Skip to content

Commit 73c8888

Browse files
calumgrantcalumgrant
authored
Merge pull request #2356 from cldrn/ASPNetRequestValidationMode
Adds CodeQL query to check for insecure RequestValidationMode in ASP.NET
2 parents 343385b + fcd13dc commit 73c8888

15 files changed

+104
-4
lines changed

‎change-notes/1.24/analysis-csharp.md‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,24 @@
22

33
The following changes in version 1.24 affect C# analysis in all applications.
44

5-
## General improvements
6-
75
## New queries
86

97
| **Query** | **Tags** | **Purpose** |
108
|-----------------------------|-----------|--------------------------------------------------------------------|
9+
| Insecure configuration for ASP.NET requestValidationMode (`cs/insecure-request-validation-mode`) | security, external/cwe/cwe-016 | Finds where this attribute has been set to a value less than 4.5, which turns off some validation features and makes the application less secure. |
1110

1211
## Changes to existing queries
1312

14-
| **Query** | **Expected impact** | **Change** |
15-
|----------------------------|------------------------|------------------------------------------------------------------|
13+
| **Query** | **Expected impact** | **Change** |
14+
|------------------------------|------------------------|-----------------------------------|
15+
16+
## Removal of old queries
17+
18+
## Changes to code extraction
1619

1720
## Changes to libraries
1821

1922
* The taint tracking library now tracks flow through (implicit or explicit) conversion operator calls.
23+
24+
## Changes to autobuilder
25+

‎csharp/ql/src/Security Features/CWE-016/ASPNetRequestValidationMode.qhelp‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
4+
<overview>
5+
<p>
6+
The <code>requestValidationMode</code> attribute in ASP.NET is used to configure built-in validation to
7+
protect applications against code injections. Downgrading or disabling
8+
this configuration is not recommended. The default value of 4.5
9+
is the only recommended value, as previous versions only test a subset of requests.
10+
</p>
11+
12+
</overview>
13+
<recommendation>
14+
15+
<p>
16+
Always set <code>requestValidationMode</code> to 4.5, or leave it at its default value.
17+
</p>
18+
19+
</recommendation>
20+
<example>
21+
22+
<p>
23+
The following example shows the <code>requestValidationMode</code>
24+
attribute set to a value of 4.0, which disables some protections and
25+
ignores individual <code>Page</code> directives:
26+
</p>
27+
28+
<sample src="ASPNetRequestValidationModeBad.config" />
29+
30+
<p>
31+
Setting the value to 4.5 enables request validation for all requests:
32+
</p>
33+
34+
<sample src="ASPNetRequestValidationModeGood.config" />
35+
36+
</example>
37+
<references>
38+
39+
<li>
40+
Microsoft:
41+
<a
42+
href="https://docs.microsoft.com/en-us/dotnet/api/system.web.configuration.httpruntimesection.requestvalidationmode?view=netframework-4.8">HttpRuntimeSection.RequestValidationMode Property
43+
</a>.
44+
</li>
45+
<li>
46+
OWASP:
47+
<a
48+
href="https://www.owasp.org/index.php/ASP.NET_Request_Validation">ASP.NET Request Validation</a>.
49+
</li>
50+
</references>
51+
52+
</qhelp>

‎csharp/ql/src/Security Features/CWE-016/ASPNetRequestValidationMode.ql‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* @name Insecure configuration for ASP.NET requestValidationMode
3+
* @description Setting 'requestValidationMode' to less than 4.5 disables built-in validations
4+
* included by default in ASP.NET. Disabling or downgrading this protection is not
5+
* recommended.
6+
* @kind problem
7+
* @id cs/insecure-request-validation-mode
8+
* @problem.severity warning
9+
* @tags security
10+
* external/cwe/cwe-016
11+
*/
12+
13+
import csharp
14+
15+
from XMLAttribute reqValidationMode
16+
where
17+
reqValidationMode.getName().toLowerCase() = "requestvalidationmode" and
18+
reqValidationMode.getValue().toFloat() < 4.5
19+
select reqValidationMode,
20+
"Insecure value for requestValidationMode (" + reqValidationMode.getValue() + ")."

‎csharp/ql/src/Security Features/CWE-016/ASPNetRequestValidationModeBad.config‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<configuration>
2+
<system.web>
3+
<httpRuntime requestValidationMode="4.0"/>
4+
</system.web>
5+
</configuration>

‎csharp/ql/src/Security Features/CWE-016/ASPNetRequestValidationModeGood.config‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<configuration>
2+
<system.web>
3+
<httpRuntime requestValidationMode="4.5"/>
4+
</system.web>
5+
</configuration>

csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength.cs renamed to csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/ASPNetMaxRequestLength.cs

File renamed without changes.

csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength.expected renamed to csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/ASPNetMaxRequestLength.expected

File renamed without changes.

csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength.qlref renamed to csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/ASPNetMaxRequestLength.qlref

File renamed without changes.

csharp/ql/test/query-tests/Security Features/CWE-016/Web.config renamed to csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/Web.config

File renamed without changes.

csharp/ql/test/query-tests/Security Features/CWE-016/bad/Web.config renamed to csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/bad/Web.config

File renamed without changes.

0 commit comments

Comments
 (0)