hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Add test case for authorization attribute that extends Authorize.

Browse Source
This commit is contained in:
Michael Nebel
2025-04-14 14:18:30 +02:00
parent 8d571672e9
commit 2e7e276806
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/MissingAccessControl.expected
View File

@@ -1 +1,5 @@
| ProfileController.cs:10:25:10:31 | Delete1 | This action is missing an authorization check. |
#select
| ProfileController.cs:12:25:12:31 | Delete1 | This action is missing an authorization check. |
| ProfileController.cs:39:25:39:31 | Delete4 | This action is missing an authorization check. |
testFailures
| ProfileController.cs:39:25:39:31 | This action is missing an authorization check. | Unexpected result: Alert |

9
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/ProfileController.cs
View File

@@ -1,6 +1,8 @@
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authorization;
public class RequirePermissionAttribute : AuthorizeAttribute { }
public class ProfileController : Controller
{
private void doThings() { }
@@ -32,6 +34,13 @@ public class ProfileController : Controller
return View();
}
// GOOD: The RequirePermission attribute is used (which extends AuthorizeAttribute).
[RequirePermission]
public ActionResult Delete4(int id)
{
doThings();
return View();
}
}
[Authorize]