[英]Getting warning in Security Hotspot in SonarQube make sure that controlled safely here
ClaimsPrincipal principal = new ClaimsPrincipal(identity);
控制權限是安全敏感的。 它在過去導致了以下漏洞:
CVE-2018-12999
CVE-2018-10285
CVE-2017-7455
建議是這樣的。 class SecurityPrincipalDemo { class MyIdentity: IIdentity // 應審查敏感的自定義 IIdentity 實現 { //... }
class MyPrincipal : IPrincipal // Sensitive, custom IPrincipal implementations should be reviewed
{
// ...
}
[System.Security.Permissions.PrincipalPermission(SecurityAction.Demand, Role = "Administrators")] // Sensitive. The access restrictions enforced by this attribute should be reviewed.
static void CheckAdministrator()
{
WindowsIdentity MyIdentity = WindowsIdentity.GetCurrent(); // Sensitive
HttpContext.User = ...; // Sensitive: review all reference (set and get) to System.Web HttpContext.User
AppDomain domain = AppDomain.CurrentDomain;
domain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal); // Sensitive
MyIdentity identity = new MyIdentity(); // Sensitive
MyPrincipal MyPrincipal = new MyPrincipal(MyIdentity); // Sensitive
Thread.CurrentPrincipal = MyPrincipal; // Sensitive
domain.SetThreadPrincipal(MyPrincipal); // Sensitive
// All instantiation of PrincipalPermission should be reviewed.
PrincipalPermission principalPerm = new PrincipalPermission(null, "Administrators"); // Sensitive
principalPerm.Demand();
SecurityTokenHandler handler = ...;
// Sensitive: this creates an identity.
ReadOnlyCollection<ClaimsIdentity> identities = handler.ValidateToken(…);
}
// Sensitive: review how this function uses the identity and principal.
void modifyPrincipal(MyIdentity identity, MyPrincipal principal)
{
// ...
}
}
沒關系。 我通過聲明私有只讀來解決這個問題
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.