File tree Expand file tree Collapse file tree 2 files changed +4
-4
lines changed
Security Features/CWE-451 Expand file tree Collapse file tree 2 files changed +4
-4
lines changed Original file line number Diff line number Diff line change @@ -16,12 +16,12 @@ import csharp
1616import semmle.code.asp.WebConfig
1717import semmle.code.csharp.frameworks.system.Web
1818
19- XmlElement getAWebServerConfig ( WebConfigXml webConfig ) {
19+ XmlElement getAWebConfigRoot ( WebConfigXml webConfig ) {
2020 result = webConfig .getARootElement ( )
2121 or
2222 result = webConfig .getARootElement ( ) .getAChild ( "location" ) and
2323 (
24- not exists ( result .getAttributeValue ( "path" ) ) // equivalent to path="."
24+ not result .hasAttribute ( "path" ) // equivalent to path="."
2525 or
2626 result .getAttributeValue ( "path" ) = [ "" , "." ]
2727 )
@@ -42,7 +42,7 @@ predicate hasWebConfigXFrameOptions(WebConfigXml webConfig) {
4242 // </system.webServer>
4343 // ```
4444 // This can also be in a `location`
45- getAWebServerConfig ( webConfig )
45+ getAWebConfigRoot ( webConfig )
4646 .getAChild ( "system.webServer" )
4747 .getAChild ( "httpProtocol" )
4848 .getAChild ( "customHeaders" )
Original file line number Diff line number Diff line change 11---
22category : minorAnalysis
33---
4- * the ` cs/web/missing-x-frame-options ` query now correctly handles configuration nested in ` <location> ` elements.
4+ * the ` cs/web/missing-x-frame-options ` query now correctly handles configuration nested in a ` <location > ` elements.
You can’t perform that action at this time.
0 commit comments