hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Csharp: address review

Browse Source
This commit is contained in:
Paolo Tranquilli
2025-10-21 11:43:58 +02:00
parent c728503517
commit 6f8b1f6f4c
1 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.ql
View File

@@ -16,6 +16,17 @@ import csharp
import semmle.code.asp.WebConfig
import semmle.code.csharp.frameworks.system.Web
XmlElement getAWebServerConfig(WebConfigXml webConfig) {
result = webConfig.getARootElement()
or
result = webConfig.getARootElement().getAChild("location") and
(
not exists(result.getAttributeValue("path")) // equivalent to path="."
or
result.getAttributeValue("path") = ["", "."]
)
}
/**
* Holds if the `Web.config` file `webConfig` adds an `X-Frame-Options` header.
*/
@@ -31,15 +42,12 @@ predicate hasWebConfigXFrameOptions(WebConfigXml webConfig) {
// </system.webServer>
// ```
// This can also be in a `location`
exists(XmlElement root |
root = webConfig.getARootElement() and
[root, root.getAChild("location")]
.getAChild("system.webServer")
.getAChild("httpProtocol")
.getAChild("customHeaders")
.getAChild("add")
.getAttributeValue("name") = "X-Frame-Options"
)
getAWebServerConfig(webConfig)
.getAChild("system.webServer")
.getAChild("httpProtocol")
.getAChild("customHeaders")
.getAChild("add")
.getAttributeValue("name") = "X-Frame-Options"
}
/**