Add more sinks

Author: luchua-bc

csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql

@@ -33,15 +33,15 @@ class KeyedHashAlgorithm extends RefType {
 }
 
 /**
- * The method `ComputeHash()` declared in `System.Security.Cryptography.HashAlgorithm` and
+ * The method `ComputeHash()`, `ComputeHashAsync`, `TryComputeHash`, `HashData`, or `TryHashData` declared in `System.Security.Cryptography.HashAlgorithm` and
  * the method `HashData()` declared in `Windows.Security.Cryptography.Core.HashAlgorithmProvider`.
  */
 class HashMethod extends Method {
   HashMethod() {
-    this.getDeclaringType() instanceof HashAlgorithm and
-    this.hasName("ComputeHash")
+    this.getDeclaringType().getABaseType*() instanceof HashAlgorithm and
+    this.getName().matches(["%ComputeHash%", "%HashData"])
     or
-    this.getDeclaringType() instanceof HashAlgorithmProvider and
+    this.getDeclaringType().getABaseType*() instanceof HashAlgorithmProvider and
     this.hasName("HashData")
   }
 }

csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.cs

@@ -62,6 +62,15 @@ public static string HashPassword2(string password)
         return Convert.ToBase64String(dbPassword);
     }
 
+    // BAD - Hash without a salt.
+    public static string HashPassword3(string password)
+    {
+        HashAlgorithm hashAlg = new SHA256CryptoServiceProvider();
+        byte[] passBytes = System.Text.Encoding.ASCII.GetBytes(password);
+        byte[] hashBytes = hashAlg.ComputeHash(passBytes);
+        return Convert.ToBase64String(hashBytes);
+    }
+
     // GOOD - Hash with a salt.
     public bool VerifyPasswordHash(string password, byte[] passwordHash, byte[] passwordSalt)
     {

csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.expected

@@ -2,12 +2,18 @@ edges
 | HashWithoutSalt.cs:17:70:17:77 | access to parameter password : String | HashWithoutSalt.cs:19:49:19:56 | access to local variable passBuff |
 | HashWithoutSalt.cs:37:28:37:72 | call to method GetBytes : Byte[] | HashWithoutSalt.cs:38:51:38:59 | access to local variable passBytes |
 | HashWithoutSalt.cs:37:64:37:71 | access to parameter password : String | HashWithoutSalt.cs:37:28:37:72 | call to method GetBytes : Byte[] |
+| HashWithoutSalt.cs:69:28:69:72 | call to method GetBytes : Byte[] | HashWithoutSalt.cs:70:48:70:56 | access to local variable passBytes |
+| HashWithoutSalt.cs:69:64:69:71 | access to parameter password : String | HashWithoutSalt.cs:69:28:69:72 | call to method GetBytes : Byte[] |
 nodes
 | HashWithoutSalt.cs:17:70:17:77 | access to parameter password : String | semmle.label | access to parameter password : String |
 | HashWithoutSalt.cs:19:49:19:56 | access to local variable passBuff | semmle.label | access to local variable passBuff |
 | HashWithoutSalt.cs:37:28:37:72 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] |
 | HashWithoutSalt.cs:37:64:37:71 | access to parameter password : String | semmle.label | access to parameter password : String |
 | HashWithoutSalt.cs:38:51:38:59 | access to local variable passBytes | semmle.label | access to local variable passBytes |
+| HashWithoutSalt.cs:69:28:69:72 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] |
+| HashWithoutSalt.cs:69:64:69:71 | access to parameter password : String | semmle.label | access to parameter password : String |
+| HashWithoutSalt.cs:70:48:70:56 | access to local variable passBytes | semmle.label | access to local variable passBytes |
 #select
 | HashWithoutSalt.cs:19:49:19:56 | access to local variable passBuff | HashWithoutSalt.cs:17:70:17:77 | access to parameter password : String | HashWithoutSalt.cs:19:49:19:56 | access to local variable passBuff | $@ is hashed without a salt. | HashWithoutSalt.cs:17:70:17:77 | access to parameter password | The password |
 | HashWithoutSalt.cs:38:51:38:59 | access to local variable passBytes | HashWithoutSalt.cs:37:64:37:71 | access to parameter password : String | HashWithoutSalt.cs:38:51:38:59 | access to local variable passBytes | $@ is hashed without a salt. | HashWithoutSalt.cs:37:64:37:71 | access to parameter password | The password |
+| HashWithoutSalt.cs:70:48:70:56 | access to local variable passBytes | HashWithoutSalt.cs:69:64:69:71 | access to parameter password : String | HashWithoutSalt.cs:70:48:70:56 | access to local variable passBytes | $@ is hashed without a salt. | HashWithoutSalt.cs:69:64:69:71 | access to parameter password | The password |