hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add unit tests for webform case with auth in code

Browse Source
This commit is contained in:
Joe Farebrother
2023-06-06 13:35:49 +01:00
parent 57b3b2b2e3
commit 1b6e7f9140
5 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MissingAccessControl.expected Normal file
View File

@@ -0,0 +1,2 @@
| Test1/EditProfile.aspx.cs:9:20:9:29 | btn1_Click | This action is missing an authorization check. |
| Test1/ViewProfile.aspx.cs:14:20:14:36 | btn_delete1_Click | This action is missing an authorization check. |

1
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MissingAccessControl.qlref Normal file
View File

@@ -0,0 +1 @@
Security Features/CWE-285/MissingAccessControl.ql

18
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test1/EditProfile.aspx.cs Normal file
View File

@@ -0,0 +1,18 @@
using System;
using System.Web.UI;
class EditProfile : System.Web.UI.Page {
private void doThings() { }
private bool isAuthorized() { return false; }
protected void btn1_Click(object sender, EventArgs e) {
doThings();
}
protected void btn2_Click(object sender, EventArgs e) {
if (isAuthorized()) {
doThings();
}
}
}

23
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test1/ViewProfile.aspx.cs Normal file
View File

@@ -0,0 +1,23 @@
using System;
using System.Web.UI;
using System.Web.Security;
class ViewProfile : System.Web.UI.Page {
private void doThings() { }
public System.Security.Principal.IPrincipal User { get; } // TODO: this should be in the stubs
protected void btn_safe_Click(object sender, EventArgs e) {
doThings();
}
protected void btn_delete1_Click(object sender, EventArgs e) {
doThings();
}
protected void btn_delete2_Click(object sender, EventArgs e) {
if (User.IsInRole("admin")) {
doThings();
}
}
}

1
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/options Normal file
View File

@@ -0,0 +1 @@
semmle-extractor-options: /r:System.Runtime.Extensions.dll /r:System.Collections.Specialized.dll ${testdir}/../../../../resources/stubs/System.Web.cs