csharp_object_dataprovider.ql

/**
 * @kind path-problem
 */

import csharp

class ODPSetter extends Setter {
  ODPSetter() {
    getDeclaringType().getName() = "ObjectDataProvider" and
    getName() = "set_ObjectInstance"
  }
}

class StartMethod extends Setter {
  StartMethod() { getDeclaringType().getABaseInterface().getName() = "ISerializable" }
}

class TargetMethod extends Method {
  TargetMethod() { getName() = "InvokeMember" }
}

query predicate edges(Method a, Method b) {
  a.calls(b) and
  (
    a.getDeclaringType().getASubType+() = b.getDeclaringType()
    or a.getDeclaringType().getABaseType+() = b.getDeclaringType()
  )
}

from Method end, ODPSetter prestart, Method entryPoint
where
  prestart.calls(entryPoint) and
  edges+(entryPoint, end)
select end, entryPoint, end, "Found a path from start to target."