Fix S2077 FN: Add support for Mono.Data.Sqlite

[loris-s-sonarsource]

Description

Hey dotnet artists!

While tackling APPSEC-725 for the WebGoat framework, it appeared that we did not support the following two method IDs in this rule:

Mono.Data.Sqlite.SqliteDataAdapter.SqliteDataAdapter(string, Mono.Data.Sqlite.SqliteConnection)
Mono.Data.Sqlite.SqliteCommand.SqliteCommand(string, Mono.Data.Sqlite.SqliteConnection)

Cheers!

Repro steps

This appears in the WebGoat.Net project, in this file: https://github.com/jerryhoff/WebGoat.NET/blob/1c6cab19f9029673cd98ba8624bf9cc91d04bae9/WebGoat/App_Code/DB/SqliteDbProvider.cs.

Here is a reproducer:

using Mono.Data.Sqlite;

namespace Reproducer
{
    public class S2077
    {
        void Reproduce(string connectionString, string query)
        {
            //get data
            string sql = "select * from table where query = '" + query + "';";
            
            using (SqliteConnection connection = new SqliteConnection(connectionString))
            {
                connection.Open();

                SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); // FN: S2077

                SqliteCommand command = new SqliteCommand(sql, connection); // FN: S2077
            }              
        }
    }
}

Related information

• .Net Framework v3.5

[martin-strecker-sonarsource]

The Mono.Data.Sqlite.dll is directly referenced in WebGoat.

https://www.nuget.org/packages/Mono.Data.Sqlite
Is the package we should support in our tests as it contains the right types (SqliteDataAdapter, SqliteConnection, and SqliteCommand from the Mono.Data.Sqlite namespace).