollectionFlow.cs:555:13:555:13 | access to local variable a : A | CollectionFlow.cs:556:19:556:19 | access to local variable a : A | provenance | |
| CollectionFlow.cs:555:17:555:23 | object creation of type A : A | CollectionFlow.cs:555:13:555:13 | access to local variable a : A | provenance | |
| CollectionFlow.cs:556:9:556:12 | [post] access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:557:14:557:17 | access to parameter dict | provenance | |
| CollectionFlow.cs:556:19:556:19 | access to local variable a : A | CollectionFlow.cs:556:9:556:12 | [post] access to parameter dict : Dictionary<T,T> [element, property Value] : A | provenance | MaD:11 |
nodes
| CollectionFlow.cs:14:40:14:41 | ts : A[] [element] : A | semmle.label | ts : A[] [element] : A |
| CollectionFlow.cs:14:40:14:41 | ts : null [element] : A | semmle.label | ts : null [element] : A |
Expand Down Expand Up @@ -1170,6 +1174,11 @@ nodes
| CollectionFlow.cs:551:14:551:17 | access to local variable span : ReadOnlySpan<A> | semmle.label | access to local variable span : ReadOnlySpan<A> |
| CollectionFlow.cs:551:14:551:17 | access to local variable span : ReadOnlySpan<T> [element] : A | semmle.label | access to local variable span : ReadOnlySpan<T> [element] : A |
| CollectionFlow.cs:551:14:551:20 | access to indexer | semmle.label | access to indexer |
| CollectionFlow.cs:555:13:555:13 | access to local variable a : A | semmle.label | access to local variable a : A |
| CollectionFlow.cs:555:17:555:23 | object creation of type A : A | semmle.label | object creation of type A : A |
| CollectionFlow.cs:556:9:556:12 | [post] access to parameter dict : Dictionary<T,T> [element, property Value] : A | semmle.label | [post] access to parameter dict : Dictionary<T,T> [element, property Value] : A |
| CollectionFlow.cs:556:19:556:19 | access to local variable a : A | semmle.label | access to local variable a : A |
| CollectionFlow.cs:557:14:557:17 | access to parameter dict | semmle.label | access to parameter dict |
subpaths
| CollectionFlow.cs:50:20:50:22 | access to local variable as : null [element] : A | CollectionFlow.cs:24:34:24:35 | ts : null [element] : A | CollectionFlow.cs:24:41:24:45 | access to array element : A | CollectionFlow.cs:50:14:50:23 | call to method First<A> |
| CollectionFlow.cs:68:20:68:23 | access to field As : A[] [element] : A | CollectionFlow.cs:24:34:24:35 | ts : A[] [element] : A | CollectionFlow.cs:24:41:24:45 | access to array element : A | CollectionFlow.cs:68:14:68:24 | call to method First<A> |
Expand Down Expand Up @@ -1372,3 +1381,4 @@ subpaths
| CollectionFlow.cs:542:42:542:48 | object creation of type A : A | CollectionFlow.cs:542:42:542:48 | object creation of type A : A | CollectionFlow.cs:544:14:544:22 | access to indexer | $@ | CollectionFlow.cs:544:14:544:22 | access to indexer | access to indexer |
| CollectionFlow.cs:549:17:549:23 | object creation of type A : A | CollectionFlow.cs:549:17:549:23 | object creation of type A : A | CollectionFlow.cs:551:14:551:20 | access to indexer | $@ | CollectionFlow.cs:551:14:551:20 | access to indexer | access to indexer |
| CollectionFlow.cs:550:32:550:63 | object creation of type ReadOnlySpan<A> : ReadOnlySpan<A> | CollectionFlow.cs:550:32:550:63 | object creation of type ReadOnlySpan<A> : ReadOnlySpan<A> | CollectionFlow.cs:551:14:551:20 | access to indexer | $@ | CollectionFlow.cs:551:14:551:20 | access to indexer | access to indexer |
| CollectionFlow.cs:555:17:555:23 | object creation of type A : A | CollectionFlow.cs:555:17:555:23 | object creation of type A : A | CollectionFlow.cs:557:14:557:17 | access to parameter dict | $@ | CollectionFlow.cs:557:14:557:17 | access to parameter dict | access to parameter dict |
Loading