search

pumasecurity / puma-scan

Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.
https://www.pumascan.com
Mozilla Public License 2.0
446 stars 80 forks source link

Session State Element #16

Open curea opened 7 years ago

curea commented 7 years ago

Flag the following issues in the session state element:

1) mode="StateServer" - Missing auth for session data on remote server and and insecure transmission of session data.

2) timeout < RuleOptions.SessionExpirationMax

3) mode="SQLServer" and sqlConnectionString contains a connection string password

https://msdn.microsoft.com/en-us/library/h6bb9cz9(v=vs.71).aspx

ejohn20 commented 7 years ago

1 and 2 were added released in v1.0.2. Still need to add item 3.