C#: Recognize safe output encoding in cs/log-forging

Author: Bubby4j

csharp/ql/lib/semmle/code/csharp/security/dataflow/JsonLoggingConfiguration.qll

@@ -10,6 +10,7 @@ private import semmle.code.csharp.frameworks.system.text.RegularExpressions
 private import semmle.code.csharp.security.Sanitizers
 private import semmle.code.csharp.security.dataflow.flowsinks.ExternalLocationSink
 private import semmle.code.csharp.dataflow.internal.ExternalFlow
+private import semmle.code.csharp.security.dataflow.JsonLoggingConfiguration
 
 /**
  * A data flow source for untrusted user input used in log entries.
@@ -57,6 +58,7 @@ private class HtmlSanitizer extends Sanitizer {
  */
 private class LogForgingLogMessageSink extends Sink, LogMessageSink {
   LogForgingLogMessageSink() {
+    not isJsonProtectedLogArgument(this.getExpr()) and
     not exists(ExtensionMethodCall mc |
       this.getExpr() = mc.getAnArgument() and
       mc.getTarget().fromSource()

csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll

@@ -0,0 +1,7 @@
+---
+category: minorAnalysis
+---
+* The `cs/log-forging` query now uses a conservative, database-wide heuristic to recognize
+  supported code-configured Serilog and .NET JSON-only logging setups. This reduces false-positive
+  results for standard logging calls when all visible logging configuration in the database is
+  safe and understood.

csharp/ql/src/change-notes/2026-10-01-json-logging-log-forging.md

@@ -0,0 +1,4 @@
+#select
+edges
+nodes
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInSafe/LogForging.expected

@@ -0,0 +1,4 @@
+query: Security Features/CWE-117/LogForging.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInSafe/LogForging.qlref

@@ -0,0 +1,20 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using System.Web;
+
+class BuiltInJsonLoggingController : ControllerBase
+{
+    public void Action(HttpContext context)
+    {
+        using var factory = LoggerFactory.Create(logging => logging.AddJsonConsole());
+        var logger = factory.CreateLogger("Example");
+        var genericLogger = factory.CreateLogger<BuiltInJsonLoggingController>();
+        string input = context.Request.QueryString["input"];
+        logger.LogInformation("Input: {Input}", input);
+        logger.LogInformation($"Input: {input}");
+        genericLogger.LogInformation("Input: {Input}", input);
+
+        var explicitlyDisposed = LoggerFactory.Create(logging => logging.AddJsonConsole());
+        explicitlyDisposed.Dispose();
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInSafe/Test.cs

@@ -0,0 +1,3 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInSafe/options

@@ -0,0 +1,15 @@
+#select
+| Test.cs:16:49:16:53 | access to local variable input | Test.cs:15:24:15:50 | access to property QueryString : NameValueCollection | Test.cs:16:49:16:53 | access to local variable input | This log entry depends on a $@. | Test.cs:15:24:15:50 | access to property QueryString | user-provided value |
+edges
+| Test.cs:15:16:15:20 | access to local variable input : String | Test.cs:16:49:16:53 | access to local variable input | provenance |  |
+| Test.cs:15:24:15:50 | access to property QueryString : NameValueCollection | Test.cs:15:16:15:20 | access to local variable input : String | provenance |  |
+| Test.cs:15:24:15:50 | access to property QueryString : NameValueCollection | Test.cs:15:24:15:59 | access to indexer : String | provenance | MaD:1 |
+| Test.cs:15:24:15:59 | access to indexer : String | Test.cs:15:16:15:20 | access to local variable input : String | provenance |  |
+models
+| 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
+nodes
+| Test.cs:15:16:15:20 | access to local variable input : String | semmle.label | access to local variable input : String |
+| Test.cs:15:24:15:50 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| Test.cs:15:24:15:59 | access to indexer : String | semmle.label | access to indexer : String |
+| Test.cs:16:49:16:53 | access to local variable input | semmle.label | access to local variable input |
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInUnsafe/LogForging.expected

@@ -0,0 +1,4 @@
+query: Security Features/CWE-117/LogForging.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInUnsafe/LogForging.qlref

@@ -0,0 +1,18 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using System.Web;
+
+class MixedBuiltInLoggingController : ControllerBase
+{
+    public void Configure()
+    {
+        LoggerFactory.Create(logging => logging.ClearProviders().AddJsonConsole());
+        LoggerFactory.Create(logging => logging.AddConsole());
+    }
+
+    public void Action(HttpContext context, ILogger logger)
+    {
+        string input = context.Request.QueryString["input"]; // $ Source
+        logger.LogInformation("Input: {Input}", input); // $ Alert
+    }
+}