C#: Blazor: Support string literals as property names in jump nodes#19145
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| query: Security Features/CWE-079/XSS.ql | ||
| postprocess: utils/test/PrettyPrintModels.ql |
Check warning
Code scanning / CodeQL
Query test without inline test expectations Warning
| query: Security Features/CWE-079/XSS.ql | ||
| postprocess: utils/test/PrettyPrintModels.ql |
Check warning
Code scanning / CodeQL
Query test without inline test expectations Warning
| query: Security Features/CWE-079/XSS.ql | ||
| postprocess: utils/test/PrettyPrintModels.ql |
Check warning
Code scanning / CodeQL
Query test without inline test expectations Warning
| @@ -0,0 +1 @@ | |||
| Security Features/CWE-079/XSS.ql No newline at end of file | |||
Check warning
Code scanning / CodeQL
Query test without inline test expectations Warning test
csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
Fixed
Show fixed
Hide fixed
… `nameof` expression In earlier versions of the Razor generator, a string literal was used instead of a `nameof` expression in order to indicate the name of the property being modified. This means we need to look up the property by name instead of using a more explicit access.
tamasvajk
force-pushed
the
tamasvajk/blazor/parameter-passing-jumpnode-2
branch
from
61e2aa7 to
32448c1
Compare
michaelnebel
left a comment
michaelnebel
left a comment
There was a problem hiding this comment.
Thank you for doing this @tamasvajk !
csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
Outdated
Show resolved
Hide resolved
csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
Outdated
Show resolved
Hide resolved
csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
Outdated
Show resolved
Hide resolved
…re/Components.qll Co-authored-by: Michael Nebel <michaelnebel@github.com>
michaelnebel
left a comment
michaelnebel
left a comment
There was a problem hiding this comment.
LGTM!
Maybe run DCA before merging.
3 participants
Continuation of #18957.
Older versions of Blazor used a string literal instead of a
nameofexpression in order to specify the property being set. Therefore, it is necessary to modify the corresponding jump node in order to model the steps correctly.