C#: Add query for Insecure Direct Object Reference - #13882

Merged

joefarebrother merged 25 commits into

github:mainfrom

joefarebrother:csharp-insecure-direct-object-ref

Sep 25, 2023

Commits on Sep 15, 2023

Add insecure direct object reference definitions and factor out those from missing access control
joefarebrother
committed
a510a7b
Add IDOR query
joefarebrother
committed
5d12896
Fix filenme typo
joefarebrother
committed
251f875
Fix typos in filepath + metadata, add severity
joefarebrother
committed
2edd73e
Add tests for webforms case
joefarebrother
committed
20d42df
Add MVC tests
joefarebrother
committed
009a7bf
Update alert message and make user checks more precise
joefarebrother
committed
f8b1b38
Add documentation
joefarebrother
committed
3e6750b
Add change note + update query ID
joefarebrother
committed
4967fe0
Apply minor reveiw suggstions
joefarebrother
committed
9f25c71
Update test options
joefarebrother
committed
86abd33
Add additional example to qhelp + additional resource
joefarebrother
committed
a022893
Minor changes from review suggestions to shared logic between this and missing access control
joefarebrother
committed
0a27da0
Add checks for authorization attributes
joefarebrother
committed
ac45050
Add test cases for authorization from attributes
joefarebrother
committed
6a95ed6
Check for authorize attributes in more namespaces and on overridden methods
joefarebrother
committed
a2dce6b
Rewrite checks for index expressions in terms of dataflow
joefarebrother
committed
6d704be
Restrict logic for checking for id parameters on index expressions for performance
joefarebrother
committed
68ad5b7
Fix typos
joefarebrother
committed
eb2f589
Update severity
joefarebrother
committed
868836e

Commits on Sep 20, 2023

Commits on Sep 25, 2023

Apply suggestions from docs review

joefarebrother
and
sabrowning1
authored
df5fcc9
Elaborate 'guess' to 'guess or determine'
joefarebrother
committed
3efbbb3
Fix codescanning alert by tweaking imported modules
joefarebrother
committed
d7c1be4