codeql icon indicating copy to clipboard operation
codeql copied to clipboard

C# Dataflow limited heavily by lack of support for ServiceProvider and Dependency Injection tracking

Open ShiningMassXAcc opened this issue 1 year ago • 3 comments

Description of the issue Dependency injection and service provider building are some of the core concepts of .net / C# architecture that really define the characteristics of the platform. In some of my initial query authoring, it appears CodeQL dataflow has limited to no out-of-box flow through these entities, leaving any potential query susceptible.

Below is a psuedo-code example showcasing a flow example that would be missing. This example has some explicit calls for simplicity, that would often be less direct through a fuller dependency injection implementation.

Curious what level of support in expected for this today and perhaps what we should aspire to be able to cover in the future?

Thanks!

public interface IADependency
{
	public string AMember();
}

public interface IADependent
{
	public void SensitiveAction();
}

public class MyDependency : IADependency
{
	private string _src;

	public MyDependency(string foo)
	{
		_src = foo;
	}
	
	public string AMember()
	{
		return _src;
	}
}

public class MyDependent : IADependent
{
	private IADependency _localDependency;
	
	public MyDependent(IADependency bar)
	{
		_localDependency = bar;
	}
	
	public void SensitiveAction()
	{
		// Sensitive Action
		Console.WriteLine($"A sensitive sink has { _localDependency.AMember() }")
	}
}

void main()
{
	IServiceCollection services;
	
	IADependency dependency = MyDependencyFactory.CreateADependency("taint");
	
	services.AddSingleton<IADependency>(s => dependency);
	services.AddSingleton<IADependent, MyDependent>();
	
	var thing = services.GetRequiredService<IADependent>();
	
	thing.SensitiveAction();
}

ShiningMassXAcc avatar Dec 04 '23 18:12 ShiningMassXAcc