hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-19 14:04:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add MVC tests

Browse Source
This commit is contained in:
Joe Farebrother
2023-08-17 15:51:48 +01:00
parent 20d42dfd7d
commit 009a7bfc87
4 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/CommentController.cs Normal file
View File

@@ -0,0 +1,22 @@
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authorization;
public class CommentController : Controller {
// BAD: Any user can access this.
public ActionResult Edit1(int commentId, string text) {
editComment(commentId, text);
return View();
}
// GOOD: The user's authorization is checked.
public ActionResult Edit2(int commentId, string text) {
if (canEditComment(commentId, User.Identity.Name)){
editComment(commentId, text);
}
return View();
}
void editComment(int commentId, string text) { }
bool canEditComment(int commentId, string userName) { return false; }
}

1
csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/InsecureDirectObjectReference.expected Normal file
View File

@@ -0,0 +1 @@
| CommentController.cs:6:25:6:29 | Edit1 | This method may not verify which users should be able to access resources of the provided ID. |

1
csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/InsecureDirectObjectReference.qlref Normal file
View File

@@ -0,0 +1 @@
Security Features/CWE-639/InsecureDirectObjectReference.ql

3
csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/options Normal file
View File

@@ -0,0 +1,3 @@
semmle-extractor-options: /nostdlib /noconfig
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj