search

dotnet-security-guard / roslyn-security-guard

Roslyn analyzers that aim to help security audit on .NET applications.
https://dotnet-security-guard.github.io
GNU Lesser General Public License v3.0
208 stars 38 forks source link

False Positive - CSRF vulnerability on HttpPost Controller decorated with custom security tag #83

Open VladPapacostea-SM opened 7 years ago

VladPapacostea-SM commented 7 years ago

Hi there. Currently using the Roslyn security guard extension for VS. We have a few Web Api projects, for whom, the controllers are not linked to a view, therefore the normal [ValidateAntiForgeryToken] would not have any effect. Your product correctly flags up those methods to be vulnerable when no such security tag is attached to the method.

We have created our own Anti-Forgery Token validation attribute for WebApi projects, but for obvious reasons this is not called [ValidateAntiForgeryToken] , as it would conflict with existing functionality. As Roslyn Guard checks for that exact tag, our secure methods are still flagged up as insecure ( false positives ) and makes it a bit inconvenient when reviewing a very large project, to go on check every single warning ( beats the purpose of using the product in the first place, as we could just manually visit every [HttpPost] ) .

Was wondering if anything could be done about this ? ( could check for a tag containing the string AntiForgeryToken , rather than a strict lookup )

h3xstream commented 7 years ago

What is use in WebApi to prevent CSRF? Are you using a custom DelegatingHandler for example..

If their would be any special attribute that enforce stateless token or implicit use of handler, this would be helpful.