Skip to content

TaintFlow not picking up on implicit toString() #18399

Closed
@edkazcarlson-ms

Description

@edkazcarlson-ms

Hello,
When the this keyword is used in an interpolated string with no property identifiers/ methods, C# treats the this keyword to implicitly be this.toString(). In testing, doing $"{this}" and $"{this.toString()}" result in the same string, however CodeQL only seems to be detecting the taint flow with the version with .toString() (see attached file). Can a future release of CodeQL please fix this so that we can properly track taint flows when they pass through fields that are used in the toString() method? Thank you.
Attached zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    C#questionFurther information is requested

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions