Promote OAuth2 constant-state query to mainline

2026-01-29 14:23:03 +01:00 · 2020-08-18 15:30:22 +01:00
parent 0ee7bbbaa7
commit faf43efb60
13 changed files with 3 additions and 1 deletions
--- a/change-notes/2020-08-18-oauth2.md
+++ b/change-notes/2020-08-18-oauth2.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The query "Use of constant `state` value in OAuth 2.0 URL" (`go/constant-oauth2-state`) has been promoted from experimental status. This checks for use of a constant state value in generating an OAuth2 redirect URL, which may open the way for a CSRF attack.
--- a/ql/src/experimental/CWE-352/ConstantOauth2State.qhelp
+++ b/ql/src/experimental/CWE-352/ConstantOauth2State.qhelp
--- a/ql/src/experimental/CWE-352/ConstantOauth2State.ql
+++ b/ql/src/experimental/CWE-352/ConstantOauth2State.ql
--- a/ql/src/experimental/CWE-352/ConstantOauth2StateBad.go
+++ b/ql/src/experimental/CWE-352/ConstantOauth2StateBad.go
--- a/ql/src/experimental/CWE-352/ConstantOauth2StateBetter.go
+++ b/ql/src/experimental/CWE-352/ConstantOauth2StateBetter.go
--- a/ql/test/experimental/CWE-352/ConstantOauth2State.qlref
+++ b/ql/test/experimental/CWE-352/ConstantOauth2State.qlref
@@ -1 +0,0 @@
-experimental/CWE-352/ConstantOauth2State.ql
--- a/ql/test/query-tests/Security/CWE-352/ConstantOauth2State.expected
+++ b/ql/test/query-tests/Security/CWE-352/ConstantOauth2State.expected
--- a/ql/test/query-tests/Security/CWE-352/ConstantOauth2State.go
+++ b/ql/test/query-tests/Security/CWE-352/ConstantOauth2State.go
--- a/ql/test/query-tests/Security/CWE-352/ConstantOauth2State.qlref
+++ b/ql/test/query-tests/Security/CWE-352/ConstantOauth2State.qlref
@@ -0,0 +1 @@
+Security/CWE-352/ConstantOauth2State.ql
--- a/ql/test/query-tests/Security/CWE-352/go.mod
+++ b/ql/test/query-tests/Security/CWE-352/go.mod
--- a/ql/test/query-tests/Security/CWE-352/vendor/golang.org/x/oauth2/LICENSE
+++ b/ql/test/query-tests/Security/CWE-352/vendor/golang.org/x/oauth2/LICENSE
--- a/ql/test/query-tests/Security/CWE-352/vendor/golang.org/x/oauth2/stub.go
+++ b/ql/test/query-tests/Security/CWE-352/vendor/golang.org/x/oauth2/stub.go
--- a/ql/test/query-tests/Security/CWE-352/vendor/modules.txt
+++ b/ql/test/query-tests/Security/CWE-352/vendor/modules.txt
				`@@ -1 +0,0 @@`
				`experimental/CWE-352/ConstantOauth2State.ql`