Add new stubs definitions to System.Web by 5idg5 · Pull Request #19456 · github/codeql

5idg5 · 2025-05-02T21:30:55Z

Added new definitions to https://github.com/github/codeql/blob/main/csharp/ql/test/resources/stubs/System.Web.cs ~~and https://github.com/github/codeql/blob/main/csharp/ql/test/resources/stubs/System.Net.cs~~
Updated options files where applicable, to point to /resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj since the members of ApiController type need those dependencies.

Copilot

Pull Request Overview

This PR ensures that test suites loading the new System.Web API Controller definitions have their dependencies satisfied by adding the Microsoft.AspNetCore.App framework project to the extractor options.

Updated extractor options in security feature and experimental query tests to include Microsoft.AspNetCore.App.csproj
Introduced new stub definitions for System.Web.cs and System.Net.cs (not shown) and ensured dependent tests reference the appropriate frameworks

Reviewed Changes

Copilot reviewed 49 out of 49 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
csharp/ql/test/query-tests/Security Features/CWE-134/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/query-tests/Security Features/CWE-112/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/query-tests/Security Features/CWE-099/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/query-tests/Security Features/CWE-094/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/query-tests/Security Features/CWE-090/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/query-tests/Security Features/CWE-020/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/Security Features/CWE-614/RequireSSLSystemWeb/HttpCookiesTrue/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/Security Features/CWE-614/RequireSSLSystemWeb/FormsTrue/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/Security Features/CWE-614/RequireSSLSystemWeb/ConfigFalse/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/Security Features/CWE-614/RequireSSLSystemWeb/ConfigEmpty/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/Security Features/CWE-614/RequireSSLFalseSystemWeb/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/Security Features/CWE-1004/CookieWithoutHttpOnlySystemWeb/HttpCookiesTrue/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/Security Features/CWE-1004/CookieWithoutHttpOnlySystemWeb/ConfigFalse/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/Security Features/CWE-1004/CookieWithoutHttpOnlySystemWeb/ConfigEmpty/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/Security Features/CWE-1004/CookieHttpOnlyFalseSystemWeb/options	Added AspNetCore.App project reference to extractor options
csharp/ql/test/experimental/CWE-918/options	Added AspNetCore.App project reference to extractor options

Comments suppressed due to low confidence (5)

csharp/ql/test/query-tests/Security Features/CWE-134/options:3

After adding the ASP.NET Core framework load, also include the System.Net.cs stub in the options so tests can access the newly added System.Net definitions.

semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/options:3

Include the System.Net.cs stub here as well so that any queries depending on System.Net types will resolve correctly.

semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

csharp/ql/test/query-tests/Security Features/CWE-112/options:3

Add a loader for the System.Net.cs stub after the System.Web.cs line to cover new System.Net definitions in tests.

semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

csharp/ql/test/query-tests/Security Features/CWE-099/options:3

Ensure the System.Net.cs stub is also loaded here so that tests exercising System.Net APIs will pass with the new definitions.

semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

csharp/ql/test/query-tests/Security Features/CWE-094/options:3

After including the ASP.NET Core stub, add the System.Net.cs stub so that any queries relying on new System.Net definitions are resolved in this test.

semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

…ate-cs-stubs

5idg5 · 2025-05-06T02:06:59Z

Reverted the changes in System.Net.cs as it was conflicting with the existing definition of the type HttpResponseMessage here ->

codeql/csharp/ql/test/resources/stubs/_frameworks/Microsoft.NETCore.App/System.Net.Http.cs

Lines 726 to 741 in 9b0854e

    
           public class HttpResponseMessage : System.IDisposable 
        
           { 
        
               public System.Net.Http.HttpContent Content { get => throw null; set { } } 
        
               public HttpResponseMessage() => throw null; 
        
               public HttpResponseMessage(System.Net.HttpStatusCode statusCode) => throw null; 
        
               public void Dispose() => throw null; 
        
               protected virtual void Dispose(bool disposing) => throw null; 
        
               public System.Net.Http.HttpResponseMessage EnsureSuccessStatusCode() => throw null; 
        
               public System.Net.Http.Headers.HttpResponseHeaders Headers { get => throw null; } 
        
               public bool IsSuccessStatusCode { get => throw null; } 
        
               public string ReasonPhrase { get => throw null; set { } } 
        
               public System.Net.Http.HttpRequestMessage RequestMessage { get => throw null; set { } } 
        
               public System.Net.HttpStatusCode StatusCode { get => throw null; set { } } 
        
               public override string ToString() => throw null; 
        
               public System.Net.Http.Headers.HttpResponseHeaders TrailingHeaders { get => throw null; } 
        
               public System.Version Version { get => throw null; set { } }

. Nothing additional needed, existing definition will suffice.

michaelnebel

Thank you for adding these ❤️
It looks like some of the tests are failing.

…ate-cs-stubs

5idg5 · 2025-05-09T20:47:32Z

Hey @michaelnebel or @hvitved

I've pushed some more changes that led to more successful unit tests, but I'm not aware of the intricacies with the public repo testing, so can't figure out the solution for rest of the failures below. Could you please troubleshoot and help to progress this PR?

 FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/CfgConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/DataFlowConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/PrimaryQlClass.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/SsaConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/VariableCaptureConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/DB-CHECK
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/InsecureXMLSettings.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/UntrustedDataInsecureXml.qlref
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/UseXmlSecureResolver.qlref
FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/AspDirective.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/AspElement.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/AspOpenTag.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/CfgConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/DataFlowConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/PrimaryQlClass.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/SsaConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/VariableCaptureConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CodeBehind.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/DB-CHECK
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/comments.ql

michaelnebel · 2025-05-12T09:08:55Z

Hey @michaelnebel or @hvitved

I've pushed some more changes that led to more successful unit tests, but I'm not aware of the intricacies with the public repo testing, so can't figure out the solution for rest of the failures below. Could you please troubleshoot and help to progress this PR?

 FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/CfgConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/DataFlowConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/PrimaryQlClass.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/SsaConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/VariableCaptureConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/DB-CHECK
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/InsecureXMLSettings.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/UntrustedDataInsecureXml.qlref
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/UseXmlSecureResolver.qlref
FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/AspDirective.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/AspElement.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/AspOpenTag.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/CfgConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/DataFlowConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/PrimaryQlClass.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/SsaConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/VariableCaptureConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CodeBehind.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/DB-CHECK
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/comments.ql

Very understandable that this causes problems.

In the ASP test, the extractor options are inlined in directly in the .cs file (as the asp extractor doesn't support the nostdlib and noconfig options)
The test for CWE-611 should preferably be compiled against dll's (as dll meta information is read). To continue doing so, I think that the best approach is to make sure that the content of System.Web.cs doesn't depend on ASP.NET - I will try and re-factor those parts of the stub into a separate file.

I will open a PR, where you can cherry-pick the last three commits (as I don't have permissions to push to this branch): #19473

5idg5 · 2025-05-12T13:33:31Z

Hey @michaelnebel or @hvitved
I've pushed some more changes that led to more successful unit tests, but I'm not aware of the intricacies with the public repo testing, so can't figure out the solution for rest of the failures below. Could you please troubleshoot and help to progress this PR?

 FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/CfgConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/DataFlowConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/PrimaryQlClass.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/SsaConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/CONSISTENCY/VariableCaptureConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/DB-CHECK
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/InsecureXMLSettings.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/UntrustedDataInsecureXml.qlref
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/query-tests/Security Features/CWE-611/UseXmlSecureResolver.qlref
FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/AspDirective.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/AspElement.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/AspOpenTag.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/CfgConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/DataFlowConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/PrimaryQlClass.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/SsaConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CONSISTENCY/VariableCaptureConsistency.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/CodeBehind.ql
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/DB-CHECK
  FAILED: /home/runner/work/semmle-code/semmle-code/ql/csharp/ql/test/library-tests/asp/basic/comments.ql

Very understandable that this causes problems.

In the ASP test, the extractor options are inlined in directly in the .cs file (as the asp extractor doesn't support the nostdlib and noconfig options)
The test for CWE-611 should preferably be compiled against dll's (as dll meta information is read). To continue doing so, I think that the best approach is to make sure that the content of System.Web.cs doesn't depend on ASP.NET - I will try and re-factor those parts of the stub into a separate file.

I will open a PR, where you can cherry-pick the last three commits (as I don't have permissions to push to this branch): #19473

Sounds good, thank you!

… into 5idg5-update-cs-stubs

5idg5 · 2025-05-13T00:06:46Z

Tests passed, ready for approval and merge!

michaelnebel

LGTM! Thank you!

add new stubs

d600eb4

Copilot AI review requested due to automatic review settings May 2, 2025 21:30

5idg5 requested a review from a team as a code owner May 2, 2025 21:30

github-actions bot added the C# label May 2, 2025

Copilot AI reviewed May 2, 2025

View reviewed changes

5idg5 added 2 commits May 5, 2025 21:55

Merge branch 'main' of https://github.com/5idg5/codeql into 5idg5-upd…

0691cd3

…ate-cs-stubs

revert system.net stubs

7231f53

michaelnebel reviewed May 6, 2025

View reviewed changes

5idg5 added 2 commits May 9, 2025 15:35

Merge branch 'main' of https://github.com/5idg5/codeql into 5idg5-upd…

089ef1c

…ate-cs-stubs

fix unit tests part 2

4e3ac93

5idg5 changed the title ~~Add new stubs definitions to System.Web and System.Net~~ Add new stubs definitions to System.Web May 9, 2025

michaelnebel and others added 7 commits May 12, 2025 17:33

C#: Cleanup test options files.

ffd6b26

C#: Fix ASP tests.

82cf472

C#: Cleanup test options files.

60d26e5

C#: Remove dependency to ASP.NET in the System.Web.cs stub file.

05dc9b6

C#: Cleanup test options files.

5faaa4f

Merge branch 'github:main' into 5idg5-update-cs-stubs

6a5ce39

Merge branch '5idg5-update-cs-stubs' of https://github.com/5idg5/codeql…

eb4711e

… into 5idg5-update-cs-stubs

michaelnebel approved these changes May 13, 2025

View reviewed changes

michaelnebel merged commit 0c0e1d0 into github:main May 13, 2025
16 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add new stubs definitions to System.Web#19456

Add new stubs definitions to System.Web#19456
michaelnebel merged 12 commits intogithub:mainfrom
5idg5:5idg5-update-cs-stubs

5idg5 commented May 2, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

5idg5 commented May 6, 2025

Uh oh!

michaelnebel left a comment

Uh oh!

5idg5 commented May 9, 2025 •

edited

Loading

Uh oh!

michaelnebel commented May 12, 2025 •

edited

Loading

Uh oh!

5idg5 commented May 12, 2025

Uh oh!

5idg5 commented May 13, 2025

Uh oh!

michaelnebel left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

5idg5 commented May 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

5idg5 commented May 6, 2025

Uh oh!

michaelnebel left a comment

Choose a reason for hiding this comment

Uh oh!

5idg5 commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

michaelnebel commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

5idg5 commented May 12, 2025

Uh oh!

5idg5 commented May 13, 2025

Uh oh!

michaelnebel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

5idg5 commented May 2, 2025 •

edited

Loading

5idg5 commented May 9, 2025 •

edited

Loading

michaelnebel commented May 12, 2025 •

edited

Loading