Tamas Vajk 7a406d8e41 C#: Fix unsafe deserialization with JsonConvert.DeserializeObject ...

Remove false positives when `JsonConvert.DeserializeObject` is called with not necessarily unsafe settings.

2022-08-11 11:00:46 +02:00

..

CWE-011

C#: Fix whitespaces

2018-11-07 08:52:38 +01:00

CWE-016

Merge branch 'master' of git.semmle.com:Semmle/ql into ASPNetPagesValidateRequest

2019-12-05 15:58:47 +00:00

CWE-020

C#: Since NameValueCollection now has a flow summary for the string indexer it is no longer consider an unsafe external api, which is why it has disappared from the result.

2022-05-25 08:28:14 +02:00

CWE-022

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-078

C#: Update tests due to new summaries for ProcessStartInfo.

2022-05-25 08:28:14 +02:00

CWE-079

C#: Use ASP.NET Core stub instead of Microsoft.Extensions.Primitives and manual written ASP.NET Core stubs.

2022-08-09 13:08:34 +02:00

CWE-089

C#: Remove System.Data.SqlClient 4.8.2 stub.

2022-08-09 13:15:44 +02:00

CWE-090

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-091/XMLInjection

C#: Update XML Injectiont test output after rebase (query has been turned into a path-problem and the output is now affected by the added summaries for NameValueCollection).

2022-05-25 08:28:15 +02:00

CWE-094

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-099

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-112

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-114/AssemblyPathInjection

Add adjusted expected files

2021-07-01 16:09:11 +02:00

CWE-117

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-119

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

CWE-134

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-201/ExposureInTransmittedData

Dataflow: Update test expected outputs.

2021-09-07 13:02:20 +02:00

CWE-209

C#: Flow summaries has now been added for Exception stack trace, but not for ToString. The latter will be encoded as an extra taintstep in the analysis. To reduce noise for all uses of an exception itself an isSanitizerIn is introduced.

2022-05-25 08:28:15 +02:00

CWE-248/MissingASPNETGlobalErrorHandler

Trim test files + remove duplicate newlines

2021-07-01 16:09:11 +02:00

CWE-312

Dataflow: Update test expected outputs.

2021-09-07 13:02:20 +02:00

CWE-321/HardcodedSymmetricEncryptionKey

C#: Fix typo.

2022-07-18 14:28:49 +02:00

CWE-327

Dataflow: Update test expected outputs.

2021-09-07 13:02:20 +02:00

CWE-338

Dataflow: Update test expected outputs.

2021-09-07 13:02:20 +02:00

CWE-352

Add adjusted expected files

2021-07-01 16:09:11 +02:00

CWE-359

Dataflow: Update test expected outputs.

2021-09-07 13:02:20 +02:00

CWE-384

Add adjusted expected files

2021-07-01 16:09:11 +02:00

CWE-451/MissingXFrameOptions

Trim test files + remove duplicate newlines

2021-07-01 16:09:11 +02:00

CWE-502

C#: Fix unsafe deserialization with JsonConvert.DeserializeObject

2022-08-11 11:00:46 +02:00

CWE-539/PersistentCookie

Add adjusted expected files

2021-07-01 16:09:11 +02:00

CWE-548

C#: Fix whitespaces

2018-11-07 08:52:38 +01:00

CWE-601/UrlRedirect

C#: Use ASP.NET Core stub instead of Microsoft.Extensions.Primitives and manual written ASP.NET Core stubs.

2022-08-09 13:08:34 +02:00

CWE-611

Dataflow: Update test expected outputs.

2021-09-07 13:02:20 +02:00

CWE-614/RequireSSL

Trim test files + remove duplicate newlines

2021-07-01 16:09:11 +02:00

CWE-643

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-730

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-798

Dataflow: Update test expected outputs.

2021-09-07 13:02:20 +02:00

CWE-807

C#: Update test because we now have a flow summary the string indexer for NameValueCollection.

2022-05-25 08:28:14 +02:00

CWE-838

C#: Use stubs for the CWE-838 testcase

2021-11-30 15:32:19 +01:00