C#: Deprecate experimental queries. #17911
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| isClassUnsafeXmlSerializerImplementation(c, m) and | ||
| message = | ||
| "Defining an serializable class $@ that has member $@ of a type that is derived from DataSet or DataTable types and may lead to a security problem. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details." and | ||
| classMessage = c.toString() and |
Check warning
Code scanning / CodeQL
Using 'toString' in query logic Warning
| "Defining an serializable class $@ that has member $@ of a type that is derived from DataSet or DataTable types and may lead to a security problem. Please visit https://go.microsoft.com/fwlink/?linkid=2132227 for details." and | ||
| classMessage = c.toString() and | ||
| member = m and | ||
| memberMessage = m.toString() |
Check warning
Code scanning / CodeQL
Using 'toString' in query logic Warning
| FlowToDataSerializerConstructor::flow(source, sink) and | ||
| message = | ||
| "Unsafe type is used in data contract serializer. Make sure $@ comes from the trusted source." and | ||
| sourceMessage = source.toString() |
Check warning
Code scanning / CodeQL
Using 'toString' in query logic Warning
csharp/ql/src/experimental/Security Features/Serialization/XmlDeserializationWithDataSet.ql
Fixed
Show fixed
Hide fixed
| timeComparisonCall, selStatement) and | ||
| message = | ||
| "Possible TimeBomb logic triggered by an $@ that takes into account $@ from the $@ as part of the potential trigger." and | ||
| timeComparisonCallString = timeComparisonCall.toString() and |
Check warning
Code scanning / CodeQL
Using 'toString' in query logic Warning
|
DCA didn't report any performance degradations of changes to alerts. |
michaelnebel
force-pushed
the
csharp/deprecateexperimental
branch
from
8e6a849
to
9e86ef1
Compare
michaelnebel
force-pushed
the
csharp/deprecateexperimental
branch
from
9e86ef1
to
315279f
Compare
The experimental queries are being deprecated. Instead a copy of the queries have been added to the CodeQL-Community-Packs.