[csharp] How to add step from a field set in a constructor to a field access in another method ?

[Hug0Vincent]

Hi, the title might no be super clear, I have this Sink class:

public class Sink
{
    public string Command { get; set; }

    public Sink(string command)
    {
        Command = command;
    }

    public void Run()
    {
        Process.Start(Command);
    }
}

Where Process.Start(...) will be defined in isSink

And here is the code calling it:

Sink sink = new Sink(taintedData);
sink.Run();

However my query doesn't show a path from taintedData to Process.Start(Command). Quick eval seems good for my isSource and isSink methods, I tried to add an AdditionalTaintStep but without success. How to follow this data ?

Thank you :)

[hvitved]

Hi

As long as you also have the code

Sink sink = new Sink(taintedData);
sink.Run();

in the database, then we should be able to detect the flow (ideally, we should also be able to detect it if not, but that is a current known limitation).

You can try using partial flow, to debug where flow stops: https://codeql.github.com/docs/writing-codeql-queries/debugging-data-flow-queries-using-partial-flow/.

[Hug0Vincent]

Hi, I actually have this code, here is a quick eval of isSource:

I've used the ForwardPartialDataflow.ql query from here. It actually found the path that I want but not my query.

Here is the quick eval of my isSink method:

  predicate isSink(DataFlow::Node sink) {
    exists(Call c |
      c.getTarget() instanceof DangerousMethod and (
        sink.asExpr() = c.getARuntimeArgument()
      )
    )
  }

[hvitved]

Could you perhaps paste in the entire code example, as well as the entire query?

[Hug0Vincent]

I feel dumb, I used code from another query to display the location in the result string but it doesn't not work in this case. It works now sorry and thank you for your time 👍