C#: Add implicit System.Collections.Generic.KeyValuePair2.Value reads at taint sinks

[MathiasVP]

Java includes MapValueContent in the set of implicit taint reads (see here), but C# doesn't.

This leads to some developer confusion when trying to write the same query for both Java and C#. Additionally, C# uses the System.Collections.Generic.KeyValuePair.Value property (+ an ElementContent) to model the equivalent of a MapValueContent in Java which makes it even more mysterious when translating a query from Java to C#.

This PR fixes this problem by adding implicit reads of System.Collections.Generic.KeyValuePair.Value. This means that C# and Java behaves (hopefully) similarly when taint-tracking ends up with a "map-like" collection at a sink.

cc @hvitved

[Copilot]

Pull request overview

This PR adds implicit reads of System.Collections.Generic.KeyValuePair<TKey,TValue>.Value property at taint sinks in C# to align taint tracking behavior with Java's MapValueContent handling. This change makes it easier to write cross-language queries and ensures consistent behavior when taint tracking encounters dictionary-like collections at sinks.

Key Changes:

• Added implicit taint read for KeyValuePair.Value property at sinks
• Refactored test infrastructure to share common configuration
• Added test case demonstrating the new implicit read behavior

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll	Core implementation adding KeyValuePair.Value to implicit taint reads
csharp/ql/test/library-tests/dataflow/collections/CollectionFlowCommon.qll	New shared test configuration module
csharp/ql/test/library-tests/dataflow/collections/CollectionTaintFlow.ql	New test query for taint flow validation
csharp/ql/test/library-tests/dataflow/collections/CollectionDataFlow.ql	Refactored to use common configuration
csharp/ql/test/library-tests/dataflow/collections/CollectionFlow.cs	Added test case for implicit map value read
csharp/ql/test/library-tests/dataflow/collections/CollectionTaintFlow.expected	Expected test results

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aschackmull]

Additionally, C# uses the System.Collections.Generic.KeyValuePair.Value property (+ an ElementContent) to model the equivalent of a MapValueContent in Java which makes it even more mysterious when translting a query from Java to C#.

C# needs to do it this way because C# maps implement IEnumerabl<KeyValuePair> - the Java Map interface doesn't do that.

[MathiasVP]

Additionally, C# uses the System.Collections.Generic.KeyValuePair.Value property (+ an ElementContent) to model the equivalent of a MapValueContent in Java which makes it even more mysterious when translting a query from Java to C#.

C# needs to do it this way because C# maps implement IEnumerabl<KeyValuePair> - the Java Map interface doesn't do that.

Oh yeah no hate towards the way C# does it. The strategy totally makes sense. I'm just saying this additional quirk makes it harder for people to write "the same" query for both Java and C#.

[hvitved]

LGTM (assuming DCA is good).

[MathiasVP]

DCA looked uneventful