From 5d53787af93ce9fe0ee2eefc0d78864dd69e86e7 Mon Sep 17 00:00:00 2001 From: chanelyoung Date: Mon, 9 Nov 2026 16:09:06 -0800 Subject: [PATCH] Fix missing XML validation false positives Recognize schema validation in XML reader settings initializers and exclude Stream.Null from tainted XML inputs. Add regression cases for unsafe settings mutations and fix missing source annotations in the supplied tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 490de35b-0565-4725-9bcb-f1f383e3f2f1 --- .../code/csharp/frameworks/system/Xml.qll | 32 +++- .../dataflow/MissingXMLValidationQuery.qll | 60 ++++++- .../CWE-112/MissingXMLValidation.cs | 122 +++++++++++++++ .../CWE-112/MissingXMLValidation.expected | 147 ++++++++++++++---- 4 files changed, 325 insertions(+), 36 deletions(-) diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll index 798a8ed38222..4c4e21914a8e 100644 --- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll +++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll @@ -141,23 +141,43 @@ class XmlReaderSettingsCreation extends ObjectCreation { /** Gets a value set on the `ValidationType` property, if any. */ SystemXmlValidationType getValidationType() { - result.getAnAccess() = + result.getAnAccess() = this.getAValidationTypeValue() + } + + /** Gets an expression assigned to the `ValidationType` property in this local context. */ + Expr getAValidationTypeValue() { + result = this.getPropertyValue(any(SystemXmlXmlReaderSettingsClass s).getValidationTypeProperty()) } /** Gets a flag set on the `ValidationFlags` property, if any. */ SystemXmlSchemaXmlSchemaValidationFlags getAValidationFlag() { - result.getAnAccess() = + result.getAnAccess() = this.getAValidationFlagValue() + } + + /** Gets an expression assigned to the `ValidationFlags` property in this local context. */ + Expr getAValidationFlagValue() { + result = this.getPropertyValue(any(SystemXmlXmlReaderSettingsClass s).getValidationFlagsProperty()) } /** Gets a value set for the given property in this local context. */ private Expr getPropertyValue(Property p) { p = settings.getAProperty() and - exists(PropertyCall set, Expr arg | - set.getTarget() = p.getSetter() and - DataFlow::localExprFlow(this, set.getQualifier()) and - arg = set.getAnArgument() and + exists(Expr arg | + ( + exists(PropertyCall set | + set.getTarget() = p.getSetter() and + DataFlow::localExprFlow(this, set.getQualifier()) and + arg = set.getAnArgument() + ) + or + exists(MemberInitializer initializer | + initializer = this.getInitializer().(ObjectInitializer).getAMemberInitializer() and + initializer.getInitializedMember() = p and + arg = initializer.getRightOperand() + ) + ) and result = getBitwiseOrOperand*(arg) ) } diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll index 3fcdc2b88ca7..e2168230b211 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll @@ -7,6 +7,7 @@ import csharp private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks private import semmle.code.csharp.security.dataflow.flowsources.FlowSources private import semmle.code.csharp.frameworks.system.Xml +private import semmle.code.csharp.frameworks.system.IO private import semmle.code.csharp.security.Sanitizers /** @@ -61,6 +62,51 @@ deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource */ class ThreatModelSource extends Source instanceof ActiveThreatModelSource { } +private predicate hasUnknownSettingsUse(XmlReaderSettingsCreation creation) { + exists(Expr use, Call call | + DataFlow::localExprFlow(creation, use) and + ( + use = call.getAnArgument() and + not use = call.(XmlReaderCreateCall).getArgumentForName("settings") + or + use = call.(MethodCall).getQualifier() + ) + ) + or + exists(LocalVariable variable, VariableAccess use | + DataFlow::localExprFlow(creation, variable.getAnAccess()) and + use = variable.getAnAccess() and + use.getEnclosingCallable() != creation.getEnclosingCallable() + ) + or + exists(AssignExpr assignment | + DataFlow::localExprFlow(creation, assignment.getRightOperand()) and + not assignment.getLeftOperand().(VariableAccess).getTarget() instanceof LocalVariable + ) +} + +private predicate specifiesSchemaValidation( + XmlReaderSettingsCreation creation, XmlReaderCreateCall createCall +) { + creation.getValidationType().hasName("Schema") and + not exists(Expr value | + value = creation.getAValidationTypeValue() and + not value = any(SystemXmlValidationType schema | schema.hasName("Schema")).getAnAccess() + ) and + ( + not exists(creation.getInitializer()) + or + creation.getEnclosingCallable() = createCall.getEnclosingCallable() and + DataFlow::localExprFlow(creation, createCall.getSettings()) and + not hasUnknownSettingsUse(creation) and + not exists(Expr value | + value = creation.getAValidationFlagValue() and + not value instanceof BitwiseOrOperation and + not value = any(SystemXmlSchemaXmlSchemaValidationFlags flag).getAnAccess() + ) + ) +} + /** * The input argument to a call to `XmlReader.Create` where the input will not be validated against * a schema. @@ -85,11 +131,11 @@ class XmlReaderCreateCallSink extends Sink { // internally); or // - The ProcessSchemaLocation option is set (this allows the document to reference a // schema by location that this document will validate against). - result = "the 'XmlReaderSettings' instance does not specify the 'ValidationType' as 'Schema'." and + result = "the 'XmlReaderSettings' instance is not known to enforce schema validation." and exists(XmlReaderSettingsCreation settingsCreation | settingsCreation = createCall.getSettings().getASettingsCreation() | - not settingsCreation.getValidationType().hasName("Schema") + not specifiesSchemaValidation(settingsCreation, createCall) ) or exists(string badValidationFlag | @@ -109,3 +155,13 @@ class XmlReaderCreateCallSink extends Sink { private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { } private class GuidSanitizer extends Sanitizer, GuidSanitizedExpr { } + +private class NullStreamSanitizer extends Sanitizer { + NullStreamSanitizer() { + exists(FieldAccess access | + this.getExpr() = access and + access.getTarget().getDeclaringType() instanceof SystemIOStreamClass and + access.getTarget().hasName("Null") + ) + } +} diff --git a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs index c0615d90bf2b..651ecd588772 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs @@ -1,5 +1,6 @@ using System; using System.IO; +using System.Text; using System.Web; using System.Xml; using System.Xml.Schema; @@ -52,4 +53,125 @@ public bool IsReusable return true; } } + + public void ProcessInitializedSettings(HttpContext ctx) + { + string xml = ctx.Request.QueryString["xml"]; // $ Source + var schemaSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema + }; + schemaSettings.Schemas.Add("urn:my-schema", "my.xsd"); + XmlReader.Create(new StringReader(xml), schemaSettings); + + var inlineSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema, + ValidationFlags = XmlSchemaValidationFlags.ProcessInlineSchema + }; + XmlReader.Create(new StringReader(xml), inlineSettings); // $ Alert + + var locationSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema, + ValidationFlags = XmlSchemaValidationFlags.ProcessSchemaLocation + }; + XmlReader.Create(new StringReader(xml), locationSettings); // $ Alert + + var resetSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema + }; + resetSettings.ValidationType = ValidationType.None; + XmlReader.Create(new StringReader(xml), resetSettings); // $ Alert + + var unknownSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema + }; + unknownSettings.ValidationType = (ValidationType)int.Parse(ctx.Request.QueryString["type"]); + XmlReader.Create(new StringReader(xml), unknownSettings); // $ Alert + + var escapedSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema + }; + DisableValidation(escapedSettings); + XmlReader.Create(new StringReader(xml), escapedSettings); // $ Alert + + var unknownFlagsSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema + }; + unknownFlagsSettings.ValidationFlags = + (XmlSchemaValidationFlags)int.Parse(ctx.Request.QueryString["flags"]); + XmlReader.Create(new StringReader(xml), unknownFlagsSettings); // $ Alert + + var aliasSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema + }; + var alias = aliasSettings; + alias.ValidationType = ValidationType.None; + XmlReader.Create(new StringReader(xml), aliasSettings); // $ Alert + + var capturedSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema + }; + Action reset = () => capturedSettings.ValidationType = ValidationType.None; + reset(); + XmlReader.Create(new StringReader(xml), capturedSettings); // $ Alert + + var storedSettings = new XmlReaderSettings + { + ValidationType = ValidationType.Schema + }; + SharedSettings = storedSettings; + DisableValidation(SharedSettings); + XmlReader.Create(new StringReader(xml), storedSettings); // $ Alert + + var returnedSettings = CreateSettings(); + DisableValidation(returnedSettings); + XmlReader.Create(new StringReader(xml), returnedSettings); // $ Alert + + XmlReader.Create(new StringReader(xml), new XmlReaderSettings + { + ValidationType = ValidationType.Schema, + ValidationFlags = XmlSchemaValidationFlags.ProcessIdentityConstraints | + XmlSchemaValidationFlags.AllowXmlAttributes + }); + } + + private static XmlReaderSettings SharedSettings; + + private static XmlReaderSettings CreateSettings() + { + return new XmlReaderSettings { ValidationType = ValidationType.Schema }; + } + + private static void DisableValidation(XmlReaderSettings settings) + { + settings.ValidationType = ValidationType.None; + } + + public void ProcessStreams(HttpContext ctx) + { + var input = new MemoryStream(Encoding.UTF8.GetBytes(ctx.Request.QueryString["xml"])); // $ Source + input.CopyTo(Stream.Null); + XmlReader.Create(Stream.Null); + + var stream = new MemoryStream(); + input.CopyTo(stream); + stream.Position = 0; + XmlReader.Create(stream); // $ Alert + + Streams.Null = new MemoryStream(Encoding.UTF8.GetBytes(ctx.Request.QueryString["otherXml"])); // $ Source + XmlReader.Create(Streams.Null); // $ Alert + } + + private static class Streams + { + public static Stream Null; + } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.expected b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.expected index 2477cd600e0f..5740fa01c511 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.expected +++ b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.expected @@ -1,34 +1,125 @@ #select -| MissingXMLValidation.cs:16:26:16:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:16:26:16:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because there is no 'XmlReaderSettings' instance specifying schema validation. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value | -| MissingXMLValidation.cs:21:26:21:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:21:26:21:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance does not specify the 'ValidationType' as 'Schema'. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value | -| MissingXMLValidation.cs:27:26:27:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:27:26:27:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance does not specify the 'ValidationType' as 'Schema'. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value | -| MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessInlineSchema'. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value | -| MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessSchemaLocation'. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:17:26:17:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:17:26:17:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because there is no 'XmlReaderSettings' instance specifying schema validation. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:22:26:22:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:22:26:22:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:28:26:28:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:28:26:28:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessInlineSchema'. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessSchemaLocation'. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:72:26:72:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:72:26:72:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessInlineSchema'. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:79:26:79:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:79:26:79:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessSchemaLocation'. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:86:26:86:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:86:26:86:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:93:26:93:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:93:26:93:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:100:26:100:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:100:26:100:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:108:26:108:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:108:26:108:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:116:26:116:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:116:26:116:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:124:26:124:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:124:26:124:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:132:26:132:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:132:26:132:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:136:26:136:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:136:26:136:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:167:26:167:31 | access to local variable stream | MissingXMLValidation.cs:160:61:160:83 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:167:26:167:31 | access to local variable stream | This XML processing depends on a $@ without validation because there is no 'XmlReaderSettings' instance specifying schema validation. | MissingXMLValidation.cs:160:61:160:83 | access to property QueryString | user-provided value | +| MissingXMLValidation.cs:170:26:170:37 | access to field Null | MissingXMLValidation.cs:169:64:169:86 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:170:26:170:37 | access to field Null | This XML processing depends on a $@ without validation because there is no 'XmlReaderSettings' instance specifying schema validation. | MissingXMLValidation.cs:169:64:169:86 | access to property QueryString | user-provided value | edges -| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:16:43:16:57 | access to local variable userProvidedXml : String | provenance | | -| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:21:43:21:57 | access to local variable userProvidedXml : String | provenance | | -| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:27:43:27:57 | access to local variable userProvidedXml : String | provenance | | -| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:45:43:45:57 | access to local variable userProvidedXml : String | provenance | | -| MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | provenance | | -| MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:12:34:12:75 | access to indexer : String | provenance | MaD:1 | -| MissingXMLValidation.cs:12:34:12:75 | access to indexer : String | MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | provenance | | -| MissingXMLValidation.cs:16:43:16:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:16:26:16:58 | object creation of type StringReader | provenance | MaD:2 | -| MissingXMLValidation.cs:21:43:21:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:21:26:21:58 | object creation of type StringReader | provenance | MaD:2 | -| MissingXMLValidation.cs:27:43:27:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:27:26:27:58 | object creation of type StringReader | provenance | MaD:2 | -| MissingXMLValidation.cs:45:43:45:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | provenance | MaD:2 | +| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:17:43:17:57 | access to local variable userProvidedXml : String | provenance | | +| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:22:43:22:57 | access to local variable userProvidedXml : String | provenance | | +| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:28:43:28:57 | access to local variable userProvidedXml : String | provenance | | +| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:46:43:46:57 | access to local variable userProvidedXml : String | provenance | | +| MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | provenance | | +| MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:13:34:13:75 | access to indexer : String | provenance | MaD:1 | +| MissingXMLValidation.cs:13:34:13:75 | access to indexer : String | MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | provenance | | +| MissingXMLValidation.cs:17:43:17:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:17:26:17:58 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:22:43:22:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:22:26:22:58 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:28:43:28:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:28:26:28:58 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:46:43:46:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:72:43:72:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:79:43:79:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:86:43:86:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:93:43:93:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:100:43:100:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:108:43:108:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:116:43:116:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:124:43:124:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:132:43:132:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:136:43:136:45 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:59:22:59:51 | access to indexer : String | provenance | MaD:1 | +| MissingXMLValidation.cs:59:22:59:51 | access to indexer : String | MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | provenance | | +| MissingXMLValidation.cs:72:43:72:45 | access to local variable xml : String | MissingXMLValidation.cs:72:26:72:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:79:43:79:45 | access to local variable xml : String | MissingXMLValidation.cs:79:26:79:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:86:43:86:45 | access to local variable xml : String | MissingXMLValidation.cs:86:26:86:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:93:43:93:45 | access to local variable xml : String | MissingXMLValidation.cs:93:26:93:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:100:43:100:45 | access to local variable xml : String | MissingXMLValidation.cs:100:26:100:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:108:43:108:45 | access to local variable xml : String | MissingXMLValidation.cs:108:26:108:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:116:43:116:45 | access to local variable xml : String | MissingXMLValidation.cs:116:26:116:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:124:43:124:45 | access to local variable xml : String | MissingXMLValidation.cs:124:26:124:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:132:43:132:45 | access to local variable xml : String | MissingXMLValidation.cs:132:26:132:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:136:43:136:45 | access to local variable xml : String | MissingXMLValidation.cs:136:26:136:46 | object creation of type StringReader | provenance | MaD:4 | +| MissingXMLValidation.cs:160:13:160:17 | access to local variable input : MemoryStream | MissingXMLValidation.cs:165:9:165:13 | access to local variable input : MemoryStream | provenance | | +| MissingXMLValidation.cs:160:21:160:92 | object creation of type MemoryStream : MemoryStream | MissingXMLValidation.cs:160:13:160:17 | access to local variable input : MemoryStream | provenance | | +| MissingXMLValidation.cs:160:38:160:91 | call to method GetBytes : Byte[] | MissingXMLValidation.cs:160:21:160:92 | object creation of type MemoryStream : MemoryStream | provenance | MaD:2 | +| MissingXMLValidation.cs:160:61:160:83 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:160:61:160:90 | access to indexer : String | provenance | | +| MissingXMLValidation.cs:160:61:160:83 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:160:61:160:90 | access to indexer : String | provenance | MaD:1 | +| MissingXMLValidation.cs:160:61:160:90 | access to indexer : String | MissingXMLValidation.cs:160:38:160:91 | call to method GetBytes : Byte[] | provenance | MaD:5 | +| MissingXMLValidation.cs:165:9:165:13 | access to local variable input : MemoryStream | MissingXMLValidation.cs:165:22:165:27 | [post] access to local variable stream : MemoryStream | provenance | MaD:3 | +| MissingXMLValidation.cs:165:22:165:27 | [post] access to local variable stream : MemoryStream | MissingXMLValidation.cs:166:9:166:14 | access to local variable stream : MemoryStream | provenance | | +| MissingXMLValidation.cs:166:9:166:14 | access to local variable stream : MemoryStream | MissingXMLValidation.cs:167:26:167:31 | access to local variable stream | provenance | | +| MissingXMLValidation.cs:169:9:169:20 | access to field Null : MemoryStream | MissingXMLValidation.cs:170:26:170:37 | access to field Null | provenance | | +| MissingXMLValidation.cs:169:24:169:100 | object creation of type MemoryStream : MemoryStream | MissingXMLValidation.cs:169:9:169:20 | access to field Null : MemoryStream | provenance | | +| MissingXMLValidation.cs:169:41:169:99 | call to method GetBytes : Byte[] | MissingXMLValidation.cs:169:24:169:100 | object creation of type MemoryStream : MemoryStream | provenance | MaD:2 | +| MissingXMLValidation.cs:169:64:169:86 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:169:64:169:98 | access to indexer : String | provenance | | +| MissingXMLValidation.cs:169:64:169:86 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:169:64:169:98 | access to indexer : String | provenance | MaD:1 | +| MissingXMLValidation.cs:169:64:169:98 | access to indexer : String | MissingXMLValidation.cs:169:41:169:99 | call to method GetBytes : Byte[] | provenance | MaD:5 | models | 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated | -| 2 | Summary: System.IO; StringReader; false; StringReader; (System.String); ; Argument[0]; Argument[this]; taint; manual | +| 2 | Summary: System.IO; MemoryStream; false; MemoryStream; (System.Byte[]); ; Argument[0].Element; Argument[this]; taint; manual | +| 3 | Summary: System.IO; Stream; false; CopyTo; (System.IO.Stream); ; Argument[this]; Argument[0]; taint; manual | +| 4 | Summary: System.IO; StringReader; false; StringReader; (System.String); ; Argument[0]; Argument[this]; taint; manual | +| 5 | Summary: System.Text; Encoding; true; GetBytes; (System.String); ; Argument[0]; ReturnValue; taint; manual | nodes -| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | -| MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection | -| MissingXMLValidation.cs:12:34:12:75 | access to indexer : String | semmle.label | access to indexer : String | -| MissingXMLValidation.cs:16:26:16:58 | object creation of type StringReader | semmle.label | object creation of type StringReader | -| MissingXMLValidation.cs:16:43:16:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | -| MissingXMLValidation.cs:21:26:21:58 | object creation of type StringReader | semmle.label | object creation of type StringReader | -| MissingXMLValidation.cs:21:43:21:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | -| MissingXMLValidation.cs:27:26:27:58 | object creation of type StringReader | semmle.label | object creation of type StringReader | -| MissingXMLValidation.cs:27:43:27:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | -| MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | semmle.label | object creation of type StringReader | -| MissingXMLValidation.cs:45:43:45:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | +| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | +| MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection | +| MissingXMLValidation.cs:13:34:13:75 | access to indexer : String | semmle.label | access to indexer : String | +| MissingXMLValidation.cs:17:26:17:58 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:17:43:17:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | +| MissingXMLValidation.cs:22:26:22:58 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:22:43:22:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | +| MissingXMLValidation.cs:28:26:28:58 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:28:43:28:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | +| MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:46:43:46:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String | +| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection | +| MissingXMLValidation.cs:59:22:59:51 | access to indexer : String | semmle.label | access to indexer : String | +| MissingXMLValidation.cs:72:26:72:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:72:43:72:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:79:26:79:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:79:43:79:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:86:26:86:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:86:43:86:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:93:26:93:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:93:43:93:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:100:26:100:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:100:43:100:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:108:26:108:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:108:43:108:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:116:26:116:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:116:43:116:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:124:26:124:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:124:43:124:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:132:26:132:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:132:43:132:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:136:26:136:46 | object creation of type StringReader | semmle.label | object creation of type StringReader | +| MissingXMLValidation.cs:136:43:136:45 | access to local variable xml : String | semmle.label | access to local variable xml : String | +| MissingXMLValidation.cs:160:13:160:17 | access to local variable input : MemoryStream | semmle.label | access to local variable input : MemoryStream | +| MissingXMLValidation.cs:160:21:160:92 | object creation of type MemoryStream : MemoryStream | semmle.label | object creation of type MemoryStream : MemoryStream | +| MissingXMLValidation.cs:160:38:160:91 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] | +| MissingXMLValidation.cs:160:61:160:83 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection | +| MissingXMLValidation.cs:160:61:160:90 | access to indexer : String | semmle.label | access to indexer : String | +| MissingXMLValidation.cs:165:9:165:13 | access to local variable input : MemoryStream | semmle.label | access to local variable input : MemoryStream | +| MissingXMLValidation.cs:165:22:165:27 | [post] access to local variable stream : MemoryStream | semmle.label | [post] access to local variable stream : MemoryStream | +| MissingXMLValidation.cs:166:9:166:14 | access to local variable stream : MemoryStream | semmle.label | access to local variable stream : MemoryStream | +| MissingXMLValidation.cs:167:26:167:31 | access to local variable stream | semmle.label | access to local variable stream | +| MissingXMLValidation.cs:169:9:169:20 | access to field Null : MemoryStream | semmle.label | access to field Null : MemoryStream | +| MissingXMLValidation.cs:169:24:169:100 | object creation of type MemoryStream : MemoryStream | semmle.label | object creation of type MemoryStream : MemoryStream | +| MissingXMLValidation.cs:169:41:169:99 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] | +| MissingXMLValidation.cs:169:64:169:86 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection | +| MissingXMLValidation.cs:169:64:169:98 | access to indexer : String | semmle.label | access to indexer : String | +| MissingXMLValidation.cs:170:26:170:37 | access to field Null | semmle.label | access to field Null | subpaths