C#: Blazor: Add non-local jump node for parameter passing

[egregius313]

Establishes the pattern that when a variable is passed to a subcomponent, the reads of the set property are considered tainted.

For example, if in the following example Names was tainted,

@foreach (string name in Names)
{
    <DisplayName Name="name"/>
}

Then a read in the DisplayName component would be considered tainted

@* Bad: rendering unsanitized strings *@
<p>@((MarkupString)Name)</p>

@code {
   [Parameter]
   string Name { get; set; }
}

[egregius313]

I am running into an issue here: as far as I can tell from locally testing the characteristic predicate and getAJumpSuccessor, the class appears to be correct. But whenever I test it, the flow is not going from the source (the Name parameter in NameList.cs) to the sink ((MarkupString)TheName in Name.cs)

Update: It appears that changing them to share a variable fixed the issue (commit)

[tamasvajk]

I think you might be able to add a single line of code to the integration tests, and see if the flow is working there as well. You could add something like the below to the TestPage.razor:

<MyOutput Value="@QueryParam" />

and this should result in an XSS vulnerability.

[tamasvajk]

Should this also work if instead of a nameof, the name of the property is directly referenced as a string literal?

[Hamid054]

[email protected]