Incorporate the rule test cases directly into rules (#400)

* Incorporate api test cases directly into rules. * Incorporate Outbound Network Tests * Control flow tests * Cryptography tests * Add frameworks tests * Hygeine tests * Manual review tests * Add privacy tests * Storage tests * TLS Tests * Vulnerable libs tests * Xml tests * Add output to validate test to show number of rules with self-tests.
microsoft · Aug 31, 2022 · 4a72aec · 4a72aec
1 parent ca7d5d1
commit 4a72aec
Show file tree

Hide file tree

Showing 121 changed files with 581 additions and 746 deletions.
diff --git a/DevSkim-DotNet/Microsoft.DevSkim.Tests/DefaultRulesTests.cs b/DevSkim-DotNet/Microsoft.DevSkim.Tests/DefaultRulesTests.cs
@@ -20,6 +20,10 @@ public void ValidateDefaultRules()
                 Console.WriteLine(error);
             }
         }
+
+        Console.WriteLine("{0} of {1} rules have positive self-tests.",result.DevSkimRuleStatuses.Count(x => x.HasPositiveSelfTests),result.DevSkimRuleStatuses.Count());
+        Console.WriteLine("{0} of {1} rules have negative self-tests.",result.DevSkimRuleStatuses.Count(x => x.HasNegativeSelfTests),result.DevSkimRuleStatuses.Count());
+
         Assert.IsTrue(result.Verified);
         Assert.IsFalse(result.DevSkimRuleStatuses.Any(x => x.Errors.Any()));
     }

diff --git a/DevSkim-DotNet/Microsoft.DevSkim/Microsoft.DevSkim.csproj b/DevSkim-DotNet/Microsoft.DevSkim/Microsoft.DevSkim.csproj
@@ -56,9 +56,6 @@
       <EmbeddedResource Include="..\..\rules\default\security\control_flow\permission_evelation.json">
         <Link>rules\default\security\control_flow\permission_evelation.json</Link>
       </EmbeddedResource>
-      <EmbeddedResource Include="..\..\rules\default\security\control_flow\tests\DS113286.TODO">
-        <Link>rules\default\security\control_flow\tests\DS113286.TODO</Link>
-      </EmbeddedResource>
       <EmbeddedResource Include="..\..\rules\default\security\cryptography\certificate.json">
         <Link>rules\default\security\cryptography\certificate.json</Link>
       </EmbeddedResource>
@@ -83,9 +80,6 @@
       <EmbeddedResource Include="..\..\rules\default\security\cryptography\random.json">
         <Link>rules\default\security\cryptography\random.json</Link>
       </EmbeddedResource>
-      <EmbeddedResource Include="..\..\rules\default\security\cryptography\tests\DS106865.TODO">
-        <Link>rules\default\security\cryptography\tests\DS106865.TODO</Link>
-      </EmbeddedResource>
       <EmbeddedResource Include="..\..\rules\default\security\cryptography\underhanded.json">
         <Link>rules\default\security\cryptography\underhanded.json</Link>
       </EmbeddedResource>
@@ -122,9 +116,6 @@
       <EmbeddedResource Include="..\..\rules\default\security\storage\secure_storage.json">
         <Link>rules\default\security\storage\secure_storage.json</Link>
       </EmbeddedResource>
-      <EmbeddedResource Include="..\..\rules\default\security\storage\tests\DS191340.TODO">
-        <Link>rules\default\security\storage\tests\DS191340.TODO</Link>
-      </EmbeddedResource>
       <EmbeddedResource Include="..\..\rules\default\security\TLS\tls_appconfig.json">
         <Link>rules\default\security\TLS\tls_appconfig.json</Link>
       </EmbeddedResource>

diff --git a/rules/default/security/TLS/tests/DS112835.test b/rules/default/security/TLS/tests/DS112835.test
diff --git a/rules/default/security/TLS/tests/DS112836.test b/rules/default/security/TLS/tests/DS112836.test
diff --git a/rules/default/security/TLS/tests/DS112837.test b/rules/default/security/TLS/tests/DS112837.test
diff --git a/rules/default/security/TLS/tests/DS112838.test b/rules/default/security/TLS/tests/DS112838.test
diff --git a/rules/default/security/TLS/tests/DS112839.test b/rules/default/security/TLS/tests/DS112839.test
diff --git a/rules/default/security/TLS/tls_appconfig.json b/rules/default/security/TLS/tls_appconfig.json
@@ -15,32 +15,40 @@
         "patterns": [
             {
                 "pattern": "Switch.System.Net.DontEnableSchUseStrongCrypto",
-                "type": "string",
+                "type": "substring",
                 "scopes": [
                     "code"
                 ]
             },
             {
                 "pattern": "Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocol",
-                "type": "string",
+                "type": "substring",
                 "scopes": [
                     "code"
                 ]
             },
             {
                 "pattern": "Switch.System.Net.DontEnableSystemDefaultTlsVersions",
-                "type": "string",
+                "type": "substring",
                 "scopes": [
                     "code"
                 ]
             },
             {
                 "pattern": "Switch.System.ServiceModel.DontEnableSystemDefaultTlsVersions",
-                "type": "string",
+                "type": "substring",
                 "scopes": [
                     "code"
                 ]
             }
+        ],
+        "must-match": [
+            "  <AppContextSwitchOverrides value=\"Switch.System.Net.DontEnableSchUseStrongCrypto=true\"/>",
+            "  <AppContextSwitchOverrides value=\"Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols=true\"/>",
+            "  <AppContextSwitchOverrides value=\",Switch.System.Net.DontEnableSystemDefaultTlsVersions=true\"/>",
+            "  <AppContextSwitchOverrides value=\",Switch.System.ServiceModel.DontEnableSystemDefaultTlsVersions=true\"/>"
+        ],
+        "must-not-match": [
         ]
     }
 ]
diff --git a/rules/default/security/TLS/tls_appcontext.json b/rules/default/security/TLS/tls_appcontext.json
@@ -30,6 +30,12 @@
                     "code"
                 ]
             }
+        ],
+        "must-match": [
+            "private const string DisableCachingName = @\"TestSwitch.LocalAppContext.DisableCaching\";",
+            "private const string DontEnableSchUseStrongCryptoName = @\"Switch.System.Net.DontEnableSchUseStrongCrypto\";"
+        ],
+        "must-not-match": [
         ]
     }
 ]
diff --git a/rules/default/security/TLS/tls_functioncall.json b/rules/default/security/TLS/tls_functioncall.json
@@ -58,6 +58,15 @@
                     "code"
                 ]
             }
+        ],
+        "must-match": [
+            "SslStream.AuthenticateAsClient()",
+            "SslStream.AuthenticateAsClientAsync()",
+            "BeginAuthenticateAsClient()",
+            "SslStream.AuthenticateAsServer()",
+            "SslStream.AuthenticateAsServerAsync()",
+            "BeginAuthenticateAsServer()"        ],
+        "must-not-match": [
         ]
     }
 ]
diff --git a/rules/default/security/TLS/tls_securityprotocol.json b/rules/default/security/TLS/tls_securityprotocol.json
@@ -110,7 +110,19 @@
                     "code"
                 ]
             }
-
+        ],
+        "must-match": [
+            "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3;",
+            "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.SystemDefault;",
+            "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls;",
+            "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11;",
+            "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;",
+            "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls13;",
+            "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolTypeExtensions.Tls11;",
+            "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolTypeExtensions.Tls12;",
+            "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolTypeExtensions.SystemDefault;"
+        ],
+        "must-not-match": [
         ]
     }
 ]
diff --git a/rules/default/security/TLS/tls_sslprotocol.json b/rules/default/security/TLS/tls_sslprotocol.json
@@ -145,6 +145,20 @@
                     "code"
                 ]
             }
+        ],
+        "must-match": [
+            "b.Security.Transport.SslProtocols = SslProtocolsExtensions.Tls11;",
+            "b.Security.Transport.SslProtocols = SslProtocolsExtensions.Tls12;",
+            "b.Security.Transport.SslProtocols = SslProtocols.Default ;",
+            "b.Security.Transport.SslProtocols = SslProtocols.None;",
+            "b.Security.Transport.SslProtocols = SslProtocols.Ssl2 ;",
+            "b.Security.Transport.SslProtocols = SslProtocols.Ssl3;",
+            "b.Security.Transport.SslProtocols = SslProtocols.Tls;",
+            "b.Security.Transport.SslProtocols = SslProtocols.Tls11;",
+            "b.Security.Transport.SslProtocols = SslProtocols.Tls12;",
+            "b.Security.Transport.SslProtocols = SslProtocols.Tls13;"
+        ],
+        "must-not-match": [
         ]
     }
 ]
diff --git a/rules/default/security/api/dangerous_api.json b/rules/default/security/api/dangerous_api.json
@@ -16,12 +16,15 @@
         "rule_info": "DS154189.md",
         "patterns": [
             {
-                "pattern": " (sprintf|_getts|_getws|_snprintf|_sntprintf|_snwprintf|_stprintf|_tcsat|_tcscpy|_tcslen|_tcsncpy|_vsnprintf|_vsntprintf|_vsnwprintf|_vstprintf|alloca|asctime|atof|atoi|atoll|bsearch|ctime|fopen|fprintf|freopen|fscanf|fwprintf|fwscanf|getenv|getwd|gmtime|localtime|lstrcat|lstrcpy|mbsrtowcs|mbstowcs|memmove|mktemp|printf|qsort|rewind|scanf|setbuf|sscanf|strcatbuff|strerror|strtok|swprintf|swscanf|tmpnam|vfprintf|vfscanf|vfwscanf|vprintf|vscanf|vsnprintf|vsprintf|vsscanf|vswprintf|vswscanf|vwprintf|vwscanf|wcrtomb|wcrtombs|wcscat|wcscpy|wcslen|wcsncat|wcsncpy|wcsrtombs|wcstok|wctomb|wmemcpy|wmemmove|wnsprintf|wprintf|wscanf|wsprintf|wvnsprintf|wvsprintf) *\\(",
+                "pattern": "(sprintf|_getts|_getws|_snprintf|_sntprintf|_snwprintf|_stprintf|_tcsat|_tcscpy|_tcslen|_tcsncpy|_vsnprintf|_vsntprintf|_vsnwprintf|_vstprintf|alloca|asctime|atof|atoi|atoll|bsearch|ctime|fopen|fprintf|freopen|fscanf|fwprintf|fwscanf|getenv|getwd|gmtime|localtime|lstrcat|lstrcpy|mbsrtowcs|mbstowcs|memmove|mktemp|printf|qsort|rewind|scanf|setbuf|sscanf|strcatbuff|strerror|strtok|swprintf|swscanf|tmpnam|vfprintf|vfscanf|vfwscanf|vprintf|vscanf|vsnprintf|vsprintf|vsscanf|vswprintf|vswscanf|vwprintf|vwscanf|wcrtomb|wcrtombs|wcscat|wcscpy|wcslen|wcsncat|wcsncpy|wcsrtombs|wcstok|wctomb|wmemcpy|wmemmove|wnsprintf|wprintf|wscanf|wsprintf|wvnsprintf|wvsprintf)",
                 "type": "RegexWord",
                 "scopes": [
                     "code"
                 ]
             }
+        ],
+        "must-match": [
+            "int main ()\n{\n  char buffer [50];\n  int n, a=5, b=3;\n  n=sprintf (buffer, \"%d plus %d is %d\", a, b, a+b);\\n  printf (\"[%s] is a string %d chars long\n\",buffer,n);\n  return 0;\n}"
         ]
     },
     {
@@ -76,6 +79,14 @@
                     ]
                 }
             }
+        ],
+        "must-match": [
+            "strcpy (str2,str1);",
+            "strcpy (str3,\"copy successful\");"
+        ],
+        "must-not-match": [
+            "strcpy_s(string);",
+            "strlcpy(string);"
         ]
     },
     {
@@ -130,6 +141,9 @@
                     ]
                 }
             }
+        ],
+        "must-match": [
+            "int main ()\\n{\\n  char str1[]= \"To be or not to be\";\\n  char str2[40];\\n  char str3[40];\\n \\n  strncpy ( str2, str1, sizeof(str2) );\\n\\n  return 0;\\n}"
         ]
     },
     {
@@ -184,6 +198,9 @@
                     ]
                 }
             }
+        ],
+        "must-match": [
+            "int main ()\n{\n  char str[80];  \n  strcat (str,\"strings \");\n  return 0;\n}"
         ]
     },
     {
@@ -240,7 +257,7 @@
             }
         ],
         "must-match": [
-            "strncat (str1, str2, 6);"
+            "\\n=====\\nint main ()\\n{\\n  char str1[20];\\n  char str2[20];\\n  strncat (str1, str2, 6);\\n\\n  return 0;\\n}"
         ]
     },
     {
@@ -295,6 +312,13 @@
                     ]
                 }
             }
+        ],
+        "must-match": [
+            "gets(string);     // warning: unsafe (see fgets instead)"
+        ],
+        "must-not-match": [
+            "fgets(string);",
+            "gets_s(string);"
         ]
     }
 ]
diff --git a/rules/default/security/api/deserialization.json b/rules/default/security/api/deserialization.json
@@ -20,6 +20,9 @@
                     "code"
                 ]
             }
+        ],
+        "must-match": [
+            "favorite_color = pickle.load( open( \"save.p\", \"rb\" ) )"
         ]
     },
     {
@@ -43,6 +46,9 @@
                     "code"
                 ]
             }
+        ],
+        "must-match": [
+            "this.author = (String)in.readObject();"
         ]
     },
     {
@@ -66,6 +72,9 @@
                     "code"
                 ]
             }
+        ],
+        "must-match": [
+            "$session_data = unserialize($tmp[0]);"
         ]
     },
     {
@@ -96,6 +105,11 @@
                     "code"
                 ]
             }            
+        ],
+        "must-match": [
+            "thing = YAML.load_file('some.yml')",
+            "thing = YAML.load_file('some.yml')\nobj = Marshal.load(data)",
+            "ruby_obj = YAML::load( yaml_obj )"
         ]
     },
     {
@@ -134,6 +148,12 @@
                     ]
                 }
             }
+        ],
+        "must-match": [
+            "TypeNameHandling = TypeNameHandling.Auto",
+            "TypeNameHandling = TypeNameHandling.Objects",
+            "TypeNameHandling = TypeNameHandling.Arrays",
+            "TypeNameHandling = TypeNameHandling.All"
         ]
     }
 ]