C# (CSharp) SecurityCodeScan.Test.Config ConfigurationTest.CreateAnalyzersOptionsWithConfig Examples

Example #1

File: ConfigTests.cs Project: tquentin/security-code-scan

        public void MergingUserConfig_NoChanges()
        {
            var options   = ConfigurationTest.CreateAnalyzersOptionsWithConfig("Behavior:");
            var newConfig = Manager.GetProjectConfiguration(options.AdditionalFiles);

            // ensuring that field count matches count of properties tested below
            Assert.AreEqual(11, typeof(Configuration).GetProperties(BindingFlags.Instance | BindingFlags.Public).Length);

            Assert.AreEqual(StartupConfiguration.ReportAnalysisCompletion, newConfig.ReportAnalysisCompletion);
            Assert.AreEqual(StartupConfiguration.AuditMode, newConfig.AuditMode);
            Assert.AreEqual(StartupConfiguration.Behavior.Count, newConfig.Behavior.Count);
            Assert.AreEqual(StartupConfiguration.TaintEntryPoints.Count, newConfig.TaintEntryPoints.Count);
            Assert.AreEqual(StartupConfiguration.MinimumPasswordValidatorProperties, newConfig.MinimumPasswordValidatorProperties);
            Assert.AreEqual(StartupConfiguration.PasswordValidatorRequiredLength, newConfig.PasswordValidatorRequiredLength);
            Assert.AreEqual(StartupConfiguration.PasswordValidatorRequiredProperties.Count, newConfig.PasswordValidatorRequiredProperties.Count);
            Assert.AreEqual(StartupConfiguration.PasswordFields.Count, newConfig.PasswordFields.Count);
            Assert.AreEqual(StartupConfiguration.ConstantFields.Count, newConfig.ConstantFields.Count);
            Assert.AreEqual(StartupConfiguration.CsrfGoups.Count, newConfig.CsrfGoups.Count);
            Assert.AreEqual(StartupConfiguration.TaintTypeNameToBit.Count, newConfig.TaintTypeNameToBit.Count);
        }

Example #2

File: ConfigTests.cs Project: tquentin/security-code-scan

        public void ArgTypesValidation(string payload, bool shouldThrow)
        {
            var options = ConfigurationTest.CreateAnalyzersOptionsWithConfig($@"
Behavior:
  Bla:
    Namespace: NS
    ClassName: CL
    Name: Foo
    Method:
      ArgTypes: ""{payload}""
");

            if (shouldThrow)
            {
                Assert.ThrowsException <Exception>(() => Manager.GetProjectConfiguration(options.AdditionalFiles));
            }
            else
            {
                Manager.GetProjectConfiguration(options.AdditionalFiles);
            }
        }

Example #3

File: ConfigTests.cs Project: tquentin/security-code-scan

        public void DifferentConfigVersion_Exception()
        {
            var options = ConfigurationTest.CreateAnalyzersOptionsWithConfig("MinimumPasswordValidatorProperties: 0", new Version(1, 2));

            Assert.ThrowsException <ArgumentException>(() => Manager.GetProjectConfiguration(options.AdditionalFiles));
        }

Example #4

File: TaintAnalyzisConfigurationTest.cs Project: zyj0021/security-code-scan

        public async Task AddSink()
        {
            var cSharpTest = @"
using System.Web.Mvc;

namespace sample
{
    class Test : Controller
    {
        public void Vulnerable(string param)
        {
        }

        public void TestMethod(string param)
        {
            Vulnerable(param);
        }
    }
}
";

            var visualBasicTest = @"
Imports System.Web.Mvc

Namespace sample
    Class Test
        Inherits Controller

        Public Sub Vulnerable(param As String)
        End Sub

        Public Sub TestMethod(param As String)
            Vulnerable(param)
        End Sub

    End Class
End Namespace
";

            await VerifyCSharpDiagnostic(cSharpTest).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest).ConfigureAwait(false);

            var testConfig = @"
Behavior:
  MyKey:
    Namespace: sample
    ClassName: Test
    Name: Vulnerable
    Method:
      InjectableArguments: [SCS0001: 0]
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);
            var expected = new DiagnosticResult
            {
                Id       = "SCS0001",
                Severity = DiagnosticSeverity.Warning,
            };

            await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #5

        // [DataRow("",        "new Manager { Validator",            "}", false)] todo: fix to work as in the previous line
        public async Task PasswordValidatorAsMember(string modifier, string payload, string payload2, bool vb)
        {
            var cSharpTest = $@"
using Microsoft.AspNet.Identity;

namespace WebApplicationSandbox.Controllers
{{
    public class Manager
    {{
        public {modifier}PasswordValidator Validator;
    }}

    public class TestApp
    {{
        public void TestMethod()
        {{
            {payload} = new PasswordValidator
            {{
                RequiredLength = 8,
                RequireNonLetterOrDigit = true,
                RequireDigit = true,
                RequireLowercase = true,
                RequireUppercase = true,
            }}{payload2};
        }}
    }}
}}
";

            var visualBasicTest = $@"
Imports Microsoft.AspNet.Identity

Namespace WebApplicationSandbox.Controllers
    Public Class Manager
        Public {modifier.CSharpReplaceToVBasic()}Validator As PasswordValidator
    End Class

    Public Class TestApp
        Public Sub TestMethod()
            {payload.CSharpReplaceToVBasic()} = New PasswordValidator With {{
                .RequiredLength = 8,
                .RequireNonLetterOrDigit = True,
                .RequireDigit = True,
                .RequireLowercase = True,
                .RequireUppercase = True
            }}
        End Sub
    End Class
End Namespace
";

            await VerifyCSharpDiagnostic(cSharpTest).ConfigureAwait(false);

            if (vb)
            {
                await VerifyVisualBasicDiagnostic(visualBasicTest).ConfigureAwait(false);
            }

            var testConfig = @"
PasswordValidatorRequiredLength: 9
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);
            var expected = new DiagnosticResult
            {
                Id       = "SCS0032",
                Severity = DiagnosticSeverity.Warning
            };

            await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);

            if (vb)
            {
                await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            }
        }

Example #6

        public async Task TwoDifferentProjectConfigs()
        {
            var cSharpTest = @"
using System.Web.Mvc;

namespace sample
{
    public class TestController : Controller
    {
        public static string Safe (string param)
        {
            return """";
        }

        public void Vulnerable(string param)
        {
        }

        public void TestMethod(string param)
        {
            Vulnerable(param);
            Vulnerable(Safe(""test""));
        }
    }
}
";

            var visualBasicTest = @"
Imports System.Web.Mvc

Namespace sample
    Public Class TestController
        Inherits Controller

        Public Shared Function Safe(param As String) As String
            Return """"
        End Function

        Public Sub Vulnerable(param As String)
        End Sub

        Public Sub TestMethod(param As String)
            Vulnerable(param)
            Vulnerable(Safe(""test""))
        End Sub

    End Class
End Namespace
";

            await VerifyCSharpDiagnostic(cSharpTest).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest).ConfigureAwait(false);

            // todo: review the test, why this is unused?
            var testConfig = @"
Sinks:
  - Type: sample.TestController
    TaintTypes:
      - SCS0002
    Methods:
    - Name: Vulnerable
      Arguments:
        - param
";

            await VerifyCSharpDiagnostic(cSharpTest).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest).ConfigureAwait(false);

            testConfig = @"
Sinks:
  - Type: sample.TestController
    TaintTypes:
      - SCS0002
    Methods:
    - Name: Vulnerable
      Arguments:
        - param

TaintSources:
  - Type: sample.TestController
    TaintTypes:
      - SCS0002
    Methods:
      - Tainted
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);
            var expected = new DiagnosticResult
            {
                Id       = "SCS0002",
                Severity = DiagnosticSeverity.Warning,
            };

            optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #7

File: TaintAnalyzisConfigurationTest.cs Project: zyj0021/security-code-scan

        public async Task AddConstantValue()
        {
            var cSharpTest = @"
using System.Data.SqlClient;
using System.Web.Mvc;

namespace sample
{
    class Test : Controller
    {
        public static readonly string Safe = ""Safe"";

        static void TestMethod()
        {
            new SqlCommand(Safe);
        }
    }
}
";

            var visualBasicTest = @"
Imports System.Data.SqlClient
Imports System.Web.Mvc

Namespace sample
    Class Test
        Inherits Controller

        Public Shared ReadOnly Safe As String = ""Safe""

        Private Shared Sub TestMethod()
            Dim com As New SqlCommand(Safe)
        End Sub
    End Class
End Namespace
";

            var expected = new DiagnosticResult
            {
                Id       = "SCS0026",
                Severity = DiagnosticSeverity.Warning,
            };

            var testConfig = @"
AuditMode: true
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);

            testConfig = @"
AuditMode: true

ConstantFields: [sample.Test.Safe]
";

            optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, null, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, null, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #8

File: WeakPasswordValidatorPropertyAnalyzerConfigTests.cs Project: JarLob/security-code-scan

        public async Task PasswordValidatorRequireSpecificProperty(string properties, int propertiesCount)
        {
            var cSharpTest = @"
using Microsoft.AspNet.Identity;

namespace WebApplicationSandbox.Controllers
{
    public class TestApp
    {
        public PasswordValidator TestMethod()
        {
            PasswordValidator pwdv = new PasswordValidator
            {
                RequiredLength = " + 8 + @"
            };
            return pwdv;
        }
    }
}
";

            var visualBasicTest = @"
Imports Microsoft.AspNet.Identity

Namespace WebApplicationSandbox.Controllers
    Public Class TestApp
        Public Function TestMethod() As PasswordValidator
            Dim pwdv As New PasswordValidator() With { _
                .RequiredLength = " + 8 + @"
            }
            return pwdv
        End Function
    End Class
End Namespace
";

            var expected = new DiagnosticResult
            {
                Id       = "SCS0033",
                Severity = DiagnosticSeverity.Warning
            };

            await VerifyCSharpDiagnostic(cSharpTest, expected).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected).ConfigureAwait(false);

            var testConfig = $@"
MinimumPasswordValidatorProperties: 0
PasswordValidatorRequiredProperties: [{properties}]
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            expected = new DiagnosticResult
            {
                Id       = "SCS0034",
                Severity = DiagnosticSeverity.Warning
            };

            await VerifyCSharpDiagnostic(cSharpTest, Enumerable.Repeat(expected, propertiesCount).ToArray(), optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, Enumerable.Repeat(expected, propertiesCount).ToArray(), optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #9

File: TaintAnalyzisConfigurationTest.cs Project: zyj0021/security-code-scan

        public async Task AddBehavior()
        {
            var cSharpTest = @"
using System.Data.SqlClient;
using System.Web.Mvc;

namespace sample
{
    class Test : Controller
    {
        public string Safe (string param)
        {
            return param;
        }

        public void TestMethod()
        {
            var testString = ""test"";
            new SqlCommand(Safe(testString));
        }
    }
}
";

            var visualBasicTest = @"
Imports System.Web.Mvc
Imports System.Data.SqlClient

Namespace sample
    Class Test
        Inherits Controller

        Public Function Safe(param As String) As String
            Return param
        End Function

        Public Sub TestMethod()
            Dim testString = ""test""
            Dim com As New SqlCommand(Safe(testString))
        End Sub
    End Class
End Namespace
";

            var expected = new DiagnosticResult
            {
                Id       = "SCS0026",
                Severity = DiagnosticSeverity.Warning,
            };

            var testConfig = @"
AuditMode: true
";
            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);

            testConfig = @"
AuditMode: true

Behavior:
  MyKey:
    Namespace: sample
    ClassName: Test
    Name: Safe
    Method:
      Returns:
        Taint: Safe
";

            optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, null, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, null, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #10

File: UnknownPasswordApiAnalyzerConfigTest.cs Project: zyj0021/security-code-scan

        public async Task HardcodedPassword(string classPayload, string payload, string pattern, bool warn)
        {
            var cSharpTest = $@"
#pragma warning disable 8019
    using System;
#pragma warning restore 8019

namespace VulnerableApp
{{
#pragma warning disable CS0414
    class HardCodedPassword
    {{
        private string SecretWord{classPayload};

        void Foo()
        {{
            {payload};
        }}
    }}
#pragma warning restore CS0414
}}
";

            var visualBasicTest = $@"
#Disable Warning BC50001
    Imports System
#Enable Warning BC50001

Namespace VulnerableApp
    Class HardCodedPassword
        Private SecretWord As String{classPayload}

        Private Sub Foo()
            {payload}
        End Sub
    End Class
End Namespace
";

            await VerifyCSharpDiagnostic(cSharpTest).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest).ConfigureAwait(false);

            var testConfig = $@"
PasswordFields: [{pattern}]
";
            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            if (warn)
            {
                var expected = new DiagnosticResult
                {
                    Id       = "SCS0015",
                    Severity = DiagnosticSeverity.Warning
                };

                await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
                await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            }
            else
            {
                await VerifyCSharpDiagnostic(cSharpTest, null, optionsWithProjectConfig).ConfigureAwait(false);
                await VerifyVisualBasicDiagnostic(visualBasicTest, null, optionsWithProjectConfig).ConfigureAwait(false);
            }
        }

Example #11

File: WeakPasswordValidatorPropertyAnalyzerConfigTests.cs Project: JarLob/security-code-scan

        public async Task PasswordValidatorDecreaseRequiredLength()
        {
            var cSharpTest = @"
using Microsoft.AspNet.Identity;

namespace WebApplicationSandbox.Controllers
{
    public class TestApp
    {
        public PasswordValidator TestMethod()
        {
            PasswordValidator pwdv = new PasswordValidator
            {
                RequiredLength = " + 7 + @",
                RequireNonLetterOrDigit = true,
                RequireDigit = true,
                RequireLowercase = true,
                RequireUppercase = true,
            };
            return pwdv;
        }
    }
}
";

            var visualBasicTest = @"
Imports Microsoft.AspNet.Identity

Namespace WebApplicationSandbox.Controllers
    Public Class TestApp
        Public Function TestMethod() As PasswordValidator
            Dim pwdv As New PasswordValidator() With { _
                .RequiredLength = " + 7 + @", _
                .RequireNonLetterOrDigit = True, _
                .RequireDigit = True, _
                .RequireLowercase = True, _
                .RequireUppercase = True _
            }
            Return pwdv
        End Function
    End Class
End Namespace
";

            var expected = new DiagnosticResult
            {
                Id       = "SCS0032",
                Severity = DiagnosticSeverity.Warning
            };

            await VerifyCSharpDiagnostic(cSharpTest, expected).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected).ConfigureAwait(false);

            var testConfig = @"
PasswordValidatorRequiredLength: 7
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, null, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, null, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #12

        public async Task TwoDifferentProjectConfigs()
        {
            var cSharpTest = @"
namespace sample
{
    class Test
    {
        public static string Safe (string param)
        {
            return param;
        }

        public void Vulnerable(string param)
        {
        }

        public void TestMethod(string param)
        {
            Vulnerable(param);
            Vulnerable(Safe(""test""));
        }
    }
}
";

            var visualBasicTest = @"
Namespace sample
    Class Test
        Public Shared Function Safe(param As String) As String
            Return param
        End Function

        Public Sub Vulnerable(param As String)
        End Sub

        Public Sub TestMethod(param As String)
            Vulnerable(param)
            Vulnerable(Safe(""test""))
        End Sub

    End Class
End Namespace
";

            await VerifyCSharpDiagnostic(cSharpTest).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest).ConfigureAwait(false);

            var testConfig = @"
Sinks:
  MyKey:
    Namespace: sample
    ClassName: Test
    Member: method
    Name: Vulnerable
    InjectableArguments: [0]
    Locale: SCS0001
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);
            var expected = new DiagnosticResult
            {
                Id       = "SCS0001",
                Severity = DiagnosticSeverity.Warning,
            };

            await VerifyCSharpDiagnostic(cSharpTest, new [] { expected, expected }, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, new[] { expected, expected }, optionsWithProjectConfig).ConfigureAwait(false);

            testConfig = @"
Sinks:
  MyKey:
    Namespace: sample
    ClassName: Test
    Member: method
    Name: Vulnerable
    InjectableArguments: [0]
    Locale: SCS0001

Behavior:
  MyKey:
    Namespace: sample
    ClassName: Test
    Member: method
    Name: Safe
    TaintFromArguments: [-1]
";

            optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #13

        public async Task AddBehavior()
        {
            var cSharpTest = @"
using System.Data.SqlClient;

namespace sample
{
    class Test
    {
        public static string Safe (string param)
        {
            return param;
        }

        static void TestMethod()
        {
            var testString = ""test"";
            new SqlCommand(Safe(testString));
        }
    }
}
";

            var visualBasicTest = @"
Imports System.Data.SqlClient

Namespace sample
    Class Test
        Public Shared Function Safe(param As String) As String
            Return param
        End Function
        Private Sub TestMethod()
            Dim testString = ""test""
            Dim com As New SqlCommand(Safe(testString))
        End Sub
    End Class
End Namespace
";

            var expected = new DiagnosticResult
            {
                Id       = "SCS0026",
                Severity = DiagnosticSeverity.Warning,
            };

            await VerifyCSharpDiagnostic(cSharpTest, expected).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected).ConfigureAwait(false);

            var testConfig = @"
Behavior:
  MyKey:
    Namespace: sample
    ClassName: Test
    Member: method
    Name: Safe
    TaintFromArguments: [-1]
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, null, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, null, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #14

        public async Task RemoveSink()
        {
            var cSharpTest = @"
using System.Web.Mvc;

namespace sample
{
    public class TestController : Controller
    {
        public void Vulnerable(string param)
        {
        }

        public void TestMethod(string param)
        {
            Vulnerable(param);
        }
    }
}
";

            var visualBasicTest = @"
Imports System.Web.Mvc

Namespace sample
    Public Class TestController
        Inherits Controller

        Public Sub Vulnerable(param As String)
        End Sub

        Public Sub TestMethod(param As String)
            Vulnerable(param)
        End Sub

    End Class
End Namespace
";

            var testConfig = @"
Sinks:
  - Type: sample.TestController
    TaintTypes:
      - SCS0002
    Methods:
      - Name: Vulnerable
        Arguments:
          - param
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);
            var expected = new DiagnosticResult
            {
                Id       = "SCS0002",
                Severity = DiagnosticSeverity.Warning,
            };

            await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);

            testConfig = @"
Sinks:
  - Type: sample.TestController
    TaintTypes:
      - SCS0002
";

            optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);
            await VerifyCSharpDiagnostic(cSharpTest, null, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, null, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #15

        public async Task AddCustomCsrfAttributeWithCondition()
        {
            var cSharpTest = @"
using System;
using System.Web.Mvc;

namespace VulnerableApp
{
    [System.AttributeUsage(System.AttributeTargets.Method)]
    public class TestAttribute : Attribute
    {
        public HttpVerbs AppliesFor { get; private set; }
        public bool PreventsCsrf { get; private set; }

        public TestAttribute(HttpVerbs appliesFor, bool preventsCsrf)
        {
            AppliesFor = appliesFor;
            PreventsCsrf = preventsCsrf;
        }
    }

    public class TestController : Controller
    {
        [TestAttribute(HttpVerbs.Post, true)]
        public ActionResult ControllerMethod(string input)
        {
            return null;
        }
    }
}
";

            var visualBasicTest = @"
Imports System
Imports System.Web.Mvc

Namespace VulnerableApp
    <AttributeUsage(System.AttributeTargets.Method)>
    Public Class TestAttribute
        Inherits Attribute

    Public AppliesFor As HttpVerbs
    Public PreventsCsrf As Boolean

    Sub New(appliesFor As HttpVerbs, preventsCsrf As Boolean)
        AppliesFor = appliesFor
        PreventsCsrf = preventsCsrf
    End Sub

    End Class

    Public Class TestController
        Inherits Controller

        <TestAttribute(HttpVerbs.Post, True)>
        Public Function ControllerMethod(input As String) As ActionResult
            Return Nothing
        End Function
    End Class
End Namespace
";

            var testConfig = @"
CsrfProtection:
  - Name: ASP.NET MVC
    Method:
      Attributes:
        Include:
          - Name: VulnerableApp.TestAttribute
            Condition: {0: {Value: 2}}
    AntiCsrfAttributes:
      - Name: VulnerableApp.TestAttribute
        Condition: {1: {Value: true}}
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, null, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, null, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #16

File: TaintAnalyzisConfigurationTest.cs Project: zyj0021/security-code-scan

        public async Task TwoDifferentProjectConfigs()
        {
            var cSharpTest = @"
using System.Web.Mvc;

namespace sample
{
    class Test : Controller
    {
        public static string Safe (string param)
        {
            return param;
        }

        public void Vulnerable(string param)
        {
        }

        public void TestMethod(string param)
        {
            Vulnerable(param);
            Vulnerable(Safe(""test""));
        }
    }
}
";

            var visualBasicTest = @"
Imports System.Web.Mvc

Namespace sample
    Class Test
        Inherits Controller

        Public Shared Function Safe(param As String) As String
            Return param
        End Function

        Public Sub Vulnerable(param As String)
        End Sub

        Public Sub TestMethod(param As String)
            Vulnerable(param)
            Vulnerable(Safe(""test""))
        End Sub

    End Class
End Namespace
";

            await VerifyCSharpDiagnostic(cSharpTest).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest).ConfigureAwait(false);

            var testConfig = @"
AuditMode: true

Behavior:
  MyKey:
    Namespace: sample
    ClassName: Test
    Name: Vulnerable
    Method:
      InjectableArguments: [SCS0001: 0]
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);
            var expected = new DiagnosticResult
            {
                Id       = "SCS0001",
                Severity = DiagnosticSeverity.Warning,
            };

            await VerifyCSharpDiagnostic(cSharpTest, new [] { expected, expected }, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, new[] { expected, expected }, optionsWithProjectConfig).ConfigureAwait(false);

            testConfig = @"
AuditMode: true

Behavior:
  MyKey1:
    Namespace: sample
    ClassName: Test
    Name: Vulnerable
    Method:
      InjectableArguments: [SCS0001: 0]

  MyKey2:
    Namespace: sample
    ClassName: Test
    Name: Safe
    Method:
      Returns:
        Taint: Safe
";

            optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #17

        public async Task AddCustomCsrfAttributeForMvc()
        {
            var cSharpTest = @"
using System;
using System.Web.Mvc;

namespace VulnerableApp
{
    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
    public class TestAttribute : Attribute
    {
    }

    public class TestController : Controller
    {
        [HttpPost]
        [TestAttribute]
        public ActionResult ControllerMethod(string input)
        {
            return null;
        }
    }
}
";

            var visualBasicTest = @"
Imports System
Imports System.Web.Mvc

Namespace VulnerableApp
    <System.AttributeUsage(System.AttributeTargets.Class Or System.AttributeTargets.Method)>
    Public Class TestAttribute
        Inherits Attribute
    End Class

    Public Class TestController
        Inherits Controller

        <HttpPost>
        <TestAttribute>
        Public Function ControllerMethod(input As String) As ActionResult
            Return Nothing
        End Function
    End Class
End Namespace
";

            var expected = new DiagnosticResult
            {
                Id       = CsrfTokenDiagnosticAnalyzer.DiagnosticId,
                Severity = DiagnosticSeverity.Warning
            };

            await VerifyCSharpDiagnostic(cSharpTest, expected.WithLocation(16, 29)).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected.WithLocation(16, 25)).ConfigureAwait(false);

            var testConfig = @"
CsrfProtection:
  - Name: ASP.NET MVC
    AntiCsrfAttributes:
      - Name: VulnerableApp.TestAttribute
";

            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, null, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, null, optionsWithProjectConfig).ConfigureAwait(false);
        }

Example #18

        public async Task AddTaintSource()
        {
            var cSharpTest = @"
using System.Data.SqlClient;
using System.Web.Mvc;

namespace sample
{
    public class TestController : Controller
    {
        public string Tainted ()
        {
            return """";
        }

        public void TestMethod()
        {
            new SqlCommand(Tainted());
        }
    }
}
";

            var visualBasicTest = @"
Imports System.Web.Mvc
Imports System.Data.SqlClient

Namespace sample
    Public Class TestController
        Inherits Controller

        Public Function Tainted() As String
            Return """"
        End Function

        Public Sub TestMethod()
            Dim com As New SqlCommand(Tainted())
        End Sub
    End Class
End Namespace
";

            await VerifyCSharpDiagnostic(cSharpTest).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest).ConfigureAwait(false);

            var expected = new DiagnosticResult
            {
                Id       = "SCS0002",
                Severity = DiagnosticSeverity.Warning,
            };

            var testConfig = @"
TaintSources:
  - Type: sample.TestController
    TaintTypes:
      - SCS0002
    Methods:
      - Tainted
";
            var optionsWithProjectConfig = ConfigurationTest.CreateAnalyzersOptionsWithConfig(testConfig);

            await VerifyCSharpDiagnostic(cSharpTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
            await VerifyVisualBasicDiagnostic(visualBasicTest, expected, optionsWithProjectConfig).ConfigureAwait(false);
        }