Skip to content

Updated C# CSRF rule: exception for class level CSRF Attribute Scenario

Dinura Seneviratne requested to merge dseneviratne-ext/sast-rules:main into main

csharp/csrf/rule-Csrf.yml - Updated Rule to take into account the application possibly using https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.mvc.autovalidateantiforgerytokenattribute?view=aspnetcore-7.0

  • Modified the existing rule to scan at a class level if [AutoValidateAntiforgeryToken] is applied and prevent the triggering of the false positive.

Relates to Draft: Enhance C# semgrep rules (gitlab-org/gitlab#408758 - closed)

Edited by Wayne Haber

Merge request reports