hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20658 from github/redsun82/csharp-fix-xframe-options-in-location

Browse Source 
Csharp: fix `cs/web/missing-x-frame-options` to also consider `location` elements
This commit is contained in:
Paolo Tranquilli
2025-10-27 13:49:09 +01:00
committed by GitHub
parent 2e0e9e0834 3f98d32124
commit 105f810654
7 changed files with 51 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.cs Normal file
View File

@@ -0,0 +1,18 @@
using System;
using System.Web;
public class AddXFrameOptions : IHttpHandler
{
public void ProcessRequest(HttpContext ctx)
{
}
public bool IsReusable
{
get
{
return true;
}
}
}

0
csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.expected Normal file
View File

1
csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.qlref Normal file
View File

@@ -0,0 +1 @@
Security Features/CWE-451/MissingXFrameOptions.ql

12
csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/Web.config Normal file
View File

@@ -0,0 +1,12 @@
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<location path="." inheritInChildApplications="false">
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="X-Frame-Options" value="SAMEORIGIN" />
</customHeaders>
</httpProtocol>
</system.webServer>
</location>
</configuration>

3
csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/options Normal file
View File

@@ -0,0 +1,3 @@
semmle-extractor-options: /nostdlib /noconfig
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
semmle-extractor-options: ${testdir}/../../../../../resources/stubs/System.Web.cs