C#: Recognize safe output encoding in cs/log-forging

csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll

@@ -10,6 +10,7 @@ private import semmle.code.csharp.frameworks.system.text.RegularExpressions
 private import semmle.code.csharp.security.Sanitizers
 private import semmle.code.csharp.security.dataflow.flowsinks.ExternalLocationSink
 private import semmle.code.csharp.dataflow.internal.ExternalFlow
+private import semmle.code.csharp.security.dataflow.JsonLoggingConfiguration
 
 /**
  * A data flow source for untrusted user input used in log entries.
@@ -57,6 +58,7 @@ private class HtmlSanitizer extends Sanitizer {
  */
 private class LogForgingLogMessageSink extends Sink, LogMessageSink {
   LogForgingLogMessageSink() {
+    not isJsonProtectedLogArgument(this.getExpr()) and
     not exists(ExtensionMethodCall mc |
       this.getExpr() = mc.getAnArgument() and
       mc.getTarget().fromSource()

csharp/ql/src/change-notes/2026-10-01-json-logging-log-forging.md

@@ -0,0 +1,7 @@
+---
+category: minorAnalysis
+---
+* The `cs/log-forging` query now uses a conservative, database-wide heuristic to recognize
+  supported code-configured Serilog and .NET JSON-only logging setups. This reduces false-positive
+  results for standard logging calls when all visible logging configuration in the database is
+  safe and understood.

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInSafe/LogForging.expected

@@ -0,0 +1,4 @@
+#select
+edges
+nodes
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInSafe/LogForging.qlref

@@ -0,0 +1,4 @@
+query: Security Features/CWE-117/LogForging.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInSafe/Test.cs

@@ -0,0 +1,20 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using System.Web;
+
+class BuiltInJsonLoggingController : ControllerBase
+{
+    public void Action(HttpContext context)
+    {
+        using var factory = LoggerFactory.Create(logging => logging.AddJsonConsole());
+        var logger = factory.CreateLogger("Example");
+        var genericLogger = factory.CreateLogger<BuiltInJsonLoggingController>();
+        string input = context.Request.QueryString["input"];
+        logger.LogInformation("Input: {Input}", input);
+        logger.LogInformation($"Input: {input}");
+        genericLogger.LogInformation("Input: {Input}", input);
+
+        var explicitlyDisposed = LoggerFactory.Create(logging => logging.AddJsonConsole());
+        explicitlyDisposed.Dispose();
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInSafe/options

@@ -0,0 +1,3 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInUnsafe/LogForging.expected

@@ -0,0 +1,15 @@
+#select
+| Test.cs:16:49:16:53 | access to local variable input | Test.cs:15:24:15:50 | access to property QueryString : NameValueCollection | Test.cs:16:49:16:53 | access to local variable input | This log entry depends on a $@. | Test.cs:15:24:15:50 | access to property QueryString | user-provided value |
+edges
+| Test.cs:15:16:15:20 | access to local variable input : String | Test.cs:16:49:16:53 | access to local variable input | provenance |  |
+| Test.cs:15:24:15:50 | access to property QueryString : NameValueCollection | Test.cs:15:16:15:20 | access to local variable input : String | provenance |  |
+| Test.cs:15:24:15:50 | access to property QueryString : NameValueCollection | Test.cs:15:24:15:59 | access to indexer : String | provenance | MaD:1 |
+| Test.cs:15:24:15:59 | access to indexer : String | Test.cs:15:16:15:20 | access to local variable input : String | provenance |  |
+models
+| 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
+nodes
+| Test.cs:15:16:15:20 | access to local variable input : String | semmle.label | access to local variable input : String |
+| Test.cs:15:24:15:50 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| Test.cs:15:24:15:59 | access to indexer : String | semmle.label | access to indexer : String |
+| Test.cs:16:49:16:53 | access to local variable input | semmle.label | access to local variable input |
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInUnsafe/LogForging.qlref

@@ -0,0 +1,4 @@
+query: Security Features/CWE-117/LogForging.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInUnsafe/Test.cs

@@ -0,0 +1,18 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using System.Web;
+
+class MixedBuiltInLoggingController : ControllerBase
+{
+    public void Configure()
+    {
+        LoggerFactory.Create(logging => logging.ClearProviders().AddJsonConsole());
+        LoggerFactory.Create(logging => logging.AddConsole());
+    }
+
+    public void Action(HttpContext context, ILogger logger)
+    {
+        string input = context.Request.QueryString["input"]; // $ Source
+        logger.LogInformation("Input: {Input}", input); // $ Alert
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingBuiltInUnsafe/options

@@ -0,0 +1,3 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingHostSafe/LogForging.expected

@@ -0,0 +1,4 @@
+#select
+edges
+nodes
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingHostSafe/LogForging.qlref

@@ -0,0 +1,4 @@
+query: Security Features/CWE-117/LogForging.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingHostSafe/Test.cs

@@ -0,0 +1,24 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Hosting;
+using System.Web;
+
+class JsonHost
+{
+    public void Configure()
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.Logging.ClearProviders();
+        builder.Logging.AddJsonConsole();
+
+        var genericHost = new HostApplicationBuilder();
+        genericHost.Logging.ClearProviders();
+        genericHost.Logging.AddJsonConsole();
+    }
+
+    public void Action(HttpContext context, ILogger logger)
+    {
+        string input = context.Request.QueryString["input"];
+        logger.LogInformation("Input: {Input}", input);
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingHostSafe/options

@@ -0,0 +1,3 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogForwarding/LogForging.expected

@@ -0,0 +1,15 @@
+#select
+| Test.cs:18:49:18:53 | access to local variable input | Test.cs:17:24:17:50 | access to property QueryString : NameValueCollection | Test.cs:18:49:18:53 | access to local variable input | This log entry depends on a $@. | Test.cs:17:24:17:50 | access to property QueryString | user-provided value |
+edges
+| Test.cs:17:16:17:20 | access to local variable input : String | Test.cs:18:49:18:53 | access to local variable input | provenance |  |
+| Test.cs:17:24:17:50 | access to property QueryString : NameValueCollection | Test.cs:17:16:17:20 | access to local variable input : String | provenance |  |
+| Test.cs:17:24:17:50 | access to property QueryString : NameValueCollection | Test.cs:17:24:17:59 | access to indexer : String | provenance | MaD:1 |
+| Test.cs:17:24:17:59 | access to indexer : String | Test.cs:17:16:17:20 | access to local variable input : String | provenance |  |
+models
+| 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
+nodes
+| Test.cs:17:16:17:20 | access to local variable input : String | semmle.label | access to local variable input : String |
+| Test.cs:17:24:17:50 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| Test.cs:17:24:17:59 | access to indexer : String | semmle.label | access to indexer : String |
+| Test.cs:18:49:18:53 | access to local variable input | semmle.label | access to local variable input |
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogForwarding/LogForging.qlref

@@ -0,0 +1,4 @@
+query: Security Features/CWE-117/LogForging.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogForwarding/Test.cs

@@ -0,0 +1,20 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Serilog;
+using Serilog.Formatting.Json;
+using System.Web;
+
+class ForwardingLogging
+{
+    public void Configure(IServiceCollection services)
+    {
+        services.AddSerilog(configuration => configuration.WriteTo.Console(new JsonFormatter()),
+            writeToProviders: true);
+    }
+
+    public void Action(HttpContext context, Microsoft.Extensions.Logging.ILogger logger)
+    {
+        string input = context.Request.QueryString["input"]; // $ Source
+        logger.LogInformation("Input: {Input}", input); // $ Alert
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogForwarding/options

@@ -0,0 +1,4 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/Serilog/Serilog.csproj
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogSafe/LogForging.expected

@@ -0,0 +1,18 @@
+#select
+| Test.cs:65:35:65:39 | access to local variable input | Test.cs:55:24:55:50 | access to property QueryString : NameValueCollection | Test.cs:65:35:65:39 | access to local variable input | This log entry depends on a $@. | Test.cs:55:24:55:50 | access to property QueryString | user-provided value |
+| Test.cs:66:50:66:54 | access to local variable input | Test.cs:55:24:55:50 | access to property QueryString : NameValueCollection | Test.cs:66:50:66:54 | access to local variable input | This log entry depends on a $@. | Test.cs:55:24:55:50 | access to property QueryString | user-provided value |
+edges
+| Test.cs:55:16:55:20 | access to local variable input : String | Test.cs:65:35:65:39 | access to local variable input | provenance |  |
+| Test.cs:55:16:55:20 | access to local variable input : String | Test.cs:66:50:66:54 | access to local variable input | provenance |  |
+| Test.cs:55:24:55:50 | access to property QueryString : NameValueCollection | Test.cs:55:16:55:20 | access to local variable input : String | provenance |  |
+| Test.cs:55:24:55:50 | access to property QueryString : NameValueCollection | Test.cs:55:24:55:59 | access to indexer : String | provenance | MaD:1 |
+| Test.cs:55:24:55:59 | access to indexer : String | Test.cs:55:16:55:20 | access to local variable input : String | provenance |  |
+models
+| 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
+nodes
+| Test.cs:55:16:55:20 | access to local variable input : String | semmle.label | access to local variable input : String |
+| Test.cs:55:24:55:50 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| Test.cs:55:24:55:59 | access to indexer : String | semmle.label | access to indexer : String |
+| Test.cs:65:35:65:39 | access to local variable input | semmle.label | access to local variable input |
+| Test.cs:66:50:66:54 | access to local variable input | semmle.label | access to local variable input |
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogSafe/LogForging.qlref

@@ -0,0 +1,4 @@
+query: Security Features/CWE-117/LogForging.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogSafe/Test.cs

@@ -0,0 +1,68 @@
+using System;
+using System.Diagnostics;
+using System.Web;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Serilog;
+using Serilog.Formatting.Json;
+using Serilog.Formatting.Compact;
+using Company;
+
+namespace Custom
+{
+    class ILogger
+    {
+        public void Warn(string message) { }
+    }
+}
+
+class JsonLoggingController : ControllerBase
+{
+    public void Configure()
+    {
+        Log.Logger = new LoggerConfiguration()
+            .WriteTo.Async(write => write.Console(new JsonFormatter()))
+            .CreateBootstrapLogger();
+
+        var builder = WebApplication.CreateBuilder();
+        builder.AddCompanyDefaults();
+        builder.Services.AddBusinessServices();
+        builder.Services.AddSerilog((provider, configuration) => configuration
+            .Enrich.FromLogContext()
+            .Enrich.WithProperty("Application", "test")
+            .WriteTo.Console(new JsonFormatter())
+            .WriteTo.Console(new JsonFormatter(closingDelimiter: null, renderMessage: true))
+            .WriteTo.Console(new CompactJsonFormatter())
+            .WriteTo.Console(new RenderedCompactJsonFormatter(new JsonValueFormatter()))
+            .WriteTo.File(new JsonFormatter(), "safe.log")
+            .AuditTo.Console(new JsonFormatter()),
+            preserveStaticLogger: false,
+            writeToProviders: false);
+        var app = builder.Build();
+        app.MapGet("/", (Microsoft.AspNetCore.Http.HttpContext context,
+            Microsoft.Extensions.Logging.ILogger<JsonLoggingController> logger) =>
+        {
+            string input = context.Request.Query["input"].ToString();
+            logger.LogInformation("Input: {Input}", input);
+            return input;
+        });
+    }
+
+    public void Action(HttpContext context, Microsoft.Extensions.Logging.ILogger logger, Serilog.ILogger serilog)
+    {
+        string input = context.Request.QueryString["input"]; // $ Source
+        logger.LogInformation("Input: {Input}", input);
+        logger.LogInformation($"Input: {input}");
+        serilog.Information("Input: {Input}", input);
+
+        var concrete = new LoggerConfiguration()
+            .WriteTo.Console(new JsonFormatter())
+            .CreateLogger();
+        concrete.Information("Input: {Input}", input);
+
+        new Custom.ILogger().Warn(input); // $ Alert
+        new TraceSource("test").TraceInformation(input); // $ Alert
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogSafe/options

@@ -0,0 +1,4 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/Serilog/Serilog.csproj
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogUnsafe/LogForging.expected

@@ -0,0 +1,15 @@
+#select
+| Test.cs:23:49:23:53 | access to local variable input | Test.cs:22:24:22:50 | access to property QueryString : NameValueCollection | Test.cs:23:49:23:53 | access to local variable input | This log entry depends on a $@. | Test.cs:22:24:22:50 | access to property QueryString | user-provided value |
+edges
+| Test.cs:22:16:22:20 | access to local variable input : String | Test.cs:23:49:23:53 | access to local variable input | provenance |  |
+| Test.cs:22:24:22:50 | access to property QueryString : NameValueCollection | Test.cs:22:16:22:20 | access to local variable input : String | provenance |  |
+| Test.cs:22:24:22:50 | access to property QueryString : NameValueCollection | Test.cs:22:24:22:59 | access to indexer : String | provenance | MaD:1 |
+| Test.cs:22:24:22:59 | access to indexer : String | Test.cs:22:16:22:20 | access to local variable input : String | provenance |  |
+models
+| 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
+nodes
+| Test.cs:22:16:22:20 | access to local variable input : String | semmle.label | access to local variable input : String |
+| Test.cs:22:24:22:50 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| Test.cs:22:24:22:59 | access to indexer : String | semmle.label | access to indexer : String |
+| Test.cs:23:49:23:53 | access to local variable input | semmle.label | access to local variable input |
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogUnsafe/LogForging.qlref

@@ -0,0 +1,4 @@
+query: Security Features/CWE-117/LogForging.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogUnsafe/Test.cs

@@ -0,0 +1,25 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Serilog;
+using Serilog.Formatting.Json;
+using System.Web;
+
+class UnsafeJsonLoggingController : ControllerBase
+{
+    public void Configure(IServiceCollection services,
+        Microsoft.Extensions.Configuration.IConfiguration externalConfiguration)
+    {
+        services.AddSerilog(configuration => configuration
+            .WriteTo.Console(new JsonFormatter()));
+
+        // A discovered external configuration reader vetoes the database-wide optimization.
+        new LoggerConfiguration().ReadFrom.Configuration(externalConfiguration).CreateLogger();
+    }
+
+    public void Action(HttpContext context, Microsoft.Extensions.Logging.ILogger logger)
+    {
+        string input = context.Request.QueryString["input"]; // $ Source
+        logger.LogInformation("Input: {Input}", input); // $ Alert
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingSerilogUnsafe/options

@@ -0,0 +1,4 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/Serilog/Serilog.csproj
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingStandaloneLogger/LogForging.expected

@@ -0,0 +1,15 @@
+#select
+| Test.cs:17:49:17:53 | access to local variable input | Test.cs:16:24:16:50 | access to property QueryString : NameValueCollection | Test.cs:17:49:17:53 | access to local variable input | This log entry depends on a $@. | Test.cs:16:24:16:50 | access to property QueryString | user-provided value |
+edges
+| Test.cs:16:16:16:20 | access to local variable input : String | Test.cs:17:49:17:53 | access to local variable input | provenance |  |
+| Test.cs:16:24:16:50 | access to property QueryString : NameValueCollection | Test.cs:16:16:16:20 | access to local variable input : String | provenance |  |
+| Test.cs:16:24:16:50 | access to property QueryString : NameValueCollection | Test.cs:16:24:16:59 | access to indexer : String | provenance | MaD:1 |
+| Test.cs:16:24:16:59 | access to indexer : String | Test.cs:16:16:16:20 | access to local variable input : String | provenance |  |
+models
+| 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
+nodes
+| Test.cs:16:16:16:20 | access to local variable input : String | semmle.label | access to local variable input : String |
+| Test.cs:16:24:16:50 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| Test.cs:16:24:16:59 | access to indexer : String | semmle.label | access to indexer : String |
+| Test.cs:17:49:17:53 | access to local variable input | semmle.label | access to local variable input |
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingStandaloneLogger/LogForging.qlref

@@ -0,0 +1,4 @@
+query: Security Features/CWE-117/LogForging.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingStandaloneLogger/Test.cs

@@ -0,0 +1,19 @@
+using Microsoft.Extensions.Logging;
+using Serilog;
+using Serilog.Formatting.Json;
+using System.Web;
+
+class StandaloneLogger
+{
+    public void Configure()
+    {
+        // A safe static logger does not establish the configuration of an injected logger.
+        Log.Logger = new LoggerConfiguration().WriteTo.Console(new JsonFormatter()).CreateLogger();
+    }
+
+    public void Action(HttpContext context, Microsoft.Extensions.Logging.ILogger logger)
+    {
+        string input = context.Request.QueryString["input"]; // $ Source
+        logger.LogInformation("Input: {Input}", input); // $ Alert
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-117-JsonLoggingStandaloneLogger/options

@@ -0,0 +1,4 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/Serilog/Serilog.csproj
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs