Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

C#: Improve cs/invalid-string-formatting and add to the Code Quality suite. #19148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 18 commits into from
Apr 24, 2025
Merged

C#: Improve cs/invalid-string-formatting and add to the Code Quality suite. #19148

Changes from 1 commit
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
68f9349
C#: Add cs/invalid-string-formatting to the codeql quality suite.
michaelnebel Mar 28, 2025
9cfd6e3
C#: Convert testing of cs/invalid-string-formatting to inline expecta…
michaelnebel Apr 3, 2025
327ddb0
C#: Re-factor FormatMethod.
michaelnebel Apr 4, 2025
175e4ec
C#: Add more format testcases.
michaelnebel Apr 4, 2025
f73b742
C#: Remove false positive example.
michaelnebel Apr 4, 2025
1d9d878
C#: Remove some false positives and add more true positives for cs/in…
michaelnebel Apr 4, 2025
8fb5fe9
C#: Update test expected output.
michaelnebel Apr 4, 2025
11dffc6
C#: Add more invalid-string-formatting testcases.
michaelnebel Apr 9, 2025
f31235d
C#: Improve format logic to take CompositeFormat and generics into ac…
michaelnebel Apr 8, 2025
39abd5c
C#: Update test expected output.
michaelnebel Apr 9, 2025
930bb6b
C#: Add FP for string.Format using params collection.
michaelnebel Apr 9, 2025
042c7e5
C#: Generalize array logic to params collection like types.
michaelnebel Apr 9, 2025
6de5920
C#: Update test expected output.
michaelnebel Apr 9, 2025
f2dddd6
C#: Hide the abstract FormatMethod class.
michaelnebel Apr 9, 2025
22ae3e7
C#: Update string format item parameter expected test case.
michaelnebel Apr 9, 2025
b6d2f14
C#: Add change note.
michaelnebel Apr 10, 2025
dcf11c2
C#: Match up sources, alerts and sinks in the tests.
michaelnebel Apr 23, 2025
65ac951
C#: Remove all Sink tags after rebase.
michaelnebel Apr 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
C#: Re-factor FormatMethod.
  • Loading branch information
@michaelnebel
michaelnebel committed Apr 24, 2025
commit 327ddb07a173f827c0316933a97472bac6ccdac5
122 changes: 73 additions & 49 deletions 122 csharp/ql/lib/semmle/code/csharp/frameworks/Format.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,67 +8,91 @@ private import semmle.code.csharp.frameworks.System
private import semmle.code.csharp.frameworks.system.Text

/** A method that formats a string, for example `string.Format()`. */
class FormatMethod extends Method {
FormatMethod() {
exists(Class declType | declType = this.getDeclaringType() |
abstract class FormatMethod extends Method {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now we are exposing an abstract method, which is not backwards-compatible (and also not best practice). So Instead replace the current abstract FormatMethod class with a private FormatMethodImpl class, and add final class FormatMethod = FormatMethodImpl;.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Never mind, I see that you did exactly this in a subsequent commit.

/**
* Gets the argument containing the format string. For example, the argument of
* `string.Format(IFormatProvider, String, Object)` is `1`.
*/
abstract int getFormatArgument();
}

private class StringAndStringBuilderFormatMethods extends FormatMethod {
StringAndStringBuilderFormatMethods() {
(
this.getParameter(0).getType() instanceof SystemIFormatProviderInterface and
this.getParameter(1).getType() instanceof StringType and
this.getParameter(1).getType() instanceof StringType
or
this.getParameter(0).getType() instanceof StringType
) and
(
this = any(SystemStringClass c).getFormatMethod()
or
this = any(SystemTextStringBuilderClass c).getAppendFormatMethod()
)
}

override int getFormatArgument() {
if this.getParameter(0).getType() instanceof SystemIFormatProviderInterface
then result = 1
else result = 0
}
}

private class SystemConsoleAndSystemIoTextWriterFormatMethods extends FormatMethod {
SystemConsoleAndSystemIoTextWriterFormatMethods() {
this.getParameter(0).getType() instanceof StringType and
exists(Class declType | declType = this.getDeclaringType() |
this.hasName(["Write", "WriteLine"]) and
(
this = any(SystemStringClass c).getFormatMethod()
declType.hasFullyQualifiedName("System", "Console")
or
this = any(SystemTextStringBuilderClass c).getAppendFormatMethod()
declType.hasFullyQualifiedName("System.IO", "TextWriter")
)
or
this.getParameter(0).getType() instanceof StringType and
)
}

override int getFormatArgument() { result = 0 }
}

private class SystemDiagnosticsDebugAssert extends FormatMethod {
SystemDiagnosticsDebugAssert() {
this.hasName("Assert") and
this.getDeclaringType().hasFullyQualifiedName("System.Diagnostics", "Debug") and
this.getNumberOfParameters() = 4
}

override int getFormatArgument() { result = 2 }
}

private class SystemDiagnosticsFormatMethods extends FormatMethod {
SystemDiagnosticsFormatMethods() {
this.getParameter(0).getType() instanceof StringType and
exists(Class declType |
declType = this.getDeclaringType() and
declType.getNamespace().getFullName() = "System.Diagnostics"
|
declType.hasName("Trace") and
(
this = any(SystemStringClass c).getFormatMethod()
or
this = any(SystemTextStringBuilderClass c).getAppendFormatMethod()
or
(this.hasName("Write") or this.hasName("WriteLine")) and
(
declType.hasFullyQualifiedName("System", "Console")
or
declType.hasFullyQualifiedName("System.IO", "TextWriter")
or
declType.hasFullyQualifiedName("System.Diagnostics", "Debug") and
this.getParameter(1).getType() instanceof ArrayType
)
this.hasName("TraceError")
or
declType.hasFullyQualifiedName("System.Diagnostics", "Trace") and
(
this.hasName("TraceError") or
this.hasName("TraceInformation") or
this.hasName("TraceWarning")
)
this.hasName("TraceInformation")
or
this.hasName("TraceInformation") and
declType.hasFullyQualifiedName("System.Diagnostics", "TraceSource")
or
this.hasName("Print") and
declType.hasFullyQualifiedName("System.Diagnostics", "Debug")
this.hasName("TraceWarning")
)
or
this.hasName("Assert") and
declType.hasFullyQualifiedName("System.Diagnostics", "Debug") and
this.getNumberOfParameters() = 4
declType.hasName("TraceSource") and this.hasName("TraceInformation")
or
declType.hasName("Debug") and
(
this.hasName("Print")
or
this.hasName(["Write", "WriteLine"]) and
this.getParameter(1).getType() instanceof ArrayType
)
)
}

/**
* Gets the argument containing the format string. For example, the argument of
* `string.Format(IFormatProvider, String, Object)` is `1`.
*/
int getFormatArgument() {
if this.getParameter(0).getType() instanceof SystemIFormatProviderInterface
then result = 1
else
if
this.hasName("Assert") and
this.getDeclaringType().hasFullyQualifiedName("System.Diagnostics", "Debug")
then result = 2
else result = 0
}
override int getFormatArgument() { result = 0 }
}

pragma[nomagic]
Expand Down
Morty Proxy This is a proxified and sanitized view of the page, visit original site.