Skip to content

Commit c190dd2

Browse files
egregius313egregius313
authored
Merge pull request #15877 from egregius313/egregius313/csharp/mad/sources/windows-registry
C#: Add source models for values from the Windows registry
2 parents d544899 + 7745c2c commit c190dd2

File tree

10 files changed

+107
-1
lines changed

10 files changed

+107
-1
lines changed

‎csharp/ql/lib/change-notes/2024-03-11-registry-sources.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added the `windows-registry` source kind and threat model to represent values which come from the registry on Windows.

‎csharp/ql/lib/ext/Microsoft.Win32.model.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/csharp-all
4+
extensible: sourceModel
5+
data:
6+
- ["Microsoft.Win32", "Registry", False, "GetValue", "(System.String,System.String,System.Object)", "", "ReturnValue", "windows-registry", "manual"]
7+
- ["Microsoft.Win32", "RegistryKey", False, "GetSubKeyNames", "()", "", "ReturnValue", "windows-registry", "manual"]
8+
- ["Microsoft.Win32", "RegistryKey", False, "GetValue", "", "", "ReturnValue", "windows-registry", "manual"]
9+
- ["Microsoft.Win32", "RegistryKey", False, "GetValueNames", "()", "", "ReturnValue", "windows-registry", "manual"]

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,3 +55,16 @@ abstract class CommandLineArgumentSource extends LocalFlowSource {
5555
private class MainMethodArgumentSource extends CommandLineArgumentSource {
5656
MainMethodArgumentSource() { this.asParameter() = any(MainMethod mainMethod).getAParameter() }
5757
}
58+
59+
/**
60+
* A data flow source that represents the access of a value from the Windows registry.
61+
*/
62+
abstract class WindowsRegistrySource extends LocalFlowSource {
63+
override string getThreatModel() { result = "windows-registry" }
64+
65+
override string getSourceType() { result = "a value from the Windows registry" }
66+
}
67+
68+
private class ExternalWindowsRegistrySource extends WindowsRegistrySource {
69+
ExternalWindowsRegistrySource() { sourceNode(this, "windows-registry") }
70+
}

‎csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
| UseRegistry.cs:10:36:10:58 | call to method GetValue | windows-registry |
2+
| UseRegistry.cs:16:36:16:58 | call to method GetValue | windows-registry |
3+
| UseRegistry.cs:22:36:22:58 | call to method GetValue | windows-registry |
4+
| UseRegistry.cs:28:36:28:58 | call to method GetValue | windows-registry |
5+
| UseRegistry.cs:34:36:34:58 | call to method GetValue | windows-registry |
6+
| UseRegistry.cs:40:36:40:58 | call to method GetValue | windows-registry |
7+
| UseRegistry.cs:46:35:46:53 | call to method GetValueNames | windows-registry |
8+
| UseRegistry.cs:52:36:52:55 | call to method GetSubKeyNames | windows-registry |

‎csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ext.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
3+
- addsTo:
4+
pack: codeql/threat-models
5+
extensible: threatModelConfiguration
6+
data:
7+
- ["windows-registry", true, 0]

‎csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import csharp
2+
import semmle.code.csharp.security.dataflow.flowsources.FlowSources
3+
4+
from DataFlow::Node source
5+
where source instanceof ThreatModelFlowSource
6+
select source, source.(SourceNode).getThreatModel()

‎csharp/ql/test/library-tests/dataflow/flowsources/local/registry/UseRegistry.cs

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
using Microsoft.Win32;
2+
3+
namespace Test
4+
{
5+
class UseRegistry
6+
{
7+
public static void GetRegistryValue(string keyName, string valueName)
8+
{
9+
RegistryKey key = Registry.LocalMachine.OpenSubKey(keyName);
10+
string value = (string)key.GetValue(valueName);
11+
}
12+
13+
public static void GetRegistryValue2(string keyName, string valueName)
14+
{
15+
RegistryKey key = Registry.CurrentUser.OpenSubKey(keyName);
16+
string value = (string)key.GetValue(valueName);
17+
}
18+
19+
public static void GetRegistryValue3(string keyName, string valueName)
20+
{
21+
RegistryKey key = Registry.ClassesRoot.OpenSubKey(keyName);
22+
string value = (string)key.GetValue(valueName);
23+
}
24+
25+
public static void GetRegistryValue4(string keyName, string valueName)
26+
{
27+
RegistryKey key = Registry.Users.OpenSubKey(keyName);
28+
string value = (string)key.GetValue(valueName);
29+
}
30+
31+
public static void GetRegistryValue5(string keyName, string valueName)
32+
{
33+
RegistryKey key = Registry.CurrentConfig.OpenSubKey(keyName);
34+
string value = (string)key.GetValue(valueName);
35+
}
36+
37+
public static void GetRegistryValue6(string keyName, string valueName)
38+
{
39+
RegistryKey key = Registry.PerformanceData.OpenSubKey(keyName);
40+
string value = (string)key.GetValue(valueName);
41+
}
42+
43+
public static void GetRegistryValueNames(string keyName, string valueName)
44+
{
45+
RegistryKey key = Registry.LocalMachine.OpenSubKey(keyName);
46+
string[] valueNames = key.GetValueNames();
47+
}
48+
49+
public static void GetRegistrySubKeyNames(string keyName, string valueName)
50+
{
51+
RegistryKey key = Registry.LocalMachine.OpenSubKey(keyName);
52+
string[] subKeyNames = key.GetSubKeyNames();
53+
}
54+
}
55+
}

‎csharp/ql/test/library-tests/dataflow/flowsources/local/registry/options

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
3+
semmle-extractor-options: ${testdir}/../../../../../resources/stubs/Microsoft.VisualStudio.TestTools.UnitTesting.cs

‎shared/mad/codeql/mad/ModelValidation.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ module KindValidation<KindValidationConfigSig Config> {
120120
// Java
121121
"android-external-storage-dir", "contentprovider",
122122
// C#
123-
"file-write",
123+
"file-write", "windows-registry",
124124
// JavaScript
125125
"database-access-result"
126126
]

‎shared/threat-models/ext/threat-model-grouping.model.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ extensions:
1616
- ["commandargs", "local"]
1717
- ["environment", "local"]
1818
- ["file", "local"]
19+
- ["windows-registry", "local"]
1920

2021
# Android threat models
2122
- ["android-external-storage-dir", "android"]

0 commit comments

Comments
 (0)