False positive: Creating an ASP.NET debug binary may reveal sensitive information

[a-joya]

Description of the false positive

CodeQL is firing "Creating an ASP.NET debug binary may reveal sensitive information" alert for the Web.config, where it has been already fixed in accordance with https://codeql.github.com/codeql-query-help/csharp/cs-web-debug-binary/ recommendations (debug’ flag should be set to false, or removed completely).

Code samples or links to source code

<compilation targetFramework="4.7.2">

or

<compilation debug="false" targetFramework="4.7.2">

[michaelnebel]

@a-joya : I am not able to re-produce the query result. Could you provide the full Web.config files?

[a-joya]

@michaelnebel: I had to remove all sensitive information due to the policies. But generally speaking if I add <compilation targetFramework="4.7.2"> line, then it's showing 2 alerts: one as closed and second as opened pointing to the same exact place. When adding this line <compilation debug="false" targetFramework="4.7.2"> and explicitly setting debug flag to false, then it's showing just 1 alert as opened.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <configSections>
    <!-- ... -->
  </configSections>

  <configBuilders>
    <!-- ... -->
  </configBuilders>

  <!-- ... -->

  <appSettings>
    <!-- ... -->
  </appSettings>

  <system.web>
    <globalization uiCulture="en-GB" culture="en-GB" />
    <httpRuntime maxRequestLength="1572864" maxQueryStringLength="8192" requestValidationMode="2.0"
      enableVersionHeader="false" />
    <!-- ... -->
    <customErrors mode="Off" />
    <trace enabled="false" localOnly="true" requestLimit="40" pageOutput="false" />
    <compilation targetFramework="4.7.2">
      <assemblies>
        <!-- ... -->
      </assemblies>
      <buildProviders>
        <add extension=".cshtml"
          type="System.Web.WebPages.Razor.RazorBuildProvider, System.Web.WebPages.Razor" />
      </buildProviders>
    </compilation>
    <pages validateRequest="false" controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID">
      <controls>
        <!-- ... -->
      </controls>
      <namespaces>
        <!-- ... -->
      </namespaces>
    </pages>
    <httpHandlers>
      <!-- ... -->
    </httpHandlers>
    <httpModules>
      <!-- ... -->
    </httpModules>
    <identity impersonate="false" />
    <httpCookies httpOnlyCookies="false" requireSSL="false" />
  </system.web>
  <system.webServer>
    <httpErrors errorMode="Detailed" />
    <validation validateIntegratedModeConfiguration="false" />
    <modules runAllManagedModulesForAllRequests="false">
      <!-- ... -->
    </modules>
    <handlers>
      <!-- ... -->
    </handlers>
    <urlCompression doDynamicCompression="true" doStaticCompression="true" />
    <httpCompression>
      <!-- ... -->
    </httpCompression>
    <staticContent>
      <!-- ... -->
    </staticContent>
    <security>
      <requestFiltering>
        <requestLimits maxQueryString="8192" maxAllowedContentLength="157286400" />
      </requestFiltering>
    </security>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
        <add name="X-Frame-Options" value="SAMEORIGIN" />
        <add name="X-UA-Compatible" value="IE=edge" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
  <system.serviceModel>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" aspNetCompatibilityEnabled="true" />
    <standardEndpoints>
      <!-- ... -->
    </standardEndpoints>
    <behaviors>
      <!-- ... -->
    </behaviors>
    <services>
      <!-- ... -->
    </services>
    <bindings>
      <!-- ... -->
    </bindings>
    <client>
      <!-- ... -->
    </client>

  </system.serviceModel>
  <PlatformClientConfiguration EndpointAddress="*" />
  <clientConfiguration>
    <serviceEndpoints>
      <!-- ... -->
    </serviceEndpoints>
  </clientConfiguration>
  <appConnectorGatewayConfiguration>
    <publicApiEndpoints>
      <!-- ... -->
    </publicApiEndpoints>
  </appConnectorGatewayConfiguration>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <!-- ... -->
    </assemblyBinding>
  </runtime>
  <system.diagnostics>
    <!-- ... -->
  </system.diagnostics>
  <dotless minifyCss="false" cache="true" web="false" />
  <conditionalHeaderConfiguration enableIfForwardedFor="https">
    <!-- ... -->
  </conditionalHeaderConfiguration>
</configuration>

[michaelnebel]

Some follow up questions
(1) It looks like there is already a <compilation ..> tag in the above Web.config file. The changes you mention are they related to changing the tag that is already there or are you putting in new lines in the config file (multiple compilation tags)?
(2) Do you know if there is a machine.config file present where the debug flag could be inherited from?

[a-joya]

1. They are related to changing the existing tag
2. I'm not aware of this

[michaelnebel]

I can't reproduce the issue, which leads me to believe that there are two possible causes:
(1) That there exist a machine.config file where the debug flag is inherited from.
(2) That the alert that might be an old alert that re-surfaces for some reason.

[michaelnebel]

https://github.blog/changelog/2023-03-10-delete-stale-code-scanning-configurations-to-close-outdated-alerts/