github · asgerf · Jan 23, 2025
@@ -68,6 +68,12 @@ private module DapperCommandDefitionMethodCallSqlConfig implements DataFlow::Con
      node.asExpr() = mc.getArgumentForName("command")
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/frameworks/Sql.qll:54: Flow call outside 'select' clause
+    none()
+  }
 }

 private module DapperCommandDefinitionMethodCallSql =

@@ -167,6 +167,12 @@ private module SettingsDataFlowConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) { source.asExpr() instanceof XmlReaderSettingsCreation }

  predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof XmlReaderSettingsInstance }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/frameworks/system/Xml.qll:190: Flow call outside 'select' clause
+    none()
+  }
 }

 private module SettingsDataFlow = DataFlow::Global<SettingsDataFlowConfig>;

@@ -70,6 +70,8 @@ private module SymmetricKeyConfig implements DataFlow::ConfigSig {

  /** Holds if the node is a key sanitizer. */
  predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof KeySanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -82,6 +82,8 @@ module HardcodedSymmetricEncryptionKey {
        succ.asExpr() = mc
      )
    }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
  }

  /**

@@ -32,6 +32,8 @@ private module ClearTextStorageConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -33,6 +33,8 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -42,6 +42,8 @@ module CommandInjectionConfig implements DataFlow::ConfigSig {
   * `node` from the data flow graph.
   */
  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -39,6 +39,12 @@ private module ConditionalBypassConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/src/Security Features/CWE-807/ConditionalBypass.ql:23: Column 5 selects sink.getSensitiveMethodCall
+    none()
+  }
 }

 /**

@@ -32,6 +32,8 @@ private module ExposureOfPrivateInformationConfig implements DataFlow::ConfigSig
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -78,6 +78,13 @@ private module RemoteSourceToExternalApiConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }

  predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll:88: Flow call outside 'select' clause
+    // ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll:91: Flow call outside 'select' clause
+    none()
+  }
 }

 /** A module for tracking flow from `ActiveThreatModelSource`s to `ExternalApiDataNode`s. */

@@ -45,6 +45,8 @@ module LdapInjectionConfig implements DataFlow::ConfigSig {
   * `node` from the data flow graph.
   */
  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -35,6 +35,8 @@ private module LogForgingConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -39,6 +39,8 @@ private module MissingXmlValidationConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { exists(sink.(Sink).getReason()) }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -33,6 +33,8 @@ private module ReDoSConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**
@@ -77,6 +79,12 @@ private module ExponentialRegexDataFlowConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node s) { isExponentialRegex(s.asExpr()) }

  predicate isSink(DataFlow::Node s) { s.asExpr() = any(RegexOperation c).getPattern() }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll:92: Flow call outside 'select' clause
+    none()
+  }
 }

 module ExponentialRegexDataFlow = DataFlow::Global<ExponentialRegexDataFlowConfig>;

@@ -33,6 +33,8 @@ private module RegexInjectionConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -32,6 +32,8 @@ private module ResourceInjectionConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -43,6 +43,8 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
   * `node` from the data flow graph.
   */
  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -35,6 +35,8 @@ private module TaintedPathConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -59,6 +59,13 @@ private module TaintToObjectMethodTrackingConfig implements DataFlow::ConfigSig
  predicate isSink(DataFlow::Node sink) { sink instanceof InstanceMethodSink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 1 does not select a source or sink originating from the flow call on line 33
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:60: Column 5 does not select a source or sink originating from the flow call on line 33
+    none()
+  }
 }

 /**
@@ -77,6 +84,13 @@ private module JsonConvertTrackingConfig implements DataFlow::ConfigSig {
  }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 1 does not select a source or sink originating from the flow call on line 55
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:60: Column 5 does not select a source or sink originating from the flow call on line 55
+    none()
+  }
 }

 /**
@@ -133,6 +147,13 @@ private module TypeNameTrackingConfig implements DataFlow::ConfigSig {
      )
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 1 does not select a source or sink originating from the flow call on line 56
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:60: Column 5 does not select a source or sink originating from the flow call on line 56
+    none()
+  }
 }

 /**
@@ -149,6 +170,13 @@ private module TaintToConstructorOrStaticMethodTrackingConfig implements DataFlo
  predicate isSink(DataFlow::Node sink) { sink instanceof ConstructorOrStaticMethodSink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 1 does not select a source or sink originating from the flow call on line 50
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:60: Column 5 does not select a source or sink originating from the flow call on line 50
+    none()
+  }
 }

 /**
@@ -186,6 +214,13 @@ private module TaintToObjectTypeTrackingConfig implements DataFlow::ConfigSig {
      oc.getObjectType() instanceof StrongTypeDeserializer
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 1 does not select a source or sink originating from the flow call on line 43
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:60: Column 5 does not select a source or sink originating from the flow call on line 43
+    none()
+  }
 }

 /**
@@ -210,6 +245,13 @@ private module WeakTypeCreationToUsageTrackingConfig implements DataFlow::Config
      sink.asExpr() = mc.getQualifier()
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:59: Column 1 does not select a source or sink originating from the flow call on line 37
+    // ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql:60: Column 5 does not select a source or sink originating from the flow call on line 37
+    none()
+  }
 }

 /**
@@ -342,6 +384,12 @@ private module DataContractJsonSafeConstructorTrackingConfig implements DataFlow
      mc.getQualifier() = sink.asExpr()
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:28: Flow call outside 'select' clause
+    none()
+  }
 }

 private module DataContractJsonSafeConstructorTracking =
@@ -389,6 +437,12 @@ private module JavaScriptSerializerSafeConstructorTrackingConfig implements Data
      mc.getQualifier() = sink.asExpr()
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:29: Flow call outside 'select' clause
+    none()
+  }
 }

 private module JavaScriptSerializerSafeConstructorTracking =
@@ -434,6 +488,12 @@ private module XmlObjectSerializerDerivedConstructorTrackingConfig implements Da
      mc.getQualifier() = sink.asExpr()
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:30: Flow call outside 'select' clause
+    none()
+  }
 }

 private module XmlObjectSerializerDerivedConstructorTracking =
@@ -476,6 +536,12 @@ private module XmlSerializerSafeConstructorTrackingConfig implements DataFlow::C
      mc.getQualifier() = sink.asExpr()
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:31: Flow call outside 'select' clause
+    none()
+  }
 }

 private module XmlSerializerSafeConstructorTracking =
@@ -522,6 +588,12 @@ private module DataContractSerializerSafeConstructorTrackingConfig implements Da
      mc.getQualifier() = sink.asExpr()
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:32: Flow call outside 'select' clause
+    none()
+  }
 }

 private module DataContractSerializerSafeConstructorTracking =
@@ -564,6 +636,12 @@ private module XmlMessageFormatterSafeConstructorTrackingConfig implements DataF
      mc.getQualifier() = sink.asExpr()
    )
  }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll:33: Flow call outside 'select' clause
+    none()
+  }
 }

 private module XmlMessageFormatterSafeConstructorTracking =

@@ -37,6 +37,8 @@ private module UrlRedirectConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -43,6 +43,8 @@ module XpathInjectionConfig implements DataFlow::ConfigSig {
   * `node` from the data flow graph.
   */
  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**

@@ -158,6 +158,12 @@ module XssTrackingConfig implements DataFlow::ConfigSig {
   * `node` from the data flow graph.
   */
  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/lib/semmle/code/csharp/security/dataflow/XSSQuery.qll:22: Flow call outside 'select' clause
+    none()
+  }
 }

 module XssTracking = TaintTracking::Global<XssTrackingConfig>;

@@ -30,6 +30,8 @@ private module ZipSlipConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }

 /**