hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2358 from cldrn/ASPNetPagesValidateRequest

Browse Source 
Adds CodeQL query to check for Pages with disabled built-in validation
This commit is contained in:
Calum Grant
2019-12-09 13:05:03 +00:00
committed by GitHub
parent 25265bddc7 59ce8842bb
commit 3049bf2c85
10 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
change-notes/1.24/analysis-csharp.md
View File

@@ -7,6 +7,7 @@ The following changes in version 1.24 affect C# analysis in all applications.
| **Query** | **Tags** | **Purpose** |
|-----------------------------|-----------|--------------------------------------------------------------------|
| Insecure configuration for ASP.NET requestValidationMode (`cs/insecure-request-validation-mode`) | security, external/cwe/cwe-016 | Finds where this attribute has been set to a value less than 4.5, which turns off some validation features and makes the application less secure. |
| Page request validation is disabled (`cs/web/request-validation-disabled`) | security, frameworks/asp.net, external/cwe/cwe-016 | Finds where ASP.NET page request validation has been disabled, which could makes the application less secure. |
## Changes to existing queries

51
csharp/ql/src/Security Features/CWE-016/ASPNetPagesValidateRequest.qhelp Normal file
View File

@@ -0,0 +1,51 @@
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
<qhelp>
<overview>
<p>
Request validation is a feature in ASP.NET that protects web applications against
potentially malicious content in requests, specifically against
cross-site scripting attacks (XSS).
</p>
</overview>
<recommendation>
<p>
Enable the directive <code>validateRequest</code> in your <code>web.config</code> file:
<code>
&lt;pages validateRequest="true" /&gt;
</code>
</p>
</recommendation>
<example>
<p>
The following example shows the <code>validateRequest</code> flag set to <code>false</code>
in a <code>Web.config</code> file for ASP.NET. This will disable validation, and leave
the web application vulnerable against common XSS attacks:
</p>
<sample src="ASPNetPagesValidateRequestBad.config" />
<p>
If <code>validateRequest</code> is set to <code>true</code>, validation is enabled:
</p>
<sample src="ASPNetPagesValidateRequestGood.config" />
</example>
<references>
<li>
MSDN:
<a
href="https://docs.microsoft.com/en-us/previous-versions/aspnet/hh882339(v=vs.110)?redirectedfrom=MSDN">
Request Validation in ASP.NET
</a>.
</li>
</references>
</qhelp>

19
csharp/ql/src/Security Features/CWE-016/ASPNetPagesValidateRequest.ql Normal file
View File

@@ -0,0 +1,19 @@
/**
* @name Page request validation is disabled
* @description ASP.NET pages should not disable the built-in request validation.
* @kind problem
* @problem.severity warning
* @id cs/web/request-validation-disabled
* @tags security
* frameworks/asp.net
* external/cwe/cwe-16
*/
import csharp
import semmle.code.asp.WebConfig
from SystemWebXMLElement web, XMLAttribute requestvalidateAttribute
where
requestvalidateAttribute = web.getAChild("pages").getAttribute("validateRequest") and
requestvalidateAttribute.getValue().toLowerCase() = "false"
select requestvalidateAttribute, "The 'validateRequest' attribute is set to 'false'."

5
csharp/ql/src/Security Features/CWE-016/ASPNetPagesValidateRequestBad.config Normal file
View File

@@ -0,0 +1,5 @@
<configuration>
<system.web>
<pages validateRequest="false" />
</system.web>
</configuration>

5
csharp/ql/src/Security Features/CWE-016/ASPNetPagesValidateRequestGood.config Normal file
View File

@@ -0,0 +1,5 @@
<configuration>
<system.web>
<pages validateRequest="true" />
</system.web>
</configuration>

1
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequest.expected Normal file
View File

@@ -0,0 +1 @@
| ASPNetPagesValidateRequestBad.config:3:5:3:38 | validateRequest=false | The 'validateRequest' attribute is set to 'false'. |

1
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequest.qlref Normal file
View File

@@ -0,0 +1 @@
Security Features/CWE-016/ASPNetPagesValidateRequest.ql

5
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequestBad.config Normal file
View File

@@ -0,0 +1,5 @@
<configuration>
<system.web>
<pages validateRequest="false" />
</system.web>
</configuration>

5
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequestGood.config Normal file
View File

@@ -0,0 +1,5 @@
<configuration>
<system.web>
<pages validateRequest="true" />
</system.web>
</configuration>

0
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/Program.cs Normal file
View File