[csharp] Delegate propagation fails

[Hug0Vincent]

I’m analyzing a DLL and encountered a code pattern that I’m having trouble modeling with CodeQL. Below is a simplified example to illustrate the issue:

namespace ConsoleApp1
{
    // 1. Define the delegate with one input and one out parameter
    delegate void SimpleDelegate(string input, out string output);

    // 2. A method that matches the delegate signature
    class Handler
    {
        public static void Process(string input, out string output)
        {
            output = "Processed: " + input;
        }
    }

    // 3. Class that stores and retrieves the delegate
    class DelegateRegistry
    {
        public static readonly Dictionary<string, SimpleDelegate> Registry = new Dictionary<string, SimpleDelegate>();

        public static void Register(string key, SimpleDelegate del)
        {
            Registry[key] = del;
        }
    }
    internal class DelegatePoc
    {
        static void Poc()
        {
            string source = "source";
            SimpleDelegate simpleDelegate = new SimpleDelegate(Handler.Process);
            /// Register the delegate
            DelegateRegistry.Register("key", simpleDelegate);

            // Fetch and call
            if (DelegateRegistry.Registry.TryGetValue("key", out SimpleDelegate del))
            {
                string result;
                del(source, out result);
                Console.WriteLine(result);
            }
        }
    }
}

Tracking the source string with partial dataflow analysis ends in the del call. It can't follow to the actual method Process. I also tried to call getTarget / getRuntimeTarget on the DelegateCall but there is no result.

I don't know why it can't follow further or find the Process method ?

[jketema]

Hi @Hug0Vincent,

I've asked the team to have a look.

[Hug0Vincent]

Thank you 🙏

[hvitved]

Hi.

Thanks for your question. This is a known limitation of how we resolve delegate calls (we do not track delegates stored in collections). If it instead had been

    class DelegateRegistry
    {
        public static readonly SimpleDelegate d = null;

        public static void Register(SimpleDelegate del)
        {
            d = del;
        }
    }

then it ought to work (we do track delegates stored in fields).

I have been wanting to improve this for some time, but it has not yet been a priority.

[Hug0Vincent]

Alright thank you for your answer