Merge pull request #15629 from egregius313/egregius313/csharp/dataflo…

…w/threat-modeling/remove-stored-query-variants

C#: Remove `Stored` variants of queries

csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md

@@ -0,0 +1,5 @@
+---
+category: majorAnalysis
+---
+* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`. `cs/second-order-sql-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `file` and `database` threat models in your threat model configuration.
+

csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs

@@ -1,4 +1,6 @@
 using System;
+using System.Data.SqlClient;
+using System.Diagnostics;
 
 namespace System.Web.UI.WebControls
 {
@@ -34,5 +36,22 @@ public void WebCommandInjection()
             startInfoProps.WorkingDirectory = userInput;
             Process.Start(startInfoProps);
         }
+
+        public void StoredCommandInjection()
+        {
+            using (SqlConnection connection = new SqlConnection(""))
+            {
+                connection.Open();
+                SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
+                SqlDataReader customerReader = customerCommand.ExecuteReader();
+
+                while (customerReader.Read())
+                {
+                    // BAD: Read from database, and use it to directly execute a command
+                    Process.Start("foo.exe", "/c " + customerReader.GetString(1));
+                }
+                customerReader.Close();
+            }
+        }
     }
 }