public void VisitStatement(Microsoft.CodeAnalysis.VisualBasic.Syntax.StatementSyntax statement, ExecutionState state)
{
var localDeclaration = statement as Microsoft.CodeAnalysis.VisualBasic.Syntax.LocalDeclarationStatementSyntax;
if (localDeclaration == null)
{
return;
}
var varDeclaration = localDeclaration.Declarators.First() as Microsoft.CodeAnalysis.VisualBasic.Syntax.VariableDeclaratorSyntax;
if (varDeclaration == null)
{
return;
}
foreach (var variable in localDeclaration.Declarators)
{
//Looking for the creation of a cookie (HttpCookie)
var variableDecorator = variable;
if (variableDecorator != null)
{
var expressionValue = variableDecorator.Initializer?.Value;
if (expressionValue is Microsoft.CodeAnalysis.VisualBasic.Syntax.ObjectCreationExpressionSyntax)
{
var objCreation = (Microsoft.CodeAnalysis.VisualBasic.Syntax.ObjectCreationExpressionSyntax)expressionValue;
var symbol = state.GetSymbol(objCreation);
if (AnalyzerUtil.SymbolMatch(symbol, "HttpCookie", ".ctor"))
{
//It will override the initial state
state.AddNewValue(variableDecorator.GetFirstToken().Text, //
new VariableState(variable, VariableTaint.SAFE) //
.AddTag(VariableTag.HttpCookie) //
.AddSyntaxNode(variable));
}
}
}
}
}
public void VisitStatement(Microsoft.CodeAnalysis.VisualBasic.Syntax.StatementSyntax node, ExecutionState state)
{
}