C#: Fix false positives in cs/log-forging for extension methods

[Gregro]

The log forging query previously treated all arguments to methods called on logger types as sinks, including user-defined extension methods. This caused false positives when extension methods sanitize input internally, since interprocedural analysis was bypassed.

Now, only direct instance method calls on logger types are treated as sinks. User-defined extension methods are analyzed interprocedurally, allowing the query to see sanitization within method bodies.

Known framework extension methods (Microsoft.Extensions.Logging.LoggerExtensions) are modeled as explicit sinks via Models as Data.

Fixes #15824

[Copilot]

Pull request overview

Updates the C# cs/log-forging dataflow to avoid treating user-defined logger extension methods as sinks, reducing false positives while still flagging framework logging extension methods via Models as Data.

Changes:

• Refines the log-forging sink definition to focus on direct instance calls on logger types rather than all calls with logger arguments.
• Adds Models-as-Data sink models for Microsoft.Extensions.Logging.LoggerExtensions logging APIs.
• Extends CWE-117 test coverage to include safe/unsafe user-defined extension methods and updates expected results + changelog.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected	Updates expected results to reflect new sink modeling and interprocedural flows through extension methods.
csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.cs	Adds user-defined logger extension methods (safe/unsafe) to validate reduced false positives.
csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll	Adjusts sink definition intended to exclude extension methods from being treated as sinks.
csharp/ql/lib/ext/Microsoft.Extensions.Logging.Sinks.model.yml	Introduces explicit sink models for Microsoft.Extensions.Logging.LoggerExtensions APIs.
csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md	Documents the analysis change and new MaD modeling.

[hvitved]

Thanks a lot for your contribution, much appreciated.

[hvitved]

How about this instead?

private class LogForgingLogMessageSink extends Sink, LogMessageSink {
  LogForgingLogMessageSink() {
    not exists(MethodCall mc, Method m |
      this.getExpr() = mc.getAnArgument() and
      m.fromSource()
    )
  }
}

Then it shouldn't be necessary to add the explicit models.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

• Changes to framework-coverage-csharp.rst:

-    Others,"``Amazon.Lambda.APIGatewayEvents``, ``Amazon.Lambda.Core``, ``Dapper``, ``ILCompiler``, ``ILLink.RoslynAnalyzer``, ``ILLink.Shared``, ``ILLink.Tasks``, ``Internal.IL``, ``Internal.Pgo``, ``Internal.TypeSystem``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.AspNetCore.Components``, ``Microsoft.AspNetCore.Http``, ``Microsoft.AspNetCore.Mvc``, ``Microsoft.AspNetCore.WebUtilities``, ``Microsoft.CSharp``, ``Microsoft.Data.SqlClient``, ``Microsoft.Diagnostics.Tools.Pgo``, ``Microsoft.DotNet.Build.Tasks``, ``Microsoft.DotNet.PlatformAbstractions``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.Diagnostics.Metrics``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.JSInterop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``Mono.Linker``, ``MySql.Data.MySqlClient``, ``NHibernate``, ``Newtonsoft.Json``, ``SourceGenerators``, ``Windows.Security.Cryptography.Core``",60,2406,162,4
+    Others,"``Amazon.Lambda.APIGatewayEvents``, ``Amazon.Lambda.Core``, ``Dapper``, ``ILCompiler``, ``ILLink.RoslynAnalyzer``, ``ILLink.Shared``, ``ILLink.Tasks``, ``Internal.IL``, ``Internal.Pgo``, ``Internal.TypeSystem``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.AspNetCore.Components``, ``Microsoft.AspNetCore.Http``, ``Microsoft.AspNetCore.Mvc``, ``Microsoft.AspNetCore.WebUtilities``, ``Microsoft.CSharp``, ``Microsoft.Data.SqlClient``, ``Microsoft.Diagnostics.Tools.Pgo``, ``Microsoft.DotNet.Build.Tasks``, ``Microsoft.DotNet.PlatformAbstractions``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.Diagnostics.Metrics``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.JSInterop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``Mono.Linker``, ``MySql.Data.MySqlClient``, ``NHibernate``, ``Newtonsoft.Json``, ``SourceGenerators``, ``Windows.Security.Cryptography.Core``",60,2406,190,4
-    Totals,,108,14908,415,9
+    Totals,,108,14908,443,9

• Changes to framework-coverage-csharp.csv:

- Microsoft.Extensions.Logging,,,110,,,,,,,,,,,,,,,,,,,29,81
+ Microsoft.Extensions.Logging,28,,110,,,,,,,,,28,,,,,,,,,,29,81