Added CSRF token checks to address CodeQL bugs #9278
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lyndaidaii
previously approved these changes
Oct 12, 2022
joelverhagen
approved these changes
Oct 14, 2022
zhhyu
approved these changes
Oct 14, 2022
RiadGahlouz
added a commit
that referenced
this pull request
Oct 19, 2022
* Update NuGetGallery.Services to address CG alerts (#9274) * Address accessibility for syntax highlighting (#9273) * address accessbility for syntax highlighting * Fix Support link (#9276) * fix broken support link * Update Download table heading (#9267) * update correct place * update table header placement * Add instructions to install MSBuildSdk packages (#9268) * Added "IsMSBuildSdkPackageType" to determine whether a package is of type MSBuildSdk. DisplayPackage view modified to show specific instructions for SDK types in project files as per #8800 * Changed "Include" to correct attribute "Name" for SDK package type Co-authored-by: Advay Tandon <82980589+advay26@users.noreply.github.com> Co-authored-by: lyndaidaii <64443925+lyndaidaii@users.noreply.github.com> * [CodeQL] Suppress CSRF token validation warnings (#9278) * Added CSRF token checks to address CodeQL bugs * Added CodeQL suppressions * Make thinner border for focused links (#9277) * Make thiner border for focused links * Change border size of package manager tabs * Delete comment line from base.less * Change nav-tabs color and make overflow-y visible for package-tags Co-authored-by: Joel Verhagen <jver@microsoft.com> Co-authored-by: lyndaidaii <64443925+lyndaidaii@users.noreply.github.com> Co-authored-by: toseni <seniut.tomas@gmail.com> Co-authored-by: Ian Rathbone <ian@rathbone.dev> Co-authored-by: Advay Tandon <82980589+advay26@users.noreply.github.com> Co-authored-by: Daniel Olczyk <44818681+MRmlik12@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixed 3 CodeQL bugs that required us to add checks to validate anti-forgery tokens on HttpPost requests.
Part of https://github.com/NuGet/Engineering/issues/4593
Addresses https://github.com/NuGet/Engineering/issues/4608
(https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1632798, https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1632799, https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1632803)