C#: Add global ASP.NET Core - enable validation for all action methods.

Author: michaelnebel

csharp/ql/test/query-tests/Security Features/CWE-352/global-aspnetcore/MissingAntiForgeryTokenValidation.cs

@@ -0,0 +1,39 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+
+public class HomeController : Controller
+{
+    // GOOD: This is validated by the global filter.
+    [HttpPost]
+    public ActionResult Login()
+    {
+        return View();
+    }
+
+    // GOOD: Antiforgery token is validated explicitly.
+    [HttpPost]
+    [ValidateAntiForgeryToken]
+    public ActionResult UpdateDetails()
+    {
+        return View();
+    }
+}
+
+public class Program
+{
+    public static void Main(string[] args)
+    {
+        var builder = WebApplication.CreateBuilder(args);
+
+        // Register MVC controllers and Razor views.
+        // The global filter automatically validates antiforgery tokens
+        // for unsafe HTTP methods such as POST, PUT, PATCH, and DELETE.
+        builder.Services.AddControllersWithViews(options =>
+        {
+            options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
+        });
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-352/global-aspnetcore/MissingAntiForgeryTokenValidation.expected

@@ -0,0 +1 @@
+| MissingAntiForgeryTokenValidation.cs:11:25:11:29 | Login | Method 'Login' handles a POST request without performing CSRF token validation. |

csharp/ql/test/query-tests/Security Features/CWE-352/global-aspnetcore/MissingAntiForgeryTokenValidation.qlref

@@ -0,0 +1 @@
+query: Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql

csharp/ql/test/query-tests/Security Features/CWE-352/global-aspnetcore/options

@@ -0,0 +1,2 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj