cs/unsafe-deserialization-untrusted-input - deserialization flow steps

[felickz]

• Add csharp debugging query for partial flows
• WIP: Add flow steps for deserialization flow cs/unsafe-deserialization-untrusted-input to detect this flow
  • Queries
    • csharp/CWE-502/UnsafeDeserialization.ql
    • csharp/CWE-502/UnsafeDeserializationQuery.qll
  • Flow Steps
    • ✅ HttpContext.Request.Body
    • System.Xml.XmlDocument.Load() - PR added flow step
    • XmlElement in xmlDocument.SelectNodes
    • XmlElement.GetAttribute
    • XmlSerializer type from Type.GetType()
    • XmlTextReader reader from StringReader()
    • ✅ XmlSerializer.Deserialize() on XmlTextReader

[GeekMasher]

What is the difference between this query and this?

[felickz]

This query is needed to pull in the custom library. The library is where I am working through pulling in additional flow/taint steps for this particular scenario. I created this as a draft PR as it's not ready for prime time yet.

[pwntester]

This repo has been merged with the Security Lab one into the new community-codeql-packs repo which we plan to make public and promote soon. If you would like this PR to be applied to the new repo, please open a new PR there so it can get merged in the new QLPacks.