False positive: "Missing cross-site request forgery token validation" in C# API for endpoint with no cookie/session tokens
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Start by reviewing commit 5bb31afc834f53d5ea719d782744ff9c7ab70fc0 and the C# API example in this issue to understand why the finding applies. Locate the query entry point and its existing tests, then verify that API-key-only server-to-server endpoints are not flagged while endpoints using cookie or token authentication still are.
Written by the indexing model from the issue text.
Description
Description of the false positive
We are using a .NET 10 Api and since commit https://github.com/github/codeql/commit/5bb31afc834f53d5ea719d782744ff9c7ab70fc2 we get a false positive on a server -> server endpoint where we have a ApiKey in the header with no tokens or cookies.
Is it possible to extend the check to look if cookie/token authentication is used instead of a ApiKey?
Code samples or links to source code
public class Controller()
{
[HttpPost()]
public string Execute()
{
return "test";
}
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 143
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/codeql
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
false-positive javascript
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
C#: cs/simplifiable-boolean-expression false positive on Nullable<bool> compared with a literal Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
false-positive
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Similar issues
-
clawsweeper:linked-pr-open clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:message-loss issue-rating: 🦞 diamond lobster maturity:stable P2
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
growthbook/growthbook#7100 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
punkpeye/mcp-remote#369 ·
-
Client customer-reported needs-team-attention question Service Attention WebPubSub
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Azure/azure-sdk-for-net#63292 · 3 comments · 1 reaction ·
-
bug p:3-mid pydanty:bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
pydantic/pydantic-ai#8643 · 1 comment ·