Adds CodeQL query to check for insecure RequestValidationMode in ASP.NET

[cldrn]

Report

ASP.NET applications ship with requestValidationMode enabled by default as it consists of built-in validations to protect against code injections. It is not recommended to set it to other value different than 4.5 as doing so will disable some or all protections for HTTP requests. This check belongs to the category CWE-016 which didn't exist previously in QL and corresponds to common insecure configurations.

This issue is still commonly found in ASP.NET applications and CVEs caused by this usually get labeled as code injection vulnerabilities:

• https://docs.microsoft.com/en-us/dotnet/api/system.web.configuration.httpruntimesection.requestvalidationmode?view=netframework-4.8
• https://www.secpulse.com/archives/26365.html

CodeQL query PR: https://github.com/Semmle/ql/pull/2356

[xcorail]

Overall Rating: Low Paid