Merge pull request #22360 from hugo-syn/hugo-syn/csharp-additional-taint-step

C#: add AdditionalTaintStep extension point for taint-tracking

Author: hvitved

csharp/ql/lib/change-notes/2026-08-15-additional-taint-step.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added the `AdditionalTaintStep` extension point (`semmle.code.csharp.dataflow.FlowSteps`). Extend this class to add additional taint steps that apply to all taint-tracking configurations.

csharp/ql/lib/semmle/code/csharp/dataflow/FlowSteps.qll

@@ -0,0 +1,20 @@
+/**
+ * Provides classes representing various flow steps for taint tracking.
+ */
+
+private import codeql.util.Unit
+private import semmle.code.csharp.dataflow.DataFlow
+
+/**
+ * A unit class for adding additional taint steps.
+ *
+ * Extend this class to add additional taint steps that should apply to all
+ * taint configurations.
+ */
+class AdditionalTaintStep extends Unit {
+  /**
+   * Holds if the step from `node1` to `node2` should be considered a taint
+   * step for all configurations.
+   */
+  abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
+}

csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll

@@ -2,6 +2,7 @@ private import csharp
 private import TaintTrackingPublic
 private import FlowSummaryImpl as FlowSummaryImpl
 private import semmle.code.csharp.Caching
+private import semmle.code.csharp.dataflow.FlowSteps
 private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
 private import semmle.code.csharp.dataflow.internal.DataFlowPrivate
 private import semmle.code.csharp.dispatch.Dispatch
@@ -172,6 +173,8 @@ private module Cached {
     model = ""
     or
     FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, false, model)
+    or
+    any(AdditionalTaintStep a).step(nodeFrom, nodeTo) and model = "AdditionalTaintStep"
   }
 }
 

csharp/ql/test/library-tests/dataflow/additional-taint-step/AdditionalTaintStep.expected

@@ -0,0 +1 @@
+| Test.cs:13:35:13:45 | access to parameter taintSource | Test.cs:13:23:13:46 | call to method Step | AdditionalTaintStep |

csharp/ql/test/library-tests/dataflow/additional-taint-step/AdditionalTaintStep.ql

@@ -0,0 +1,24 @@
+import csharp
+import semmle.code.csharp.dataflow.FlowSteps
+import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate
+
+/**
+ * A test-only additional taint step that treats calls to `Marker.Step` as
+ * propagating taint from the argument to the call result, to verify that
+ * `AdditionalTaintStep` subclasses are picked up by `defaultAdditionalTaintStep`.
+ */
+private class MarkerStepTaintStep extends AdditionalTaintStep {
+  override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
+    exists(MethodCall mc |
+      mc.getTarget().hasName("Step") and
+      mc.getTarget().getDeclaringType().hasName("Marker")
+    |
+      node1.asExpr() = mc.getArgument(0) and
+      node2.asExpr() = mc
+    )
+  }
+}
+
+from DataFlow::Node src, DataFlow::Node sink, string model
+where defaultAdditionalTaintStep(src, sink, model) and model = "AdditionalTaintStep"
+select src, sink, model

csharp/ql/test/library-tests/dataflow/additional-taint-step/Test.cs

@@ -0,0 +1,18 @@
+class Marker
+{
+    // A stand-in for a framework method that isn't otherwise understood by the
+    // taint-tracking library, whose taint behaviour is modelled by a test-only
+    // `AdditionalTaintStep` subclass instead.
+    public static object Step(object x) => new object();
+}
+
+class Test
+{
+    void M(object taintSource)
+    {
+        var tainted = Marker.Step(taintSource);
+        Sink(tainted);
+    }
+
+    static void Sink(object o) { }
+}