From 6aa4c5c1876c3cdcf5413affb25c1db86ad3bd7b Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Tue, 23 Apr 2024 11:47:55 +0200 Subject: [PATCH] C#: Fix a bad join --- .../CWE-352/MissingAntiForgeryTokenValidation.ql | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/csharp/ql/src/Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql b/csharp/ql/src/Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql index 3b56d3d73777..48000667b570 100644 --- a/csharp/ql/src/Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql +++ b/csharp/ql/src/Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql @@ -16,11 +16,15 @@ import semmle.code.csharp.frameworks.system.Web import semmle.code.csharp.frameworks.system.web.Helpers import semmle.code.csharp.frameworks.system.web.Mvc +private Method getAValidatingMethod() { + result = any(AntiForgeryClass a).getValidateMethod() + or + result.calls(getAValidatingMethod()) +} + /** An `AuthorizationFilter` that calls the `AntiForgery.Validate` method. */ class AntiForgeryAuthorizationFilter extends AuthorizationFilter { - AntiForgeryAuthorizationFilter() { - this.getOnAuthorizationMethod().calls*(any(AntiForgeryClass a).getValidateMethod()) - } + AntiForgeryAuthorizationFilter() { this.getOnAuthorizationMethod() = getAValidatingMethod() } } /**