C#: Allow implicit variables in properties to be taint sources by maciejpirog · Pull Request #516 · opengrep/opengrep

maciejpirog · 2026-01-01T14:29:40Z

The implicit variables field and value in property definitions can be considered a source of taint. In this PR we introduce a special syntax to write patterns that do that. It is possible by treating get and set as functions with field and value as arguments. The syntax is enabled by giving the [get] or [set] attribute to the function definition in the pattern:

For example, the rules:

rules:
- id: taint_prop_field
  languages: [csharp]
  message: "a function is called"
  severity: WARNING
  mode: taint
  pattern-sources:
    - patterns:
      - pattern-inside: |
          [get] $T $F($FIELD) { ... }
      - focus-metavariable: $FIELD
    - patterns:
      - pattern-inside: |
          [set] $T $F($VALUE, $FIELD) { ... }
      - focus-metavariable: $FIELD
  pattern-sinks:
    - pattern: |
        sink(...)
- id: taint_prop_value
  languages: [csharp]
  message: "a function is called"
  severity: WARNING
  mode: taint
  pattern-sources:
    - patterns:
      - pattern-inside: |
          [set] $T $F($VALUE, $FIELD) { ... }
      - focus-metavariable: $VALUE
  pattern-sinks:
    - pattern: |
        sink(...)

can be used to match

class C
{
    public string Message
    {
        // ruleid: taint_prop_field
        get => sink(field);
        //ruleid: taint_prop_field
        set => sink(field);
    }
    public string Message2
    {
        // ruleid: taint_prop_value
        set => sink(value);
    }
}

TODO

Sources have to have real locations. The location of a parameter cannot overlap with the location of another parameter, because otherwise, when one is a source of taint, so is the other. The solution for now is to anchor the source to particular characters in the get and set keywords. This makes --dataflow-traces highlighting a bit weird, but a deeper refactoring is needed to solve this. :(

dimitris-m · 2026-01-03T13:48:13Z

In some sense this deviates from patterns-as-valid-syntax which held until now.
It would have to be documented clearly and still, will most users look for our wiki?

Can't we set just field and value as taint sources, in combination with pattern-inside that specifies that the names appear under get => ... and resp. set => ... ?

Something along these lines:

rules:
- id: taint_prop_field
  languages: [csharp]
  message: "a function is called"
  severity: WARNING
  mode: taint
  pattern-sources:
    - patterns:
      - pattern-inside: |
          class $C
          {
              public $T $M
              {
                  get => ...;
              }
          }
      - pattern:
        - pattern-either:
          - pattern: field
          - pattern: value
  pattern-sinks:
    - pattern: |
        sink(...)

What would make this easy is if pattern-inside: get => ... would work out of the box, which I have not tested but expect to fail.

dimitris-m · 2026-01-03T14:01:56Z

I think the premise It is possible by treating get and set as functions with field and value as arguments is not the only way right?

My comment above is to basically consider instances of field and value as sources of taint in specific contexts.

maciejpirog · 2026-01-05T11:45:15Z

Something along these lines:

Nope, this won't work because you will match any instance of value or field, even after you sanitize it, or ones that are shadowing variables, e.g.

get => value => sink(value)

which introduces a fresh var called value, which is inside the pattern

src/osemgrep/cli_show/Show_CLI.ml

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [opengrep/opengrep](https://github.com/opengrep/opengrep) | minor | `v1.13.2` → `v1.14.1` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>opengrep/opengrep (opengrep/opengrep)</summary> ### [`v1.14.1`](https://github.com/opengrep/opengrep/releases/tag/v1.14.1): Opengrep 1.14.1 [Compare Source](opengrep/opengrep@v1.14.0...v1.14.1) #### Improvements - Clojure translation part II by [@dimitris-m](https://github.com/dimitris-m) in [#517](opengrep/opengrep#517) - C#: Allow implicit variables in properties to be taint sources by [@maciejpirog](https://github.com/maciejpirog) in [#516](opengrep/opengrep#516) - Add core flags `dump_rule` and `dump_patterns_of_rule` as options in the show command by [@maciejpirog](https://github.com/maciejpirog) in [#519](opengrep/opengrep#519) #### Bug fixes - Fix: pass signature databaseb to lambda analysis, handle method mutation tainting by [@corneliuhoffman](https://github.com/corneliuhoffman) in [#520](opengrep/opengrep#520) #### Tech debt - Fix CHANGELOG.md, OPENGREP.md, remove unused files by [@dimitris-m](https://github.com/dimitris-m) in [#523](opengrep/opengrep#523) **Full Changelog**: <opengrep/opengrep@v1.14.0...v1.14.1> ### [`v1.14.0`](https://github.com/opengrep/opengrep/releases/tag/v1.14.0): Opengrep 1.14.0 [Compare Source](opengrep/opengrep@v1.13.2...v1.14.0) #### Improvements - Support for higher-order functions in intrafile taint analysis by [@corneliuhoffman](https://github.com/corneliuhoffman) in [#469](opengrep/opengrep#469) and [#513](opengrep/opengrep#513) - Clojure: Improved support for Clojure (incl. tainting) by [@dimitris-m](https://github.com/dimitris-m) in [#501](opengrep/opengrep#501) - Dart: Improved support for Dart by [@maciejpirog](https://github.com/maciejpirog) in [#508](opengrep/opengrep#508) - C#: Better handing of extension methods and extension blocks by [@maciejpirog](https://github.com/maciejpirog) in [#514](opengrep/opengrep#514) #### Fixes - Bump cygwin install action by [@dimitris-m](https://github.com/dimitris-m) in [#503](opengrep/opengrep#503) and [#509](opengrep/opengrep#509) **Full Changelog**: <opengrep/opengrep@v1.13.2...v1.14.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

maciejpirog requested review from corneliuhoffman, dimitris-m and willem-delbare as code owners January 1, 2026 14:29

maciejpirog force-pushed the mpir/csharp-allow-implicit-vars-to-be-sources branch from bef11bc to c33298b Compare January 1, 2026 14:43

dimitris-m removed the request for review from willem-delbare January 2, 2026 18:37

dimitris-m added lang Add or improve language support taint labels Jan 2, 2026

maciejpirog force-pushed the mpir/csharp-allow-implicit-vars-to-be-sources branch from c33298b to 71e4c05 Compare January 4, 2026 23:23

dimitris-m reviewed Jan 5, 2026

View reviewed changes

src/osemgrep/cli_show/Show_CLI.ml Show resolved Hide resolved

maciejpirog force-pushed the mpir/csharp-allow-implicit-vars-to-be-sources branch 4 times, most recently from bab680b to 8854ae7 Compare January 6, 2026 15:51

maciejpirog added 2 commits January 6, 2026 16:52

csharp: allow implicit variables in properties to be taint sources

b5b712a

don't produce intermediate vars for empty tokens

95f30d5

maciejpirog force-pushed the mpir/csharp-allow-implicit-vars-to-be-sources branch from 8854ae7 to 95f30d5 Compare January 6, 2026 15:52

maciejpirog changed the title ~~[WIP] C#: Allow implicit variables in properties to be taint sources~~ C#: Allow implicit variables in properties to be taint sources Jan 6, 2026

dimitris-m approved these changes Jan 6, 2026

View reviewed changes

maciejpirog merged commit 42313b4 into main Jan 6, 2026
6 checks passed

maciejpirog deleted the mpir/csharp-allow-implicit-vars-to-be-sources branch January 6, 2026 16:19

This was referenced Jan 6, 2026

Release v1.14.1 #524

Merged

Php modernisation #529

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

C#: Allow implicit variables in properties to be taint sources#516

C#: Allow implicit variables in properties to be taint sources#516
maciejpirog merged 2 commits intomainfrom
mpir/csharp-allow-implicit-vars-to-be-sources

maciejpirog commented Jan 1, 2026 •

edited

Loading

Uh oh!

dimitris-m commented Jan 3, 2026 •

edited

Loading

Uh oh!

dimitris-m commented Jan 3, 2026

Uh oh!

maciejpirog commented Jan 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

maciejpirog commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TODO

Uh oh!

dimitris-m commented Jan 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dimitris-m commented Jan 3, 2026

Uh oh!

maciejpirog commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

maciejpirog commented Jan 1, 2026 •

edited

Loading

dimitris-m commented Jan 3, 2026 •

edited

Loading

maciejpirog commented Jan 5, 2026 •

edited

Loading