C#: Extend simple type sanitizers with enums and System.DateTimeOffset.

[michaelnebel]

The sanitization logic for many of our queries relies on "sanitizing by type". That is, if tainted data is converted to a type that provides a "sufficient" loss of information (eg. a boolean) or if values of the type contains very little information, where we don't consider it important for the query, if a user can control values of this type, we can consider such types to have a sanitizing effect.
In this PR we extend the list of such type sanitizers to also include enums (we already include simple types like int and long) and DateTimeOffset (we already consider DateTime to be a sanitizer).

DCA looks good: There are no changes to performance or in alerts on nightly/nightly. This indicates that this is not a invasive change.

[Copilot]

Pull Request Overview

This PR extends the set of type sanitizers to include enums and System.DateTimeOffset, enhancing the sanitization logic for query parameters.

• Added an enum and corresponding test actions in the LogForgingAsp.cs file.
• Extended tests in LogForging.cs to cover logging for enum and DateTimeOffset.
• Updated the change notes to reflect that enums and DateTimeOffset are now considered simple types.

Reviewed Changes

Copilot reviewed 3 out of 7 changed files in this pull request and generated no comments.

File	Description
csharp/ql/test/query-tests/Security Features/CWE-117/LogForgingAsp.cs	Added an enum and multiple test actions to demonstrate sanitization for various types including the new enum and DateTimeOffset.
csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.cs	Updated test cases with new source and alert markers for logging, maintaining existing test patterns.
csharp/ql/src/change-notes/2025-04-02-simple-type-enum.md	Added change notes documenting the new sanitization support for enums and DateTimeOffset.

Files not reviewed (4)

• csharp/ql/lib/semmle/code/csharp/frameworks/System.qll: Language not supported
• csharp/ql/lib/semmle/code/csharp/security/Sanitizers.qll: Language not supported
• csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected: Language not supported
• csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.qlref: Language not supported

Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more