public void SystemProcessUnsafeConcatinationAnalyserReportsNothingIfArgumentsIsMethodCall()
{
string code = @"
using System;
public class TestClass
{
public void TestMethod()
{
System.Diagnostics.Process.Start(""CMD.exe"", this.GetArguments());
}
private string GetArguments()
{
return ""echo hello"";
}
}
";
CompilationUnitSyntax root = CSharpSyntaxTree.ParseText(code).GetCompilationUnitRoot();
SystemProcessUnsafeConcatinationAnalyser analyser = new SystemProcessUnsafeConcatinationAnalyser();
analyser.Visit(root);
IReadOnlyCollection <AnalyserItem> result = analyser.AnalyserItems;
Assert.Empty(result);
}
public void SystemProcessUnsafeConcatinationAnalyserReportsIfArgumentsVariableIsNotSafelyConcatenatedWithMethodCall()
{
string code = @"
using System;
public class TestClass
{
public void TestMethod()
{
string arguments = ""echo Hello"" + this.GetString();
System.Diagnostics.Process.Start(""CMD.exe"", arguments);
}
private string GetString()
{
return "" World"";
}
}
";
CompilationUnitSyntax root = CSharpSyntaxTree.ParseText(code).GetCompilationUnitRoot();
SystemProcessUnsafeConcatinationAnalyser analyser = new SystemProcessUnsafeConcatinationAnalyser();
analyser.Visit(root);
IReadOnlyCollection <AnalyserItem> result = analyser.AnalyserItems;
Assert.NotEmpty(result);
Assert.Equal(1, result.Count);
Assert.Equal("Concatinated process start arguments are unsafe", result.Last().Message);
Assert.Equal(8, result.Last().NodeReference.GetSyntax().GetLocation().GetMappedLineSpan().StartLinePosition.Line);
}
public void SystemProcessUnsafeConcatinationAnalyserReportsNothingIfArgumentsVariableIsParameter()
{
string code = @"
using System;
public class TestClass
{
public void TestMethod(string arguments)
{
System.Diagnostics.Process.Start(""CMD.exe"", arguments);
}
}
";
CompilationUnitSyntax root = CSharpSyntaxTree.ParseText(code).GetCompilationUnitRoot();
SystemProcessUnsafeConcatinationAnalyser analyser = new SystemProcessUnsafeConcatinationAnalyser();
analyser.Visit(root);
IReadOnlyCollection <AnalyserItem> result = analyser.AnalyserItems;
Assert.Empty(result);
}
