Skip to content

Commit 97a3734

Browse files
committed
fix
1 parent ada1c28 commit 97a3734

File tree

2 files changed

+1
-12
lines changed

2 files changed

+1
-12
lines changed

csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description Loading a .NET assembly based on a path constructed from user-controlled sources
44
* may allow a malicious user to load code which modifies the program in unintended
55
* ways.
6-
* @kind path-problem
6+
* @kind problem
77
* @id cs/assembly-path-injection
88
* @problem.severity error
99
* @security-severity 8.2
@@ -15,7 +15,6 @@
1515
import csharp
1616
import semmle.code.csharp.security.dataflow.flowsources.Remote
1717
import semmle.code.csharp.commons.Util
18-
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1918

2019
/**
2120
* A taint-tracking configuration for untrusted user input used to load a DLL.
Original file line numberDiff line numberDiff line change
@@ -1,11 +1 @@
1-
edges
2-
| Test.cs:7:26:7:48 | access to property QueryString : NameValueCollection | Test.cs:7:26:7:63 | access to indexer : String |
3-
| Test.cs:7:26:7:48 | access to property QueryString : NameValueCollection | Test.cs:10:36:10:46 | access to local variable libraryName |
4-
| Test.cs:7:26:7:63 | access to indexer : String | Test.cs:10:36:10:46 | access to local variable libraryName |
5-
nodes
6-
| Test.cs:7:26:7:48 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
7-
| Test.cs:7:26:7:63 | access to indexer : String | semmle.label | access to indexer : String |
8-
| Test.cs:10:36:10:46 | access to local variable libraryName | semmle.label | access to local variable libraryName |
9-
subpaths
10-
#select
111
| Test.cs:10:36:10:46 | access to local variable libraryName | This assembly path depends on a $@. | Test.cs:7:26:7:48 | access to property QueryString | user-provided value |

0 commit comments

Comments
 (0)