From 3ed8a8f8a3d3174ca690f12042313e862699e981 Mon Sep 17 00:00:00 2001 From: James Tatsch Date: Fri, 11 Sep 2026 08:33:22 -0500 Subject: [PATCH] C#: Reduce false positives in cs/web/missing-x-frame-options --- .../CWE-451/MissingXFrameOptions.qhelp | 43 +++++-- .../CWE-451/MissingXFrameOptions.ql | 53 ++++---- .../CWE-451/MissingXFrameOptionsAspNetCore.cs | 8 ++ .../MissingXFrameOptionsLib.qll | 118 ++++++++++++++++++ .../2026-09-10-missing-x-frame-options.md | 6 + .../MissingXFrameOptions.qlref | 3 +- .../HeaderWrites/HeaderWrites.cs | 52 ++++++++ .../HeaderWrites/HeaderWrites.expected | 9 ++ .../HeaderWrites/HeaderWrites.ql | 12 ++ .../HeaderWrites/HeaderWrites.qlref | 2 + .../MissingXFrameOptions.expected | 0 .../HeaderWrites/MissingXFrameOptions.qlref | 1 + .../HeaderWrites/Web.config | 2 + .../MissingXFrameOptions/HeaderWrites/options | 3 + .../NoHeader/MissingXFrameOptions.expected | 2 +- .../WebConfigAddedHeader/Csp.Web.config | 10 ++ .../CspSubstring.Web.config | 10 ++ .../MissingXFrameOptions.expected | 2 + .../MissingXFrameOptions.qlref | 3 +- .../PrefixedCsp.Web.config | 10 ++ .../WebConfigAddedHeader/Web.config | 2 +- .../MissingXFrameOptions.qlref | 3 +- 22 files changed, 309 insertions(+), 45 deletions(-) create mode 100644 csharp/ql/src/Security Features/CWE-451/MissingXFrameOptionsAspNetCore.cs create mode 100644 csharp/ql/src/Security Features/MissingXFrameOptionsLib.qll create mode 100644 csharp/ql/src/change-notes/2026-09-10-missing-x-frame-options.md create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.cs create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.expected create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.ql create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.qlref create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/MissingXFrameOptions.expected create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/MissingXFrameOptions.qlref create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/Web.config create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/options create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/Csp.Web.config create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/CspSubstring.Web.config create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/PrefixedCsp.Web.config diff --git a/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.qhelp b/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.qhelp index 6d5d298c8e43..5f7dd4f3282f 100644 --- a/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.qhelp +++ b/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.qhelp @@ -5,9 +5,10 @@

-Web sites that do not specify the X-Frame-Options HTTP header may be vulnerable to UI -redress attacks ("clickjacking"). In these attacks, the vulnerable site is loaded in a frame on -an attacker-controlled site which uses opaque or transparent layers to trick the user into +Web sites that do not restrict framing using the X-Frame-Options HTTP header or the +frame-ancestors Content Security Policy directive may be vulnerable to UI redress +attacks ("clickjacking"). In these attacks, the vulnerable site is loaded in a frame on an +attacker-controlled site which uses opaque or transparent layers to trick the user into unintentionally clicking a button or link on the vulnerable site.

@@ -17,16 +18,24 @@ unintentionally clicking a button or link on the vulnerable site.

Set the X-Frame-Options HTTP header to DENY, to instruct web browsers to block attempts to load the site in a frame. Alternatively, if framing is needed in certain -circumstances, specify SAMEORIGIN or ALLOW FROM: ... to limit the ability -to frame the site to pages from the same origin, or from an allowed whitelist of trusted domains. +circumstances, specify SAMEORIGIN to permit framing by the same origin. The +frame-ancestors directive in an enforced Content-Security-Policy header +provides a more flexible alternative. For example, use frame-ancestors 'none' to +prevent all framing, or use its source list to specify which origins may embed the application.

-For ASP.NET web applications, the header may be specified either in the Web.config -file, using the <customHeaders> tag, or within the source code of the -application using the HttpResponse.AddHeader method. In general, prefer specifying the -header in the Web.config file to ensure it is added to all requests. If adding it -to the source code, ensure that it is added unconditionally to all requests. For example, add the -header in the Application_BeginRequest method in the global.asax file. +For ASP.NET Framework applications, the header may be specified either in the +Web.config file, using the <customHeaders> tag, or within the source +code of the application using the HttpResponse.AddHeader method. In general, prefer +specifying the header in the Web.config file to ensure it is added to all requests. If +adding it to the source code, ensure that it is added unconditionally to all requests. For example, +add the header in the Application_BeginRequest method in the +global.asax file. +

+

+For ASP.NET Core applications, set the header on HttpResponse.Headers. This can be +done using the header dictionary's indexer or its Append, Add, or +TryAdd methods.

@@ -41,11 +50,17 @@ The following example shows how to specify the X-Frame-Options head

This next example shows how to specify the X-Frame-Options header within the -global.asax file for ASP.NET application: +global.asax file for an ASP.NET application:

+

+The following ASP.NET Core example uses an enforced Content Security Policy to disallow framing: +

+ + + @@ -57,6 +72,10 @@ OWASP: Mozilla: X-Frame-Options +
  • +Mozilla: +Content-Security-Policy: frame-ancestors +
    •  diff --git a/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.ql b/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.ql index 1b647457e7c8..8d78587c0943 100644 --- a/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.ql +++ b/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.ql @@ -1,7 +1,8 @@ /** - * @name Missing X-Frame-Options HTTP header - * @description If the 'X-Frame-Options' setting is not provided, a malicious user may be able to - * overlay their own UI on top of the site by using an iframe. + * @name Missing clickjacking protection + * @description If neither the 'X-Frame-Options' header nor a Content Security Policy + * 'frame-ancestors' directive is provided, a malicious user may be able to overlay + * their own UI on top of the site by using an iframe. * @kind problem * @problem.severity error * @security-severity 7.5 @@ -14,7 +15,7 @@ import csharp import semmle.code.asp.WebConfig -import semmle.code.csharp.frameworks.system.Web +import Security_Features.MissingXFrameOptionsLib XmlElement getAWebConfigRoot(WebConfigXml webConfig) { result = webConfig.getARootElement() @@ -28,9 +29,10 @@ XmlElement getAWebConfigRoot(WebConfigXml webConfig) { } /** - * Holds if the `Web.config` file `webConfig` adds an `X-Frame-Options` header. + * Holds if the `Web.config` file `webConfig` adds an `X-Frame-Options` header or a + * `Content-Security-Policy` header containing a `frame-ancestors` directive. */ -predicate hasWebConfigXFrameOptions(WebConfigXml webConfig) { +predicate hasWebConfigClickjackingProtection(WebConfigXml webConfig) { // Looking for an entry in `webConfig` that looks like this: // ```xml // @@ -42,29 +44,30 @@ predicate hasWebConfigXFrameOptions(WebConfigXml webConfig) { // // ``` // This can also be in a `location` - getAWebConfigRoot(webConfig) - .getAChild("system.webServer") - .getAChild("httpProtocol") - .getAChild("customHeaders") - .getAChild("add") - .getAttributeValue("name") = "X-Frame-Options" + exists(XmlElement add, string name | + add = + getAWebConfigRoot(webConfig) + .getAChild("system.webServer") + .getAChild("httpProtocol") + .getAChild("customHeaders") + .getAChild("add") and + name = add.getAttributeValue("name") and + ( + isXFrameOptionsHeaderName(name) + or + isContentSecurityPolicyHeaderName(name) and + containsFrameAncestorsDirective(add.getAttributeValue("value")) + ) + ) } /** - * Holds if there exists a call to `AddHeader` or `AppendHeader` adding the `X-Frame-Options` - * header. + * Holds if code configures a clickjacking protection response header. */ -predicate hasCodeXFrameOptions() { - exists(MethodCall call | - call.getTarget() = any(SystemWebHttpResponseClass r).getAppendHeaderMethod() or - call.getTarget() = any(SystemWebHttpResponseClass r).getAddHeaderMethod() - | - call.getArgumentForName("name").getValue() = "X-Frame-Options" - ) -} +predicate hasCodeClickjackingProtection() { exists(getAClickjackingHeaderWrite()) } from WebConfigXml webConfig where - not hasWebConfigXFrameOptions(webConfig) and - not hasCodeXFrameOptions() -select webConfig, "Configuration file is missing the X-Frame-Options setting." + not hasWebConfigClickjackingProtection(webConfig) and + not hasCodeClickjackingProtection() +select webConfig, "Configuration file is missing clickjacking protection." diff --git a/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptionsAspNetCore.cs b/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptionsAspNetCore.cs new file mode 100644 index 000000000000..f735a8f0ae7c --- /dev/null +++ b/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptionsAspNetCore.cs @@ -0,0 +1,8 @@ +void Configure(IApplicationBuilder app) +{ + app.Use(async (context, next) => + { + context.Response.Headers["Content-Security-Policy"] = "frame-ancestors 'none'"; + await next(); + }); +} diff --git a/csharp/ql/src/Security Features/MissingXFrameOptionsLib.qll b/csharp/ql/src/Security Features/MissingXFrameOptionsLib.qll new file mode 100644 index 000000000000..afd0d7410cf7 --- /dev/null +++ b/csharp/ql/src/Security Features/MissingXFrameOptionsLib.qll @@ -0,0 +1,118 @@ +/** Provides predicates for recognizing clickjacking-related response-header configuration. */ + +import csharp +import semmle.code.csharp.dataflow.DataFlow +import semmle.code.csharp.frameworks.microsoft.AspNetCore +import semmle.code.csharp.frameworks.system.Web + +/** Holds if `name` is the `X-Frame-Options` header name, ignoring case. */ +bindingset[name] +predicate isXFrameOptionsHeaderName(string name) { name.toLowerCase() = "x-frame-options" } + +/** Holds if `name` is the enforced `Content-Security-Policy` header name, ignoring case. */ +bindingset[name] +predicate isContentSecurityPolicyHeaderName(string name) { + name.toLowerCase() = "content-security-policy" +} + +/** + * Holds if `value` contains a `frame-ancestors` directive at the start of a CSP policy or + * after a directive or policy separator. + */ +bindingset[value] +predicate containsFrameAncestorsDirective(string value) { + value.regexpMatch("(?is)(^|.*[;,])\\s*frame-ancestors(\\s|;|$).*") +} + +private predicate isHeaderNamesField(Expr name, string fieldName) { + exists(FieldAccess access | + name.stripImplicit() = access and + access.getTarget().hasFullyQualifiedName("Microsoft.Net.Http.Headers", "HeaderNames", fieldName) + ) +} + +private predicate isXFrameOptionsHeaderNameExpr(Expr name) { + isXFrameOptionsHeaderName(name.stripImplicit().getValue()) + or + isHeaderNamesField(name, "XFrameOptions") +} + +private predicate isContentSecurityPolicyHeaderNameExpr(Expr name) { + isContentSecurityPolicyHeaderName(name.stripImplicit().getValue()) + or + isHeaderNamesField(name, "ContentSecurityPolicy") +} + +private predicate containsFrameAncestorsDirectiveExpr(Expr value) { + containsFrameAncestorsDirective(value.stripImplicit().getValue()) +} + +private predicate isClickjackingHeader(Expr name, Expr value) { + isXFrameOptionsHeaderNameExpr(name) + or + isContentSecurityPolicyHeaderNameExpr(name) and containsFrameAncestorsDirectiveExpr(value) +} + +private predicate isDirectResponseHeadersAccess(Expr expr) { + exists(PropertyAccessExpr headers, MicrosoftAspNetCoreHttpHttpResponse response | + expr.stripImplicit() = headers and headers.getProperty() = response.getHeadersProperty() + ) +} + +private predicate isResponseHeadersAccess(Expr expr) { + exists(Expr directAccess | + isDirectResponseHeadersAccess(directAccess) and + DataFlow::localExprFlow(directAccess, expr.stripImplicit()) + ) +} + +private Expr getHeaderDictionaryReceiver(MethodCall call) { + result = call.getQualifier() + or + call.getTarget().isExtensionMethod() and + result = call.getArgumentForParameter(call.getTarget().getParameter(0)) +} + +private predicate isClickjackingHeaderCall(MethodCall call) { + ( + call.getTarget() = any(SystemWebHttpResponseClass r).getAppendHeaderMethod() or + call.getTarget() = any(SystemWebHttpResponseClass r).getAddHeaderMethod() + ) and + isClickjackingHeader(call.getArgumentForName("name"), call.getArgumentForName("value")) + or + call.getTarget().hasUndecoratedName(["Append", "Add", "TryAdd"]) and + isResponseHeadersAccess(getHeaderDictionaryReceiver(call)) and + isClickjackingHeader(call.getArgumentForName("key"), call.getArgumentForName("value")) +} + +private predicate isClickjackingHeaderIndexerAssignment(AssignExpr assignment) { + exists(IndexerCall indexer | + assignment.getLeftOperand() = indexer and + isResponseHeadersAccess(indexer.getQualifier()) and + isClickjackingHeader(indexer.getArgument(0), assignment.getRightOperand()) + ) +} + +private predicate isClickjackingNamedHeaderPropertyAssignment(AssignExpr assignment) { + exists(PropertyAccessExpr header | + assignment.getLeftOperand() = header and + isResponseHeadersAccess(header.(QualifiableExpr).getQualifier()) and + ( + header.getProperty().hasName("XFrameOptions") + or + header.getProperty().hasName("ContentSecurityPolicy") and + containsFrameAncestorsDirectiveExpr(assignment.getRightOperand()) + ) + ) +} + +/** Gets an expression that configures a clickjacking-related response header. */ +Expr getAClickjackingHeaderWrite() { + result = any(MethodCall call | isClickjackingHeaderCall(call)) + or + result = + any(AssignExpr assignment | + isClickjackingHeaderIndexerAssignment(assignment) or + isClickjackingNamedHeaderPropertyAssignment(assignment) + ) +} diff --git a/csharp/ql/src/change-notes/2026-09-10-missing-x-frame-options.md b/csharp/ql/src/change-notes/2026-09-10-missing-x-frame-options.md new file mode 100644 index 000000000000..fe62433ec70a --- /dev/null +++ b/csharp/ql/src/change-notes/2026-09-10-missing-x-frame-options.md @@ -0,0 +1,6 @@ +--- +category: minorAnalysis +--- +* The `cs/web/missing-x-frame-options` query now recognizes clickjacking protection configured + through ASP.NET Core response headers and enforced Content Security Policy `frame-ancestors` + directives. diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/CodeAddedHeader/MissingXFrameOptions.qlref b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/CodeAddedHeader/MissingXFrameOptions.qlref index d0d38c4b0117..b8a963200e57 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/CodeAddedHeader/MissingXFrameOptions.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/CodeAddedHeader/MissingXFrameOptions.qlref @@ -1,2 +1 @@ -query: Security Features/CWE-451/MissingXFrameOptions.ql -postprocess: utils/test/InlineExpectationsTestQuery.ql +Security Features/CWE-451/MissingXFrameOptions.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.cs b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.cs new file mode 100644 index 000000000000..0bb97e464cb0 --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.cs @@ -0,0 +1,52 @@ +using System.Collections.Generic; +using Microsoft.AspNetCore.Http; +using Microsoft.Net.Http.Headers; +using AspNetCoreHttpContext = Microsoft.AspNetCore.Http.HttpContext; + +public class HeaderWrites +{ + public void AspNetCoreResponseHeaders(AspNetCoreHttpContext context) + { + context.Response.Headers.Append(HeaderNames.XFrameOptions, "DENY"); // $ Alert + context.Response.Headers.Add("x-frame-options", "SAMEORIGIN"); // $ Alert + context.Response.Headers.TryAdd( + HeaderNames.ContentSecurityPolicy, + "default-src 'self'; FrAmE-AnCeStOrS 'none'"); // $ Alert + + context.Response.Headers["X-Frame-Options"] = "DENY"; // $ Alert + context.Response.Headers["Content-Security-Policy"] = + "default-src 'self'; frame-ancestors 'none'"; // $ Alert + + context.Response.Headers.XFrameOptions = "DENY"; // $ Alert + context.Response.Headers.ContentSecurityPolicy = + "default-src 'self'; frame-ancestors 'self'"; // $ Alert + context.Response.Headers["Content-Security-Policy"] = + "default-src 'self', frame-ancestors 'none'"; // $ Alert + + IHeaderDictionary responseHeaders = context.Response.Headers; + responseHeaders.Append("X-Frame-Options", "DENY"); // $ Alert + } + + public void IgnoredHeaderWrites(AspNetCoreHttpContext context) + { + context.Request.Headers["X-Frame-Options"] = "DENY"; + + IHeaderDictionary reassignedHeaders = context.Response.Headers; + reassignedHeaders = context.Request.Headers; + reassignedHeaders["X-Frame-Options"] = "DENY"; + + var standaloneHeaders = new HeaderDictionary(); + standaloneHeaders.Append("X-Frame-Options", "DENY"); + standaloneHeaders["Content-Security-Policy"] = "frame-ancestors 'none'"; + + context.Response.Headers["Content-Security-Policy-Report-Only"] = + "frame-ancestors 'none'"; + context.Response.Headers.ContentSecurityPolicyReportOnly = "frame-ancestors 'none'"; + context.Response.Headers["X-Content-Security-Policy"] = "frame-ancestors 'none'"; + context.Response.Headers["Content-Security-Policy"] = "default-src 'self'"; + context.Response.Headers["Content-Security-Policy"] = + "report-uri https://example.test/frame-ancestors"; + context.Response.Headers["Content-Security-Policy"] = + "default-src 'self'; not-frame-ancestors 'none'"; + } +} diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.expected b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.expected new file mode 100644 index 000000000000..908d14dfda79 --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.expected @@ -0,0 +1,9 @@ +| HeaderWrites.cs:10:9:10:74 | call to method Append | A clickjacking-related response header is configured here. | +| HeaderWrites.cs:11:9:11:69 | call to method Add | A clickjacking-related response header is configured here. | +| HeaderWrites.cs:12:9:14:57 | call to method TryAdd | A clickjacking-related response header is configured here. | +| HeaderWrites.cs:16:9:16:60 | ... = ... | A clickjacking-related response header is configured here. | +| HeaderWrites.cs:17:9:18:56 | ... = ... | A clickjacking-related response header is configured here. | +| HeaderWrites.cs:20:9:20:55 | ... = ... | A clickjacking-related response header is configured here. | +| HeaderWrites.cs:21:9:22:56 | ... = ... | A clickjacking-related response header is configured here. | +| HeaderWrites.cs:23:9:24:56 | ... = ... | A clickjacking-related response header is configured here. | +| HeaderWrites.cs:27:9:27:57 | call to method Append | A clickjacking-related response header is configured here. | diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.ql b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.ql new file mode 100644 index 000000000000..ca6a7e164962 --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.ql @@ -0,0 +1,12 @@ +/** + * @kind problem + * @id cs/test/clickjacking-header-write + * @problem.severity warning + */ + +import csharp +import Security_Features.MissingXFrameOptionsLib + +from Expr write +where write = getAClickjackingHeaderWrite() +select write, "A clickjacking-related response header is configured here." diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.qlref b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.qlref new file mode 100644 index 000000000000..a2d35d0adb5b --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/HeaderWrites.qlref @@ -0,0 +1,2 @@ +query: HeaderWrites.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/MissingXFrameOptions.expected b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/MissingXFrameOptions.expected new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/MissingXFrameOptions.qlref b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/MissingXFrameOptions.qlref new file mode 100644 index 000000000000..b8a963200e57 --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/MissingXFrameOptions.qlref @@ -0,0 +1 @@ +Security Features/CWE-451/MissingXFrameOptions.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/Web.config new file mode 100644 index 000000000000..484daccbf3a4 --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/Web.config @@ -0,0 +1,2 @@ + + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/options b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/options new file mode 100644 index 000000000000..ce3f295ed117 --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/HeaderWrites/options @@ -0,0 +1,3 @@ +semmle-extractor-options: /nostdlib /noconfig +semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj +semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/NoHeader/MissingXFrameOptions.expected b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/NoHeader/MissingXFrameOptions.expected index 74dfb6fc2f47..d1708140c9d7 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/NoHeader/MissingXFrameOptions.expected +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/NoHeader/MissingXFrameOptions.expected @@ -1 +1 @@ -| Web.config:0:0:0:0 | Web.config | Configuration file is missing the X-Frame-Options setting. | +| Web.config:0:0:0:0 | Web.config | Configuration file is missing clickjacking protection. | diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/Csp.Web.config b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/Csp.Web.config new file mode 100644 index 000000000000..733792aadd8d --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/Csp.Web.config @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/CspSubstring.Web.config b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/CspSubstring.Web.config new file mode 100644 index 000000000000..caf093f9ecbe --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/CspSubstring.Web.config @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.expected b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.expected index e69de29bb2d1..31aad4a5216f 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.expected +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.expected @@ -0,0 +1,2 @@ +| CspSubstring.Web.config:0:0:0:0 | CspSubstring.Web.config | Configuration file is missing clickjacking protection. | +| PrefixedCsp.Web.config:0:0:0:0 | PrefixedCsp.Web.config | Configuration file is missing clickjacking protection. | diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.qlref b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.qlref index d0d38c4b0117..b8a963200e57 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.qlref @@ -1,2 +1 @@ -query: Security Features/CWE-451/MissingXFrameOptions.ql -postprocess: utils/test/InlineExpectationsTestQuery.ql +Security Features/CWE-451/MissingXFrameOptions.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/PrefixedCsp.Web.config b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/PrefixedCsp.Web.config new file mode 100644 index 000000000000..334b63ce5b0e --- /dev/null +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/PrefixedCsp.Web.config @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/Web.config index 78f6c30a819f..74c0fa10fd27 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/Web.config @@ -5,7 +5,7 @@ - + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.qlref b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.qlref index d0d38c4b0117..b8a963200e57 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.qlref @@ -1,2 +1 @@ -query: Security Features/CWE-451/MissingXFrameOptions.ql -postprocess: utils/test/InlineExpectationsTestQuery.ql +Security Features/CWE-451/MissingXFrameOptions.ql