Skip to content

Conversation

michaelnebel
Copy link
Contributor

@michaelnebel michaelnebel commented Mar 23, 2023

The issue that is referring this PR provides some more information.
Basically, we should disregard debug=true in case there exist a transformation that removes the debug attribute (a transformation file in the same folder as the Web.Config file).
E.g. if there exist a transformation file with content like

<?xml version="1.0" encoding="utf-8" ?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <system.web>
    <compilation xdt:Transform="RemoveAttributes(debug)" />
  </system.web>
</configuration>

then we can disregard debug=true in the Web.config file.
According to Microsoft documentation the tag doesn't need to be under system.web.

@github-actions github-actions bot added the C# label Mar 23, 2023
@michaelnebel michaelnebel force-pushed the csharp/cs-web-debug-binary branch 2 times, most recently from cf4ca48 to bc771e8 Compare March 23, 2023 18:12
@michaelnebel michaelnebel force-pushed the csharp/cs-web-debug-binary branch from 88b48c2 to 4a64479 Compare March 27, 2023 08:43
Comment on lines +4 to +7
<compilation
defaultLanguage="c#"
debug="true"
/>

Check failure

Code scanning / CodeQL

Creating an ASP.NET debug binary may reveal sensitive information

The 'debug' flag is set for an ASP.NET configuration file.
@michaelnebel
Copy link
Contributor Author

michaelnebel commented Mar 27, 2023

The DCA results show that we need to narrow the application of the transformation files to not miss any true positives.
Narrowing the implementation such that we assume that a transformation only applies in case it is the same folder as the config file.

@michaelnebel
Copy link
Contributor Author

The DCA execution looks fine.
(1) The alerts that have disappeared are all because there is a Web.Release.config next to the Web.config that removes the debug attribute.
(2) DCA reports that cs/web/debug-binary query is a bit slower on the mono project. Running the query locally doesn't exhibit the same slowdown factor. The query is expected to be slightly slower, which is also the case.

@michaelnebel michaelnebel marked this pull request as ready for review March 27, 2023 14:46
@michaelnebel michaelnebel requested a review from a team as a code owner March 27, 2023 14:46
Copy link
Contributor

@hvitved hvitved left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@michaelnebel michaelnebel merged commit 730848c into github:main Mar 28, 2023
@michaelnebel michaelnebel deleted the csharp/cs-web-debug-binary branch March 28, 2023 07:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants