Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

C#: Improve cs/invalid-string-formatting and add to the Code Quality suite. #19148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 18 commits into from
Apr 24, 2025
Merged

C#: Improve cs/invalid-string-formatting and add to the Code Quality suite. #19148

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
68f9349
C#: Add cs/invalid-string-formatting to the codeql quality suite.
michaelnebel Mar 28, 2025
9cfd6e3
C#: Convert testing of cs/invalid-string-formatting to inline expecta…
michaelnebel Apr 3, 2025
327ddb0
C#: Re-factor FormatMethod.
michaelnebel Apr 4, 2025
175e4ec
C#: Add more format testcases.
michaelnebel Apr 4, 2025
f73b742
C#: Remove false positive example.
michaelnebel Apr 4, 2025
1d9d878
C#: Remove some false positives and add more true positives for cs/in…
michaelnebel Apr 4, 2025
8fb5fe9
C#: Update test expected output.
michaelnebel Apr 4, 2025
11dffc6
C#: Add more invalid-string-formatting testcases.
michaelnebel Apr 9, 2025
f31235d
C#: Improve format logic to take CompositeFormat and generics into ac…
michaelnebel Apr 8, 2025
39abd5c
C#: Update test expected output.
michaelnebel Apr 9, 2025
930bb6b
C#: Add FP for string.Format using params collection.
michaelnebel Apr 9, 2025
042c7e5
C#: Generalize array logic to params collection like types.
michaelnebel Apr 9, 2025
6de5920
C#: Update test expected output.
michaelnebel Apr 9, 2025
f2dddd6
C#: Hide the abstract FormatMethod class.
michaelnebel Apr 9, 2025
22ae3e7
C#: Update string format item parameter expected test case.
michaelnebel Apr 9, 2025
b6d2f14
C#: Add change note.
michaelnebel Apr 10, 2025
dcf11c2
C#: Match up sources, alerts and sinks in the tests.
michaelnebel Apr 23, 2025
65ac951
C#: Remove all Sink tags after rebase.
michaelnebel Apr 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
C#: Add more invalid-string-formatting testcases.
  • Loading branch information
@michaelnebel
michaelnebel committed Apr 24, 2025
commit 11dffc6647736598bd0957d9dcbf82d1214d9091
23 changes: 23 additions & 0 deletions 23 csharp/ql/test/query-tests/API Abuse/FormatInvalid/FormatInvalid.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
using System;
using System.Globalization;
using System.Text;

class FormatInvalid
Expand Down Expand Up @@ -134,5 +135,27 @@ void FormatMethodTests()
ts.TraceInformation("{0}"); // GOOD
}

void CompositeFormatMethods()
{
var format = CompositeFormat.Parse("}"); // $ Alert

// GOOD: Format is invalid and this flagged during parsing.
String.Format<string>(null, format, "");
String.Format<string, string>(null, format, "", "");
String.Format<string, string, string>(null, format, "", "", "");

sb.AppendFormat(null, format, "");
sb.AppendFormat<string>(null, format, "");
sb.AppendFormat<string, string>(null, format, "", "");
sb.AppendFormat<string, string, string>(null, format, "", "", "");


var span = new Span<char>();
span.TryWrite(null, format, out _);
span.TryWrite<object>(null, format, out _, new object());
span.TryWrite<object, object>(null, format, out _, new object(), new object());
span.TryWrite<object, object, object>(null, format, out _, "", "", "");
}

System.IO.StringWriter sw;
}
Loading
Morty Proxy This is a proxified and sanitized view of the page, visit original site.