search

alexhiggins732 / IdentityServer8

DotNet 8, Identity, OpenID Connect and OAuth 2.0 Framework for ASP.NET Core Identity Server 8
Apache License 2.0
53 stars 25 forks source link

Fix code scanning alert - User-controlled bypass of sensitive method #9

Closed alexhiggins732 closed 8 months ago

alexhiggins732 commented 8 months ago

Code QL Code scanning alert

ID cs/user-controlled-bypass Severity: High

Description:

The original IdentityServer4 source code contains controller methods that allow user to control authentication execution flow based on a user-provided value in the Account login controller.

Source:

  1. src/IdentityServer8/host/Quickstart/Account/AccountController.cs:95
  2. src/AspNetIdentity/host/Quickstart/Account/AccountController.cs:90

References:

Common Weakness Enumeration: CWE-807. Common Weakness Enumeration: CWE-247. Common Weakness Enumeration: CWE-350.

Tracking issue for:

alexhiggins732 commented 8 months ago

Addressed in https://github.com/alexhiggins732/IdentityServer8/commit/9b70f5f99d5ebc4b85b75b052fa731a9a3f7c0b9