C#: Convert Deserialization tests to use inline expectations.

Author: michaelnebel

csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.cs

@@ -11,11 +11,11 @@ public static void M(FileStream fs)
     {
         var formatter = new BinaryFormatter();
         // BAD
-        var a = (Func<int>)formatter.Deserialize(fs);
+        var a = (Func<int>)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
         // BAD
-        var b = (Expression<Func<int>>)formatter.Deserialize(fs);
+        var b = (Expression<Func<int>>)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
         // BAD
-        var c = (D)formatter.Deserialize(fs);
+        var c = (D)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
         // GOOD
         var d = (int)formatter.Deserialize(fs);
     }

csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.qlref

@@ -1 +1,4 @@
-Security Features/CWE-502/DeserializedDelegate.ql
+query: Security Features/CWE-502/DeserializedDelegate.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegateBad.cs

@@ -8,7 +8,7 @@ public static int InvokeSerialized(FileStream fs)
     {
         var formatter = new BinaryFormatter();
         // BAD
-        var f = (Func<int>)formatter.Deserialize(fs);
+        var f = (Func<int>)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
         return f();
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/BinaryFormatterBad.cs

@@ -7,6 +7,6 @@ public static object Deserialize(Stream s)
     {
         var ds = new BinaryFormatter();
         // BAD
-        return ds.Deserialize(s);
+        return ds.Deserialize(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractJsonSerializerBad.cs

@@ -8,6 +8,6 @@ public static object Deserialize(Type type, Stream s)
     {
         var ds = new DataContractJsonSerializer(type);
         // BAD
-        return ds.ReadObject(s);
+        return ds.ReadObject(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractSerializerBad.cs

@@ -8,6 +8,6 @@ public static object Deserialize(Type type, Stream s)
     {
         var ds = new DataContractSerializer(type);
         // BAD
-        return ds.ReadObject(s);
+        return ds.ReadObject(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ResourceReaderBad.cs

@@ -6,11 +6,11 @@ class BadResourceReader
 {
     public static void Deserialize(Stream s)
     {
-        var ds = new ResourceReader(s);
+        var ds = new ResourceReader(s); // $ Alert[cs/unsafe-deserialization]
         // BAD
         var dict = ds.GetEnumerator();
         while (dict.MoveNext())
-            Console.WriteLine("   {0}: '{1}' (Type {2})", 
+            Console.WriteLine("   {0}: '{1}' (Type {2})",
                             dict.Key, dict.Value, dict.Value.GetType().Name);
         ds.Close();
     }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserialization.qlref

@@ -1 +1,4 @@
-Security Features/CWE-502/UnsafeDeserialization.ql
+query: Security Features/CWE-502/UnsafeDeserialization.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserializationBad.cs

@@ -6,6 +6,6 @@ public static object Deserialize(string s)
     {
         JavaScriptSerializer sr = new JavaScriptSerializer(new SimpleTypeResolver());
         // BAD
-        return sr.DeserializeObject(s);
+        return sr.DeserializeObject(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlObjectSerializerBad.cs

@@ -8,6 +8,6 @@ public static object Deserialize(Type type, Stream s)
     {
         XmlObjectSerializer ds = new DataContractSerializer(type);
         // BAD
-        return ds.ReadObject(s);
+        return ds.ReadObject(s); // $ Alert[cs/unsafe-deserialization]
     }
 }