C#: Threat Modeling - Introduce ThreatModelFlowSource
#15359
Conversation
![github-advanced-security[bot]](https://web.archive.org/web/20240121063348im_/https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll
Fixed
Show fixed
Hide fixed
| DbDataReaderPropertyStoredFlowSource() { | ||
| this.asExpr().(PropertyAccess).getTarget().getDeclaringType() = | ||
| any(SystemDataCommon::DbDataReader dataReader).getASubType*() | ||
| } | ||
| } | ||
|
|
||
| /** A read of a mapped property. */ | ||
| class ORMMappedProperty extends StoredFlowSource { | ||
| class ORMMappedProperty extends DatabaseInputSource { | ||
| ORMMappedProperty() { | ||
| this instanceof EntityFramework::StoredFlowSource or |
There was a problem hiding this comment.
Maybe we should consider to let EntityFramework::StoredFlowSource extends Stored::DatabaseInputSource instead (the same for NHibernate::StoredFlowSource). Then we have the same pattern like for java for different frameworks.
Then OrmMappedProperty should just extend DataFlow::Node (is it used anywhere? If not we can consider to deprecate it).
There was a problem hiding this comment.
Converting EntityFramework::StoredFlowSource and NHibernate::StoredFlowSource to extend DatabaseInputSource makes sense. They are also defined in ways where as I understand it, they cannot be converted to models-as-data.
ORMMappedProperty is not used anywhere directly within our codebase or from what I can find on https://github.com/search. I think it would be reasonable to deprecate it.
There was a problem hiding this comment.
Nice work @egregius313 !
Only a couple of minor comments.
We also need to run DCA before merging.
1. Introduces the `SourceNode` class which allows dataflow nodes representing sources to indicate the threat model they are associated with. 2. Introduces the `ThreatModelFlowSource` class which represents a source node which respects the threat model configuration
Refactor the existing flowsource classes to use the `SourceNode` class to specify which threat model they support.
egregius313
force-pushed
the
egregius313/csharp/dataflow/threat-modeling/add-threatmodelflowsource
branch
from
0d1a078
to
549d046
Compare
csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Stored.qll
Show resolved
Hide resolved
|
@egregius313 : I have started a DCA run. |
|
DCA looks good. |
Introduces the
semmle.code.csharp.security.dataflow.flowsources.FlowSourceslibrary, which introduces theThreatModelFlowSourceclass.Like Java's,
ThreatModelFlowSourceprovides a class representing source nodes which respect the current threat model.