[csharp] PartialDataflow/Dataflow Path Detection Issue with Byte Array Taint

[Hug0Vincent]

When using PartialDataflow, it displays a path that DataFlow is unable to identify. This issue may be related to taint being applied to an element within a byte array, rather than the array itself.

Here is my partial DataFlow query:

/**
 * @name Forward Partial Dataflow
 * @description Forward Partial Dataflow
 * @kind path-problem
 * @precision low
 * @problem.severity error
 * @id githubsecuritylab/forward-partial-dataflow
 * @tags template
 */

import csharp
import semmle.code.csharp.dataflow.TaintTracking
import PartialFlow::PartialPathGraph

private module MyConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) {
    (
      source.asParameter().getCallable().hasName("FileIStream")
    )
  }

  predicate isSink(DataFlow::Node sink) { none() }
}

private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>

int explorationLimit() { result = 3 }

private module PartialFlow = MyFlow::FlowExplorationFwd<explorationLimit/0>;

from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
where PartialFlow::partialFlow(source, sink, _)
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(), "this source"

Here is the path that I want to find:

In the previous screenshot the input variable is tainted.

Here is my DataFlow query:

/**
 * @name DataFlow configuration
 * @description DataFlow TaintTracking configuration
 * @kind path-problem
 * @precision low
 * @problem.severity error
 * @id githubsecuritylab/dataflow-query
 * @tags template
 */

import csharp
import DataFlow
import semmle.code.csharp.dataflow.TaintTracking
private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
import MyFlow::PathGraph

private module MyConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) {
    (
      source.asParameter().getCallable().hasName("FileIStream")
    )
  }

  predicate isSink(DataFlow::Node sink) {
    sink instanceof MySink
  }
}

class MySink extends ApiSinkExprNode {
  MySink(){
    exists(MethodCall c, Method m |
      c.getTarget() = m and
      m.hasName("Write") and
      c.getAnArgument() = this.asExpr()
    )
  }
}

module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>

from MyFlow::PathNode source, MyFlow::PathNode sink
where MyFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "Sample TaintTracking query"

The previous query does not yield any result even if the quick eval of my sink does:

My guess is that codeql taint the element of the byte array not the array itself as discussed here. I did not find the issue mentioned in the thread so I've opened this discussion.

[aschackmull]

You are exactly right. And the linked discussion on the PR is exactly the issue here. We need the Stream.Read model to taint the array instead of the elements of the array. We have an internal tracking issue for following up on this, but a lot of people are on vacation at the moment. cc: @michaelnebel

[michaelnebel]

Acknowledging that I have seen the ping, but I haven't had time to look into it yet.

[aschackmull]

In the interim, you can add

predicate allowImplicitRead(Node node, ContentSet c) {
 isSink(node) and c.isElement()
}

to your configuration. That should allow it to implicitly read the element content at the sink and thereby find the flow.

[Hug0Vincent]

Perfect it works with this, I'll wait until peoples come back, thank you so much.

[michaelnebel]

The improvement/fix has been merged: #20089
When it is released you should be able to remove the interim fix.

[Hug0Vincent]

Perfect thank you so much!