Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TaintFlow not picking up on implicit toString() #18399

Open
edkazcarlson-ms opened this issue Jan 3, 2025 · 0 comments
Open

TaintFlow not picking up on implicit toString() #18399

edkazcarlson-ms opened this issue Jan 3, 2025 · 0 comments
Labels
C# question Further information is requested

Comments

@edkazcarlson-ms
Copy link

Hello,
When the this keyword is used in an interpolated string with no property identifiers/ methods, C# treats the this keyword to implicitly be this.toString(). In testing, doing $"{this}" and $"{this.toString()}" result in the same string, however CodeQL only seems to be detecting the taint flow with the version with .toString() (see attached file). Can a future release of CodeQL please fix this so that we can properly track taint flows when they pass through fields that are used in the toString() method? Thank you.
Attached zip

@edkazcarlson-ms edkazcarlson-ms added the question Further information is requested label Jan 3, 2025
@owen-mc owen-mc added the C# label Jan 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C# question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants