-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
C#: Add query for insecure certificate validation #16824
base: main
Are you sure you want to change the base?
C#: Add query for insecure certificate validation #16824
Conversation
Hello intrigus-lgtm 👋 In the meantime, feel free to make changes to the pull request. If you'd like to maximize payout for your this and future submissions, here are a few general guidelines, that we might take into consideration when reviewing a submission.
Please note that these are guidelines, not rules. Since we have a lot of different types of submissions, the guidelines might vary for each submission. Happy hacking! |
I would like to reduce FPs by doing something similar to Java: codeql/java/ql/lib/semmle/code/java/security/UnsafeHostnameVerificationQuery.qll Lines 80 to 104 in f9ae44c
But as far as I know, there is no equivalent library for C#. |
@intrigus-lgtm Greetings, it seems that this query has many FPs due to two reasons.
if (!settings.ConnectivitySettings.TlsVerifyCert)
handler.ServerCertificateCustomValidationCallback = delegate { return true; }; I will ping the codeql C# team and hopefully they can point you in the right direction. |
@github/codeql-csharp Hi team, this query is ready for review. If you could help intrigus in removing some FPs that would be great. |
No description provided.