hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Convert cs/missing-access-control to inline expectations test.

Browse Source
This commit is contained in:
Michael Nebel
2025-04-14 13:54:43 +02:00
parent 53c4b29b50
commit 8d571672e9
3 changed files with 28 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/MissingAccessControl.expected
View File

@@ -1 +1 @@
| ProfileController.cs:9:25:9:31 | Delete1 | This action is missing an authorization check. |
| ProfileController.cs:10:25:10:31 | Delete1 | This action is missing an authorization check. |

5
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/MissingAccessControl.qlref
View File

@@ -1 +1,4 @@
Security Features/CWE-285/MissingAccessControl.ql
query: Security Features/CWE-285/MissingAccessControl.ql
postprocess:
- utils/test/PrettyPrintModels.ql
- utils/test/InlineExpectationsTestQuery.ql

35
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/ProfileController.cs
View File

@@ -1,19 +1,23 @@
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authorization;
public class ProfileController : Controller {
public class ProfileController : Controller
{
private void doThings() { }
private bool isAuthorized() { return false; }
// BAD: This is a Delete method, but no auth is specified.
public ActionResult Delete1(int id) {
public ActionResult Delete1(int id) // $ Alert
{
doThings();
return View();
}
// GOOD: isAuthorized is checked.
public ActionResult Delete2(int id) {
if (!isAuthorized()) {
public ActionResult Delete2(int id)
{
if (!isAuthorized())
{
return null;
}
doThings();
@@ -22,7 +26,8 @@ public class ProfileController : Controller {
// GOOD: The Authorize attribute is used.
[Authorize]
public ActionResult Delete3(int id) {
public ActionResult Delete3(int id)
{
doThings();
return View();
}
@@ -30,27 +35,33 @@ public class ProfileController : Controller {
}
[Authorize]
public class AuthBaseController : Controller {
public class AuthBaseController : Controller
{
protected void doThings() { }
}
public class SubController : AuthBaseController {
public class SubController : AuthBaseController
{
// GOOD: The Authorize attribute is used on the base class.
public ActionResult Delete4(int id) {
public ActionResult Delete4(int id)
{
doThings();
return View();
}
}
[Authorize]
public class AuthBaseGenericController<T> : Controller {
public class AuthBaseGenericController<T> : Controller
{
protected void doThings() { }
}
public class SubGenericController : AuthBaseGenericController<string> {
public class SubGenericController : AuthBaseGenericController<string>
{
// GOOD: The Authorize attribute is used on the base class.
public ActionResult Delete5(int id) {
public ActionResult Delete5(int id)
{
doThings();
return View();
}
}
}