False positive Java. SpringBoot CSRF

首先定位名為 "Disabled Spring CSRF protection" 的 CodeQL 查詢，並檢查它如何識別 Spring Security 設定。接著重現所提供的 stateless JWT/OIDC resource-server 範例，然後驗證對於此設定，停用 CSRF 不再觸發該查詢，同時已回報的案例仍然涵蓋在內。

Description of the false positive

Given a SpringBoot application that acts solely as an API/OIDC Resource Server and does not utilize cookies or state, where CSRF is disabled, the CodeQL / Disabled Spring CSRF protection should not be triggered.

Code samples or links to source code

  @Bean
  SecurityFilterChain securityFilterChain(
      final HttpSecurity http,
      final String privateScope,
      final AppUserPrincipalJwtAuthenticationConverter appUserPrincipalJwtAuthenticationConverter) {
    http.formLogin(AbstractHttpConfigurer::disable)
        .httpBasic(AbstractHttpConfigurer::disable)
        .csrf(AbstractHttpConfigurer::disable) // NOSONAR stateless JWT, no CSRF cookies
        .logout(AbstractHttpConfigurer::disable)
        .sessionManagement(
            session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .authorizeHttpRequests(
            authorize ->
                authorize
                    .dispatcherTypeMatchers(DispatcherType.ERROR, DispatcherType.FORWARD)
                    .permitAll()
                    .requestMatchers(RuntimeEndpointPaths.unauthenticatedPaths())
                    .permitAll()
                    .requestMatchers(
                        new RegexRequestMatcher(
                            RuntimeEndpointPaths.versionedInternalRouteRegex(), null))
                    .access(interactiveUserAuthorizationManager())
                    .requestMatchers(
                        new RegexRequestMatcher(
                            RuntimeEndpointPaths.versionedPrivateRouteRegex(), null))
                    .access(
                        callerTypeAuthorizationManager(
                            OidcCallerType.CLIENT_CREDENTIALS, privateScope))
                    .anyRequest()
                    .authenticated())
        .oauth2ResourceServer(
            oauth2 ->
                oauth2.jwt(
                    jwt ->
                        jwt.jwtAuthenticationConverter(
                            appUserPrincipalJwtAuthenticationConverter)));
    return http.build();
  }