Fix AddCommandLine models and add/fix tests

Author: egregius313

csharp/ql/lib/ext/Microsoft.Extensions.Configuration.model.yml

@@ -11,5 +11,5 @@ extensions:
     data:
       - ["Microsoft.Extensions.Configuration", "IConfiguration", True, "get_Item", "(System.String)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
       - ["Microsoft.Extensions.Configuration", "IConfigurationBuilder", True, "Build", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
-      - ["Microsoft.Extensions.Configuration", "CommandLineConfigurationExtensions", False, "AddCommandLine", "(Microsoft.Extensions.Configuration.IConfigurationBuilder,System.String[])", "", "Argument[1]", "ReturnValue", "taint", "manual"]
-      - ["Microsoft.Extensions.Configuration", "CommandLineConfigurationExtensions", False, "AddCommandLine", "(Microsoft.Extensions.Configuration.IConfigurationBuilder,System.String[],System.Collections.Generic.IDictionary<System.String,System.String>)", "", "Argument[1..2]", "ReturnValue", "taint", "manual"]
+      - ["Microsoft.Extensions.Configuration", "CommandLineConfigurationExtensions", False, "AddCommandLine", "", "", "Argument[1..2]", "Argument[0]", "taint", "manual"]
+      - ["Microsoft.Extensions.Configuration", "CommandLineConfigurationExtensions", False, "AddCommandLine", "", "", "Argument[1..2]", "ReturnValue", "taint", "manual"]

csharp/ql/test/library-tests/dataflow/flowsources/local/commandargs/CommandArgs.cs

@@ -1,8 +1,10 @@
 using System;
+using System.Collections.Generic;
+using Microsoft.Extensions.Configuration;
 
 namespace CommandArgs
 {
-    class CommandArgsUse
+    public class CommandArgsUse
     {
         public static void M1()
         {
@@ -13,5 +15,25 @@ public static void M2()
         {
             string result = Environment.CommandLine;
         }
+
+        public static void Main(string[] args)
+        {
+            var builder = new ConfigurationBuilder();
+            builder.AddCommandLine(args);
+            var config = builder.Build();
+            var arg1 = config["arg1"];
+            Sink(arg1);
+        }
+
+        public static void AddCommandLine2()
+        {
+            var config = new ConfigurationBuilder()
+                .AddCommandLine(Environment.GetCommandLineArgs())
+                .Build();
+            var arg1 = config["arg1"];
+            Sink(arg1);
+        }
+
+        static void Sink(object o) { }
     }
 }

csharp/ql/test/library-tests/dataflow/flowsources/local/commandargs/CommandArgs.expected

@@ -1,2 +1,4 @@
-| CommandArgs.cs:9:29:9:60 | call to method GetCommandLineArgs |
-| CommandArgs.cs:14:29:14:51 | access to property CommandLine |
+| CommandArgs.cs:11:29:11:60 | call to method GetCommandLineArgs |
+| CommandArgs.cs:16:29:16:51 | access to property CommandLine |
+| CommandArgs.cs:19:42:19:45 | args |
+| CommandArgs.cs:31:33:31:64 | call to method GetCommandLineArgs |

csharp/ql/test/library-tests/dataflow/flowsources/local/commandargs/CommandArgs.ext.yml

@@ -0,0 +1,7 @@
+extensions:
+
+  - addsTo:
+      pack: codeql/threat-models
+      extensible: threatModelConfiguration
+    data:
+      - ["commandargs", true, 0]

csharp/ql/test/library-tests/dataflow/flowsources/local/commandargs/CommandArgs.ql

@@ -1,6 +1,6 @@
 import csharp
-import semmle.code.csharp.dataflow.internal.ExternalFlow
+import semmle.code.csharp.security.dataflow.flowsources.FlowSources
 
 from DataFlow::Node source
-where sourceNode(source, "commandargs")
+where source instanceof ThreatModelFlowSource
 select source

csharp/ql/test/library-tests/dataflow/flowsources/local/commandargs/CommandLineFlow.ext.yml

@@ -0,0 +1,7 @@
+extensions:
+
+  - addsTo:
+      pack: codeql/threat-models
+      extensible: threatModelConfiguration
+    data:
+      - ["commandargs", true, 0]

csharp/ql/test/library-tests/dataflow/flowsources/local/commandargs/CommandLineFlow.ql

@@ -0,0 +1,16 @@
+import csharp
+import semmle.code.csharp.security.dataflow.flowsources.FlowSources
+
+module CommandLineFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
+
+  predicate isSink(DataFlow::Node sink) {
+    exists(MethodCall mc | mc.getTarget().hasName("Sink") | sink.asExpr() = mc.getArgument(0))
+  }
+}
+
+module CommandLineFlow = TaintTracking::Global<CommandLineFlowConfig>;
+
+from DataFlow::Node source, DataFlow::Node sink
+where CommandLineFlow::flow(source, sink)
+select sink, source

csharp/ql/test/library-tests/dataflow/flowsources/local/commandargs/options

@@ -0,0 +1,3 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: ${testdir}/../../../../../resources/stubs/System.Web.cs