@@ -15,12 +15,10 @@ import semmle.code.csharp.security.SensitiveActions
1515import semmle.code.csharp.security.dataflow.flowsinks.Remote
1616import semmle.code.csharp.frameworks.system.data.Common
1717import semmle.code.csharp.frameworks.System
18- import semmle.code.csharp.dataflow.DataFlow :: DataFlow :: PathGraph
18+ import ExposureInTransmittedData :: PathGraph
1919
20- class TaintTrackingConfiguration extends TaintTracking:: Configuration {
21- TaintTrackingConfiguration ( ) { this = "Exposure through transmitted data" }
22-
23- override predicate isSource ( DataFlow:: Node source ) {
20+ module ExposureInTransmittedDataConfig implements DataFlow:: ConfigSig {
21+ predicate isSource ( DataFlow:: Node source ) {
2422 // `source` may contain a password
2523 source .asExpr ( ) instanceof PasswordExpr
2624 or
@@ -42,10 +40,12 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
4240 )
4341 }
4442
45- override predicate isSink ( DataFlow:: Node sink ) { sink instanceof RemoteFlowSink }
43+ predicate isSink ( DataFlow:: Node sink ) { sink instanceof RemoteFlowSink }
4644}
4745
48- from TaintTrackingConfiguration configuration , DataFlow:: PathNode source , DataFlow:: PathNode sink
49- where configuration .hasFlowPath ( source , sink )
46+ module ExposureInTransmittedData = TaintTracking:: Global< ExposureInTransmittedDataConfig > ;
47+
48+ from ExposureInTransmittedData:: PathNode source , ExposureInTransmittedData:: PathNode sink
49+ where ExposureInTransmittedData:: flowPath ( source , sink )
5050select sink .getNode ( ) , source , sink , "This data transmitted to the user depends on $@." ,
5151 source .getNode ( ) , "sensitive information"
0 commit comments