Paolo Tranquilli c3fd06c8a4 Csharp: fix cs/web/missing-x-frame-options to also consider location elements ...

As explained in

https://learn.microsoft.com/en-us/previous-versions/aspnet/ms178692(v=vs.100),

it is possible to add `system.webServer` elements nested inside
`location` elements in `Web.config`.

2025-10-17 11:27:31 +02:00

..

CWE-011

Fix cwe tags to include leading zero

2025-04-30 16:43:03 +01:00

CWE-016

Fix cwe tags to include leading zero

2025-04-30 16:43:03 +01:00

CWE-020

Fix cwe tags to include leading zero

2025-04-30 16:43:03 +01:00

CWE-022

add a definition of user

2024-02-06 09:21:35 +01:00

CWE-078

Remove stored variants of queries

2024-03-01 12:51:51 -05:00

CWE-079

Remove stored variants of queries

2024-03-01 12:51:51 -05:00

CWE-089

Second-order SQL injection

2024-03-01 12:51:59 -05:00

CWE-090

CS: added extra guidance in recommendation section for LDAPInjection

2025-08-20 13:37:02 +02:00

CWE-091

C#: mass enable diff-informed data flow

2025-06-11 18:56:25 +02:00

CWE-094

C#: Re-factor CodeInjection to use the new API.

2023-03-29 13:19:56 +02:00

CWE-099

C#: Re-factor ResourceInjection to use the new API.

2023-04-13 10:08:40 +02:00

CWE-112

C#: Re-factor MissingXmlValidation to use the new API.

2023-04-13 10:08:40 +02:00

CWE-114

C#: mass enable diff-informed data flow

2025-06-11 18:56:25 +02:00

CWE-117

C#: Re-factor LogForging to use the new API.

2023-04-13 10:08:40 +02:00

CWE-119

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-134

Merge pull request #19661 from d10c/d10c/csharp/diff-informed

2025-06-17 14:52:24 +02:00

CWE-201

C#: mass enable diff-informed data flow

2025-06-11 18:56:25 +02:00

CWE-209

C#: mass enable diff-informed data flow

2025-06-11 18:56:25 +02:00

CWE-248

Fix cwe tags to include leading zero

2025-04-30 16:43:03 +01:00

CWE-285

Apply doc review suggestions

2023-07-05 15:37:48 +01:00

CWE-312

C#: Re-factor CleartextStorage to use the new API.

2023-03-31 13:10:42 +02:00

CWE-321

C#: Re-factor HardCodedSymmetricEncryptionKey to use the new API.

2023-03-29 13:19:56 +02:00

CWE-327

C#: mass-add none() location overrides

2025-06-17 17:00:48 +02:00

CWE-352

C#: Fix another bad join

2024-04-23 15:39:59 +02:00

CWE-359

C#: Re-factor ExposureOfPrivateInformation to use the new API.

2023-03-29 13:19:56 +02:00

CWE-384

C#: Use shared SuccessorType.

2025-09-01 12:53:24 +02:00

CWE-451

Csharp: fix cs/web/missing-x-frame-options to also consider location elements

2025-10-17 11:27:31 +02:00

CWE-502

C#: Fix various bad joins

2024-02-12 19:49:53 +01:00

CWE-548

rename all occurrences of XML to Xml

2022-08-22 14:08:31 +02:00

CWE-601

fix typo

2024-03-13 22:37:13 +01:00

CWE-611

C#: Re-factor XmlEntityInjection to use the new API.

2023-04-13 14:28:27 +02:00

CWE-614

make some acronyms camelCase

2022-08-22 21:22:35 +02:00

CWE-639

Update inconsistent CWE tags

2023-12-04 11:52:31 +00:00

CWE-643

Remove stored variants of queries

2024-03-01 12:51:51 -05:00

CWE-730

C#: Re-factor RegexInjection to use the new API.

2023-04-13 10:08:40 +02:00

CWE-798

[DIFF-INFORMED] C#: HardcodedConnectionString

2025-07-21 11:28:55 +02:00

CWE-807

C#: Re-factor ConditionalBypass to use the new API.

2023-03-29 13:19:56 +02:00

CWE-838

C#: Update comment for the RequiresEncodingConfig param module.

2023-04-26 10:32:23 +02:00

CookieWithOverlyBroadDomain.cs

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

CookieWithOverlyBroadDomain.qhelp

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

CookieWithOverlyBroadDomain.ql

C#: Use {get,has}FullyQualifiedName throughout

2023-11-10 08:46:15 +01:00

CookieWithOverlyBroadDomainFix.cs

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

CookieWithOverlyBroadPath.cs

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

CookieWithOverlyBroadPath.qhelp

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

CookieWithOverlyBroadPath.ql

C#: Use {get,has}FullyQualifiedName throughout

2023-11-10 08:46:15 +01:00

CookieWithOverlyBroadPathFix.cs

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

Encryption using ECB.qhelp

spelling: ciphertext

2022-10-11 00:23:36 -04:00

Encryption using ECB.ql

C#: Use {get,has}FullyQualifiedName throughout

2023-11-10 08:46:15 +01:00

HeaderCheckingDisabled.qhelp

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

HeaderCheckingDisabled.ql

C#: Use {get,has}FullyQualifiedName throughout

2023-11-10 08:46:15 +01:00

InadequateRSAPadding.cs

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

InadequateRSAPadding.qhelp

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

InadequateRSAPadding.ql

C#: Use {get,has}FullyQualifiedName throughout

2023-11-10 08:46:15 +01:00

InsecureRandomness.cs

Fix minor quality issues in comment and change note

2021-08-19 09:30:23 +02:00

InsecureRandomness.qhelp

C#: Update insecure randomness query description to match implementation

2023-11-17 08:48:38 +01:00

InsecureRandomness.ql

C#: mass enable diff-informed data flow

2025-06-11 18:56:25 +02:00

InsufficientKeySize.cs

C#: Increasing required size of RSA key to 2048

2020-09-22 11:09:49 +02:00

InsufficientKeySize.qhelp

C#: Increasing required size of RSA key to 2048

2020-09-22 11:09:49 +02:00

InsufficientKeySize.ql

C#: Use {get,has}FullyQualifiedName throughout

2023-11-10 08:46:15 +01:00

PersistentCookie.cs

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

PersistentCookie.qhelp

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

PersistentCookie.ql

C#: Use {get,has}FullyQualifiedName throughout

2023-11-10 08:46:15 +01:00

WeakEncryption.cs

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

WeakEncryption.qhelp

C#: add hint regarding ECB to weak encryption QHelp

2024-03-22 12:08:30 +01:00

WeakEncryption.ql

C#: Use {get,has}FullyQualifiedName throughout

2023-11-10 08:46:15 +01:00