public void VisitStatement(Microsoft.CodeAnalysis.VisualBasic.Syntax.StatementSyntax statement, ExecutionState state) { var localDeclaration = statement as Microsoft.CodeAnalysis.VisualBasic.Syntax.LocalDeclarationStatementSyntax; if (localDeclaration == null) { return; } var varDeclaration = localDeclaration.Declarators.First() as Microsoft.CodeAnalysis.VisualBasic.Syntax.VariableDeclaratorSyntax; if (varDeclaration == null) { return; } foreach (var variable in localDeclaration.Declarators) { //Looking for the creation of a cookie (HttpCookie) var variableDecorator = variable; if (variableDecorator != null) { var expressionValue = variableDecorator.Initializer?.Value; if (expressionValue is Microsoft.CodeAnalysis.VisualBasic.Syntax.ObjectCreationExpressionSyntax) { var objCreation = (Microsoft.CodeAnalysis.VisualBasic.Syntax.ObjectCreationExpressionSyntax)expressionValue; var symbol = state.GetSymbol(objCreation); if (AnalyzerUtil.SymbolMatch(symbol, "HttpCookie", ".ctor")) { //It will override the initial state state.AddNewValue(variableDecorator.GetFirstToken().Text, // new VariableState(variable, VariableTaint.SAFE) // .AddTag(VariableTag.HttpCookie) // .AddSyntaxNode(variable)); } } } } }
public void VisitStatement(Microsoft.CodeAnalysis.VisualBasic.Syntax.StatementSyntax node, ExecutionState state) { }