csharp: odata lib - #22384

Open

hugo-syn wants to merge 16 commits into

github:mainfrom

hugo-syn:hugo-syn/csharp-odata-tainted-member

Commits on Aug 19, 2026

C#: add OData action-parameter taint modeling

hugo-syn
and
claude
committed
a1f2b81
C#: make OData.qll classes public, genericize test fixtures

hugo-syn
and
claude
committed
e88e003
C#: drop redundant TaintTracking import in OData.qll

hugo-syn
and
claude
committed
3440d4a

Commits on Aug 21, 2026

C#: model Delta<T>.GetInstance() as a MaD summary instead of QL
hugo-syn
committed
22ad8c7
C#: reuse CandidateMemberToTaint from Remote.qll in OData.qll
hugo-syn
committed
a44bfec
C#: move OData test types into test/resources/stubs
hugo-syn
committed
2c17dd2
C#: fix DeltaClass doc comment to not name a specific type parameter
hugo-syn
committed
9c3a9b4

Commits on Aug 25, 2026

Update csharp/ql/lib/ext/Microsoft.AspNet.OData.model.yml

hugo-syn
and
michaelnebel
authored
746b806
Update csharp/ql/lib/semmle/code/csharp/frameworks/OData.qll

hugo-syn
and
michaelnebel
authored
131b6be
Update csharp/ql/lib/semmle/code/csharp/frameworks/OData.qll

hugo-syn
and
michaelnebel
authored
de9eae2
fix: add fix from review
hugo-syn
committed
93baa40

Commits on Aug 26, 2026

C#: address further OData review comments

hugo-syn
and
claude
committed
cf4c3d0

Commits on Aug 27, 2026

C#: Convert the OData test to use the Sink for the alert location and update test expected output.

michaelnebel
authored and
hugo-syn
committed
51a107e
C#: Convert the test to use inline expectations and update expected test output.

michaelnebel
authored and
hugo-syn
committed
538d51f
C#: Use unique types pr test case (otherwise they will interfere with each other in relation to identifying which members will be tainted).

michaelnebel
authored and
hugo-syn
committed
5b2568d
C#: Remove recursion.

michaelnebel
authored and
hugo-syn
committed
8519b91