Skip to content

C#: Tolerate missing call targets in LogMessageSink #14855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 22, 2023

Conversation

tamasvajk
Copy link
Contributor

@tamasvajk tamasvajk commented Nov 21, 2023

In the standalone mode, we're automatically adding implicit usings to the compilation. If we detect any web application in the repo, we're adding the asp.net core specific implicit usings, which include Microsoft.Extensions.Logging. This namespace contains ILogger, which is quite a common name, and oftentimes conflict with ILogger interfaces defined in the repo. As a result, we're facing ambiguities in the standalone extracted compilation, and we end up with an incomplete DB. This PR adjusts the LogMessageSink class to work in cases when "logger-like" method calls have no extracted target.

@github-actions github-actions bot added the C# label Nov 21, 2023
@tamasvajk
Copy link
Contributor Author

DCA shows no changes (in the nightly suite).

@tamasvajk tamasvajk marked this pull request as ready for review November 21, 2023 12:29
@tamasvajk tamasvajk requested a review from a team as a code owner November 21, 2023 12:29

public class C
{
public ILogger logger;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OOI, which type does Roslyn then assign to this field?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this case it's A.ILogger. What's odd is that when we process the field, there's no sign of ambiguity.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's also what I don't understand, I would have expected that Roslyn didn't assign any type at all. Or is it perhaps because we just take the first candidate symbol?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, it's not us.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To conclude, we found that there's no ambiguity when processing the field or the reference to the field. But the field's type symbol is actually an ambiguous error symbol.

@tamasvajk tamasvajk added the no-change-note-required This PR does not need a change note label Nov 21, 2023
Copy link
Contributor

@michaelnebel michaelnebel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me!
Will this improve the logging injection query alert retention rate on our standalone suite?

@tamasvajk
Copy link
Contributor Author

Looks good to me! Will this improve the logging injection query alert retention rate on our standalone suite?

Yes it will. The issue was found through the lost cs/exposure-of-sensitive-information alerts in nopSolutions/nopCommerce.

Let me kick off a DCA experiment to see the changes in Standalone...

@tamasvajk
Copy link
Contributor Author

DCA shows 86 new cs/exposure-of-sensitive-information and 5 new cs/log-forging alerts on nopSolutions/nopCommerce.

@tamasvajk tamasvajk merged commit ace633c into github:main Nov 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C# no-change-note-required This PR does not need a change note
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants