C#: Fix a URL redirection from remote source false positive #14953

rpmrmartin · 2023-11-29T21:04:53Z

When guarding the redirect with `HttpRequestBase.IsUrlLocalToHost()`

… based on main.

michaelnebel

Thank you for the contribution!
I will run DCA to check (after CI), if our testsuite detects an impact on performance or alerts.

…e test.

michaelnebel · 2023-12-04T15:32:14Z

DCA Looks good.
We probably need a second review.

hvitved

Thanks for the fix; one minor comment.

csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.cs

C#: Fix a URL redirection from remote source false positive

66b456d

When guarding the redirect with `HttpRequestBase.IsUrlLocalToHost()`

rpmrmartin requested a review from a team as a code owner November 29, 2023 21:04

github-actions bot added C# documentation labels Nov 29, 2023

michaelnebel self-requested a review December 4, 2023 08:55

michaelnebel added 3 commits December 4, 2023 11:53

C#: Add some stubs, a testcase and update the expected output without…

6807fd1

… based on main.

C#: Re-factor to avoid multiple explicit casts.

d160890

C#: Updated expected test output.

b9833fc

michaelnebel reviewed Dec 4, 2023

View reviewed changes

C#: Only include source code (and not stubs) in the remote flow sourc…

2fc7e51

…e test.

michaelnebel requested a review from a team December 4, 2023 15:32

hvitved requested changes Dec 5, 2023

View reviewed changes

csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.cs Outdated Show resolved Hide resolved

C#: Address review comments.

8dcdda6

michaelnebel requested a review from hvitved December 5, 2023 09:11

hvitved approved these changes Dec 5, 2023

View reviewed changes

michaelnebel merged commit e6a5c50 into github:main Dec 5, 2023
16 checks passed

Provide feedback