Skip to content

Commit f114ef1

Browse files
raulgarciamsftraulgarciamsft
committed
Adding unit tests
1 parent d775528 commit f114ef1

20 files changed

Lines changed: 918 additions & 0 deletions

‎csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| test.cs:31:9:31:74 | call to method InitiateSystemShutdownExW | Call to an external method 'InitiateSystemShutdownExW'. |

‎csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql

‎csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.expected‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
edges
2+
| test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:36:70:48 | access to local variable lastWriteTime |
3+
| test.cs:70:13:70:71 | call to method CompareTo : Int32 | test.cs:70:13:70:76 | ... >= ... |
4+
| test.cs:70:36:70:48 | access to local variable lastWriteTime | test.cs:70:36:70:70 | call to method AddHours |
5+
| test.cs:70:36:70:48 | access to local variable lastWriteTime | test.cs:70:36:70:70 | call to method AddHours : DateTime |
6+
| test.cs:70:36:70:48 | access to local variable lastWriteTime : DateTime | test.cs:70:36:70:70 | call to method AddHours |
7+
| test.cs:70:36:70:48 | access to local variable lastWriteTime : DateTime | test.cs:70:36:70:70 | call to method AddHours : DateTime |
8+
| test.cs:70:36:70:70 | call to method AddHours | test.cs:70:13:70:71 | call to method CompareTo |
9+
| test.cs:70:36:70:70 | call to method AddHours | test.cs:70:13:70:71 | call to method CompareTo : Int32 |
10+
| test.cs:70:36:70:70 | call to method AddHours : DateTime | test.cs:70:13:70:71 | call to method CompareTo |
11+
| test.cs:70:36:70:70 | call to method AddHours : DateTime | test.cs:70:13:70:71 | call to method CompareTo : Int32 |
12+
#select
13+
| test.cs:70:9:73:9 | if (...) ... | test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:13:70:71 | call to method CompareTo | Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger. | test.cs:70:13:70:71 | call to method CompareTo | call to method CompareTo | test.cs:70:36:70:70 | call to method AddHours | an offset | test.cs:68:34:68:76 | call to method GetLastWriteTime | last modification time of a file |
14+
| test.cs:70:9:73:9 | if (...) ... | test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:13:70:71 | call to method CompareTo : Int32 | Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger. | test.cs:70:13:70:71 | call to method CompareTo | call to method CompareTo | test.cs:70:36:70:70 | call to method AddHours | an offset | test.cs:68:34:68:76 | call to method GetLastWriteTime | last modification time of a file |
15+
| test.cs:70:9:73:9 | if (...) ... | test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:13:70:76 | ... >= ... | Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger. | test.cs:70:13:70:71 | call to method CompareTo | call to method CompareTo | test.cs:70:36:70:70 | call to method AddHours | an offset | test.cs:68:34:68:76 | call to method GetLastWriteTime | last modification time of a file |
16+
| test.cs:70:9:73:9 | if (...) ... | test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:13:70:76 | ... >= ... : Boolean | Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger. | test.cs:70:13:70:71 | call to method CompareTo | call to method CompareTo | test.cs:70:36:70:70 | call to method AddHours | an offset | test.cs:68:34:68:76 | call to method GetLastWriteTime | last modification time of a file |
17+
nodes
18+
| test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | semmle.label | call to method GetLastWriteTime : DateTime |
19+
| test.cs:70:13:70:71 | call to method CompareTo | semmle.label | call to method CompareTo |
20+
| test.cs:70:13:70:71 | call to method CompareTo : Int32 | semmle.label | call to method CompareTo : Int32 |
21+
| test.cs:70:13:70:76 | ... >= ... | semmle.label | ... >= ... |
22+
| test.cs:70:36:70:48 | access to local variable lastWriteTime | semmle.label | access to local variable lastWriteTime |
23+
| test.cs:70:36:70:70 | call to method AddHours | semmle.label | call to method AddHours |

‎csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/backdoor/PotentialTimeBomb.ql

‎csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
edges
2+
nodes
3+
#select

‎csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql

‎csharp/ql/test/experimental/Security Features/backdoor/test.cs‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
using System;
2+
using System.Runtime.InteropServices;
3+
using System.Text;
4+
5+
namespace System.IO
6+
{
7+
public class File
8+
{
9+
public static DateTime GetLastWriteTime(string s)
10+
{
11+
return new DateTime(DateTime.MaxValue.Ticks);
12+
}
13+
}
14+
}
15+
16+
namespace System.Diagnostics
17+
{
18+
public class Process
19+
{
20+
public static string GetCurrentProcess() { return "test"; }
21+
}
22+
}
23+
24+
class External {
25+
[DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
26+
[return: MarshalAs(UnmanagedType.Bool)]
27+
public static extern bool InitiateSystemShutdownExW([In] string lpMachineName, [In] string lpMessage, [In] uint dwTimeout, [MarshalAs(UnmanagedType.Bool)][In] bool bForceAppsClosed, [MarshalAs(UnmanagedType.Bool)][In] bool bRebootAfterShutdown, [In] uint dwReason);
28+
29+
void TestDangerousNativeFunctionCall()
30+
{
31+
InitiateSystemShutdownExW(null, null, 0U, true, true, 2147745794U); // BUG : DangerousNativeFunctionCall
32+
}
33+
34+
ulong GetFvnHash(string s)
35+
{
36+
ulong num = 14695981039346656037UL; /* FNV base offset */
37+
try
38+
{
39+
foreach (byte b in Encoding.UTF8.GetBytes(s))
40+
{
41+
num ^= (ulong)b;
42+
num *= 1099511628211UL; /* FNV prime */
43+
}
44+
}
45+
catch
46+
{
47+
}
48+
// regular FVN
49+
return num;
50+
}
51+
52+
void IndirectTestProcessNameToHashTaintFlow( string s)
53+
{
54+
GetFvnHash(s); // BUG : ProcessNameToHashTaintFlow
55+
}
56+
57+
void TestProcessNameToHashTaintFlow()
58+
{
59+
GetFvnHash( System.Diagnostics.Process.GetCurrentProcess() ); // BUG : ProcessNameToHashTaintFlow
60+
61+
string proc = System.Diagnostics.Process.GetCurrentProcess();
62+
63+
IndirectTestProcessNameToHashTaintFlow( proc );
64+
}
65+
66+
void TestTimeBomb()
67+
{
68+
DateTime lastWriteTime = System.IO.File.GetLastWriteTime("someFile");
69+
int num = new Random().Next(288, 336);
70+
if (DateTime.Now.CompareTo(lastWriteTime.AddHours((double)num)) >= 0) // BUG : Potential time bomb
71+
{
72+
// Some code here
73+
}
74+
}
75+
76+
}

‎csharp/ql/test/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| test.cs:40:16:40:36 | 6605813339339102567 | The variable $@ seems to be used as part of a FNV-like hash calculation, that is modified by an additional $@ expression using literal $@. | test.cs:26:9:26:11 | num | num | test.cs:40:10:40:36 | ... ^ ... | xor | test.cs:40:16:40:36 | 6605813339339102567 | 6605813339339102567 |

‎csharp/ql/test/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.ql

‎csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| test.cs:43:7:43:15 | JobEngine | The enum $@ may be related to Solorigate. It matches 19 of the values used for commands in the enum. | test.cs:43:7:43:15 | JobEngine | JobEngine |

0 commit comments

Comments
 (0)