security-code-scan · dbalikhin · Nov 5, 2022 · Nov 9, 2022 · Dec 2, 2022 · Dec 3, 2022
diff --git a/Roslyn/FlowAnalysis/FlowAnalysis/Framework/DataFlow/DataFlowAnalysisResult.cs b/Roslyn/FlowAnalysis/FlowAnalysis/Framework/DataFlow/DataFlowAnalysisResult.cs
@@ -3,7 +3,9 @@
 using System.Collections.Generic;
 using System.Collections.Immutable;
 using System.Diagnostics;
+using System.Linq;
 using Analyzer.Utilities.Extensions;
+using Analyzer.Utilities.FlowAnalysis.Analysis.TaintedDataAnalysis;
 using Microsoft.CodeAnalysis.FlowAnalysis.DataFlow.PointsToAnalysis;
 using Microsoft.CodeAnalysis.Operations;
 
@@ -141,6 +143,33 @@ public TAbstractAnalysisValue this[IOperation operation]
             }
         }
 
+        internal int InterproceduralResultCount()
+        {
+            return _interproceduralResultsMap.Count;
+        }
+
+        internal List<IOperation> GetTaintedOperations(SymbolAccess sourceOrigin)
+        {
+
+            List<IOperation> list = new();
+            foreach (var kvp in _operationStateMap)
+            {
+                if ((kvp.Value as TaintedDataAbstractValue).Kind == TaintedDataAbstractValueKind.Tainted && (kvp.Value as TaintedDataAbstractValue).SourceOrigins.Contains(sourceOrigin))
+                {
+                    list.Add(kvp.Key);
+                }
+            }
+
+            return list;
+        }
+
+        internal DataFlowAnalysisResult<TBlockAnalysisResult, TAbstractAnalysisValue>? GetInterproceduralResultByIndex(int index)
+        {
+            var element = _interproceduralResultsMap.ElementAt(index);
+
+            return (DataFlowAnalysisResult<TBlockAnalysisResult, TAbstractAnalysisValue>)element.Value;
+        }
+
         internal DataFlowAnalysisResult<TBlockAnalysisResult, TAbstractAnalysisValue>? TryGetInterproceduralResult(IOperation operation)
         {
             if (_interproceduralResultsMap.TryGetValue(operation, out var result))

diff --git a/SecurityCodeScan.Test/Helpers/DiagnosticResult.cs b/SecurityCodeScan.Test/Helpers/DiagnosticResult.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using Microsoft.CodeAnalysis;
 
 namespace SecurityCodeScan.Test.Helpers
@@ -9,6 +10,13 @@ namespace SecurityCodeScan.Test.Helpers
     /// </summary>
     public struct DiagnosticResultLocation
     {
+        public DiagnosticResultLocation()
+        {
+            Line = -1;
+            Column = -1;
+            Path = $"{DiagnosticVerifier.DefaultFilePathPrefix}0";
+        }
+
         public DiagnosticResultLocation(string path, int line, int column)
         {
             if (line < -1)
@@ -36,19 +44,25 @@ public DiagnosticResultLocation(string path, int line, int column)
     /// </summary>
     public struct DiagnosticResult
     {
-        private List<DiagnosticResultLocation> LocationsField;
+        public DiagnosticResult()
+        {
+        }
+
+        public DiagnosticResultLocation Location { get; private set; } = new DiagnosticResultLocation();
 
-        public IReadOnlyList<DiagnosticResultLocation> Locations => LocationsField;
+        private List<DiagnosticResultLocation> AdditionalLocationsField;
+
+        public IReadOnlyList<DiagnosticResultLocation> AdditionalLocations => AdditionalLocationsField;
 
         public DiagnosticSeverity? Severity { get; set; }
 
         public string Id { get; set; }
 
         public string Message { get; set; }
 
-        public int Line => LocationsField != null ? Locations[0].Line : -1;
+        public int Line => Location.Line;
 
-        public int Column => LocationsField != null ? Locations[0].Column : -1;
+        public int Column => Location.Column;
 
         public DiagnosticResult WithMessage(string message)
         {
@@ -70,11 +84,34 @@ public DiagnosticResult WithLocation(int line, int column)
         private DiagnosticResult WithLocation(string path, int line, int column)
         {
             DiagnosticResult result = this;
-            if (result.LocationsField == null)
-                result.LocationsField = new List<DiagnosticResultLocation>(1);
+            result.Location = new DiagnosticResultLocation(path, line, column);
 
-            result.LocationsField.Add(new DiagnosticResultLocation(path, line, column));
             return result;
         }
+
+        public DiagnosticResult WithAdditionalLocations(List<ResultAdditionalLocation> resultLocations)
+        {
+            DiagnosticResult result = this;
+            var path = $"{DiagnosticVerifier.DefaultFilePathPrefix}0";
+            if (result.AdditionalLocationsField == null)
+                result.AdditionalLocationsField = new List<DiagnosticResultLocation>();
+
+            result.AdditionalLocationsField.AddRange(resultLocations.Select(l => new DiagnosticResultLocation(path, l.Line, l.Column)));
+
+            return result;
+        }
+
+    }
+
+    public struct ResultAdditionalLocation
+    {
+        public ResultAdditionalLocation(int line, int column)
+        {
+            Line = line;
+            Column = column;
+        }
+
+        public int Line { get; }
+        public int Column { get; }
     }
 }
diff --git a/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj b/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj
@@ -634,6 +634,7 @@
     <Compile Include="Tests\Taint\EntryPointsTaintAnalyzerTest.cs" />
     <Compile Include="Tests\Taint\OpenRedirectAnalyzerTest.cs" />
     <Compile Include="Tests\Taint\LdapInjectionAnalyzerTest.cs" />
+    <Compile Include="Tests\Taint\TaintFlowVisualizationTests.cs" />
     <Compile Include="Tests\Taint\SqlInjectionAnalyzerTest.cs" />
     <Compile Include="Tests\Taint\TaintAnalyzerSanitizerTest.cs" />
     <Compile Include="Tests\Taint\TaintTransferTest.cs" />