Skip to content

Remove disallow returning rsa for CA5385. #2701

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jul 26, 2019
Merged

Remove disallow returning rsa for CA5385. #2701

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d6087f7
Merge pull request #17 from dotnet/master
LLLXXXCCC Jul 23, 2019
12ac488
Merge pull request #18 from dotnet/master
LLLXXXCCC Jul 25, 2019
0050dc1
Remove disallow returning RSA for CA5385.
LingxiaChen Jul 26, 2019
2ab5c4f
Test case for repro from issue
dotpaul Jul 26, 2019
5fe406c
Revert "Test case for repro from issue"
dotpaul Jul 26, 2019
fbadcb7
Test case from issue's repro
dotpaul Jul 26, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 0 additions & 21 deletions src/Microsoft.NetCore.Analyzers/Core/Security/UseRSAWithSufficientKeySize.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,27 +106,6 @@ public override void Initialize(AnalysisContext context)
}
}, OperationKind.ObjectCreation);

compilationStartAnalysisContext.RegisterOperationAction(operationAnalysisContext =>
{
var returnOperation = (IReturnOperation)operationAnalysisContext.Operation;
var typeSymbol = returnOperation.ReturnedValue?.Type;

if (typeSymbol == null)
{
return;
}

var baseTypesAndThis = typeSymbol.GetBaseTypesAndThis();

if (rsaTypeSymbol != null && baseTypesAndThis.Contains(rsaTypeSymbol))
{
operationAnalysisContext.ReportDiagnostic(
returnOperation.CreateDiagnostic(
Rule,
typeSymbol.Name));
}
}, OperationKind.Return);

compilationStartAnalysisContext.RegisterOperationAction(operationAnalysisContext =>
{
var invocationOperation = (IInvocationOperation)operationAnalysisContext.Operation;
Expand Down
42 changes: 29 additions & 13 deletions src/Microsoft.NetCore.Analyzers/UnitTests/Security/UseRSAWithSufficientKeySizeTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,23 +9,24 @@ namespace Microsoft.NetCore.Analyzers.Security.UnitTests
public class UseRSAWithSufficientKeySizeTests : DiagnosticAnalyzerTestBase
{
[Fact]
public void TestCreateObjectOfRSADerivedClassWithInt32ParameterDiagnostic()
public void Issue2697()
{
VerifyCSharp(@"
using System.Security.Cryptography;

class TestClass
{
public void TestMethod()
public RSACryptoServiceProvider TestMethod(string xml)
{
var rsaCng = new RSACng(1024);
var rsa = new RSACryptoServiceProvider();
rsa.FromXmlString(xml);
return rsa;
}
}",
GetCSharpResultAt(8, 22, UseRSAWithSufficientKeySize.Rule, "RSACng"));
}");
}

[Fact]
public void TestConstantDiagnostic()
public void TestCreateObjectOfRSADerivedClassWithInt32ParameterDiagnostic()
{
VerifyCSharp(@"
using System.Security.Cryptography;
Expand All @@ -34,27 +35,27 @@ class TestClass
{
public void TestMethod()
{
const int keySize = 1024;
var rsaCng = new RSACng(keySize);
var rsaCng = new RSACng(1024);
}
}",
GetCSharpResultAt(9, 22, UseRSAWithSufficientKeySize.Rule, "RSACng"));
GetCSharpResultAt(8, 22, UseRSAWithSufficientKeySize.Rule, "RSACng"));
}

[Fact]
public void TestReturnObjectOfRSADerivedClassDiagnostic()
public void TestConstantDiagnostic()
{
VerifyCSharp(@"
using System.Security.Cryptography;

class TestClass
{
public RSA TestMethod(RSA rsa)
public void TestMethod()
{
return rsa;
const int keySize = 1024;
var rsaCng = new RSACng(keySize);
}
}",
GetCSharpResultAt(8, 9, UseRSAWithSufficientKeySize.Rule, "RSA"));
GetCSharpResultAt(9, 22, UseRSAWithSufficientKeySize.Rule, "RSACng"));
}

[Fact]
Expand Down Expand Up @@ -285,6 +286,21 @@ public void TestMethod()
GetCSharpResultAt(9, 28, UseRSAWithSufficientKeySize.Rule, "system.security.cryptography.asymmetricalgorithm"));
}

[Fact]
public void TestReturnObjectOfRSADerivedClassNoDiagnostic()
Copy link

@dotpaul dotpaul Jul 26, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you also add a test case from the example provided in the bug?

Copy link

@mavasani mavasani Jul 26, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

{
VerifyCSharp(@"
using System.Security.Cryptography;

class TestClass
{
public RSA TestMethod(RSA rsa)
{
return rsa;
}
}");
}

[Fact]
public void TestCreateObjectOfRSADerivedClassWithInt32ParameterNoDiagnostic()
{
Expand Down