C#: Insecure Certificate Validation.

[michaelnebel]

No description provided.

[github-actions]

QHelp previews:

csharp/ql/src/experimental/CWE-295/InsecureCertificateValidation.qhelp

Unsafe CertificateValidationCallback use.

Using a RemoteCertificateValidationCallback that always returns true is insecure because it allows any certificate to be accepted as valid. This can lead to a variety of security issues, including man-in-the-middle attacks.

Recommendation

Ensure that RemoteCertificateValidationCallback implementations properly verify the certificate before returning true. Avoid implementing callbacks that unconditionally accept all certificates.

Example

The following example demonstrates an insecure use of RemoteCertificateValidationCallback that always returns true:

ServicePointManager.ServerCertificateValidationCallback = 
    (sender, cert, chain, sslPolicyErrors) => true;

A secure approach would involve proper verification of the certificate before returning true:

ServicePointManager.ServerCertificateValidationCallback += 
        (sender, cert, chain, sslPolicyErrors) => {
            if (cert.Issuer == "TrustedIssuer" /* && other conditions */)
                return true;
            return false;
        };

References

• CA5359: Do not disable certificate validation CA5359
• Common Weakness Enumeration: CWE-295.
• Common Weakness Enumeration: CWE-297.

[michaelnebel]

@intrigus-lgtm : Here you can insert a "filter" that excludes sinks located in files matching specific names.

[michaelnebel]

@intrigus-lgtm : This is somewhat similar to the Java implementation of flags that you mentioned. There doesn't exist similar library functionality for C# and thus we need to implement it here.
This is hardcoded specifically to the test flag Settings.IngoreCertificateValidation just to illustrate, how this can be achieved. This code needs to be modified to the flags/conditions that fits the purposes of certificate validation.

[michaelnebel]

@intrigus-lgtm : Maybe consider to improve this: Inspiration can be found in isExpressionAlwaysTrue in JsonWebTokenHandlerLib.qll