src\RoslynAnalyzers\Utilities\FlowAnalysis\FlowAnalysis\Analysis\TaintedDataAnalysis\RegexSinks.cs (1)
23SinkKind.Regex,
src\RoslynAnalyzers\Utilities\FlowAnalysis\FlowAnalysis\Analysis\TaintedDataAnalysis\TaintedDataAnalysis.TaintedDataOperationVisitor.cs (16)
35private Dictionary<SymbolAccess, (ImmutableHashSet<SinkKind>.Builder SinkKinds, ImmutableHashSet<SymbolAccess>.Builder SourceOrigins)> TaintedSourcesBySink { get; }
47foreach (KeyValuePair<SymbolAccess, (ImmutableHashSet<SinkKind>.Builder SinkKinds, ImmutableHashSet<SymbolAccess>.Builder SourceOrigins)> kvp in this.TaintedSourcesBySink)
533IEnumerable<SinkKind> sinkKinds,
540private void TrackTaintedDataEnteringSink(SymbolAccess sink, IEnumerable<SinkKind> sinkKinds, IEnumerable<SymbolAccess> sources)
542if (!this.TaintedSourcesBySink.TryGetValue(sink, out (ImmutableHashSet<SinkKind>.Builder SinkKinds, ImmutableHashSet<SymbolAccess>.Builder SourceOrigins) data))
544data = (ImmutableHashSet.CreateBuilder<SinkKind>(), ImmutableHashSet.CreateBuilder<SymbolAccess>());
570if (IsMethodArgumentASink(targetMethod, infosForType, taintedArgument, out HashSet<SinkKind>? sinkKinds))
586out (ImmutableHashSet<SinkKind>.Builder SinkKinds, ImmutableHashSet<SymbolAccess>.Builder SourceOrigins) data))
588data = (ImmutableHashSet.CreateBuilder<SinkKind>(), ImmutableHashSet.CreateBuilder<SymbolAccess>());
605if (this.IsPropertyASink(propertyReferenceOperation, out HashSet<SinkKind>? sinkKinds))
683private static bool IsMethodArgumentASink(IMethodSymbol method, IEnumerable<SinkInfo> infosForType, IArgumentOperation taintedArgument, [NotNullWhen(returnValue: true)] out HashSet<SinkKind>? sinkKinds)
686Lazy<HashSet<SinkKind>> lazySinkKinds = new Lazy<HashSet<SinkKind>>(() => []);
725private bool IsPropertyASink(IPropertyReferenceOperation propertyReferenceOperation, [NotNullWhen(returnValue: true)] out HashSet<SinkKind>? sinkKinds)
727Lazy<HashSet<SinkKind>> lazySinkKinds = new Lazy<HashSet<SinkKind>>(() => []);
src\RoslynAnalyzers\Utilities\FlowAnalysis\FlowAnalysis\Analysis\TaintedDataAnalysis\TaintedDataConfig.cs (81)
31/// Caches the results for <see cref="GetSourceInfos(SinkKind)"/>.
33private static ImmutableDictionary<SinkKind, ImmutableHashSet<SourceInfo>> s_sinkKindToSourceInfo
34= ImmutableDictionary.Create<SinkKind, ImmutableHashSet<SourceInfo>>();
37/// Caches the results for <see cref="GetSanitizerInfos(SinkKind)"/>.
39private static ImmutableDictionary<SinkKind, ImmutableHashSet<SanitizerInfo>> s_sinkKindToSanitizerInfo
40= ImmutableDictionary.Create<SinkKind, ImmutableHashSet<SanitizerInfo>>();
43/// Caches the results for <see cref="HasTaintArraySource(SinkKind)"/>.
45private static ImmutableDictionary<SinkKind, bool> s_sinkKindHasTaintArraySource
46= ImmutableDictionary.Create<SinkKind, bool>();
58private ImmutableDictionary<SinkKind, Lazy<TaintedDataSymbolMap<SourceInfo>>> SourceSymbolMap { get; }
63private ImmutableDictionary<SinkKind, Lazy<TaintedDataSymbolMap<SanitizerInfo>>> SanitizerSymbolMap { get; }
68private ImmutableDictionary<SinkKind, Lazy<TaintedDataSymbolMap<SinkInfo>>> SinkSymbolMap { get; }
82ImmutableDictionary<SinkKind, Lazy<TaintedDataSymbolMap<SourceInfo>>> sourceSymbolMap,
83ImmutableDictionary<SinkKind, Lazy<TaintedDataSymbolMap<SanitizerInfo>>> sanitizerSymbolMap,
84ImmutableDictionary<SinkKind, Lazy<TaintedDataSymbolMap<SinkInfo>>> sinkSymbolMap)
96PooledDictionary<SinkKind, Lazy<TaintedDataSymbolMap<SourceInfo>>>.GetInstance(out var sourceSymbolMapBuilder);
98PooledDictionary<SinkKind, Lazy<TaintedDataSymbolMap<SanitizerInfo>>>.GetInstance(out var sanitizerSymbolMapBuilder);
100PooledDictionary<SinkKind, Lazy<TaintedDataSymbolMap<SinkInfo>>>.GetInstance(out var sinkSymbolMapBuilder);
111PooledDictionary<(ImmutableHashSet<SourceInfo> SourceInfos, ImmutableHashSet<SanitizerInfo> SanitizerInfos), (ImmutableHashSet<SinkKind>.Builder SinkKinds, ImmutableHashSet<SinkInfo>.Builder SinkInfos)>.GetInstance(out var sourceSanitizersToSinks);
114foreach (var sinkKind in Enum.GetValues<SinkKind>())
139if (!sourceSanitizersToSinks.TryGetValue((sources, sanitizers), out (ImmutableHashSet<SinkKind>.Builder SinkKinds, ImmutableHashSet<SinkInfo>.Builder SinkInfos) sinksPair))
141sinksPair = (ImmutableHashSet.CreateBuilder<SinkKind>(), ImmutableHashSet.CreateBuilder<SinkInfo>());
149foreach (KeyValuePair<(ImmutableHashSet<SourceInfo> SourceInfos, ImmutableHashSet<SanitizerInfo> SanitizerInfos), (ImmutableHashSet<SinkKind>.Builder SinkKinds, ImmutableHashSet<SinkInfo>.Builder SinkInfos)> kvp in sourceSanitizersToSinks)
155foreach (SinkKind sinkKind in kvp.Value.SinkKinds)
168public TaintedDataSymbolMap<SourceInfo> GetSourceSymbolMap(SinkKind sinkKind)
173public TaintedDataSymbolMap<SanitizerInfo> GetSanitizerSymbolMap(SinkKind sinkKind)
178public TaintedDataSymbolMap<SinkInfo> GetSinkSymbolMap(SinkKind sinkKind)
183public static bool HasTaintArraySource(SinkKind sinkKind)
191private TaintedDataSymbolMap<T> GetFromMap<T>(SinkKind sinkKind, ImmutableDictionary<SinkKind, Lazy<TaintedDataSymbolMap<T>>> map)
205private static ImmutableHashSet<SourceInfo> GetSourceInfos(SinkKind sinkKind)
214case SinkKind.Dll:
215case SinkKind.FilePathInjection:
216case SinkKind.ProcessCommand:
217case SinkKind.Xss:
218case SinkKind.Regex:
219case SinkKind.Ldap:
220case SinkKind.Redirect:
221case SinkKind.XPath:
222case SinkKind.Xml:
223case SinkKind.Xaml:
227sourceInfo = GetSourceInfos(SinkKind.Sql);
230case SinkKind.Sql:
234case SinkKind.InformationDisclosure:
238case SinkKind.ZipSlip:
242case SinkKind.HardcodedEncryptionKey:
246case SinkKind.HardcodedCertificate:
258private static ImmutableHashSet<SanitizerInfo> GetSanitizerInfos(SinkKind sinkKind)
267case SinkKind.XPath:
271sanitizerInfo = GetSanitizerInfos(SinkKind.Sql);
274case SinkKind.Sql:
278case SinkKind.Xss:
282case SinkKind.Ldap:
286case SinkKind.Xml:
290case SinkKind.Dll:
291case SinkKind.InformationDisclosure:
292case SinkKind.FilePathInjection:
293case SinkKind.ProcessCommand:
294case SinkKind.Regex:
295case SinkKind.Redirect:
296case SinkKind.Xaml:
297case SinkKind.HardcodedEncryptionKey:
298case SinkKind.HardcodedCertificate:
302case SinkKind.ZipSlip:
314private static ImmutableHashSet<SinkInfo> GetSinkInfos(SinkKind sinkKind)
318case SinkKind.Sql:
321case SinkKind.Dll:
324case SinkKind.InformationDisclosure:
325case SinkKind.Xss:
328case SinkKind.FilePathInjection:
331case SinkKind.ProcessCommand:
334case SinkKind.Regex:
337case SinkKind.Ldap:
340case SinkKind.Redirect:
343case SinkKind.XPath:
346case SinkKind.Xml:
349case SinkKind.Xaml:
352case SinkKind.ZipSlip:
355case SinkKind.HardcodedEncryptionKey:
358case SinkKind.HardcodedCertificate:
src\RoslynAnalyzers\Utilities\FlowAnalysis\FlowAnalysis\Analysis\TaintedDataAnalysis\XamlSinks.cs (1)
23SinkKind.Xaml,