CodeQL query to check for insecure MaxLengthRequest values in ASP.NET applications

[cldrn]

The directive maxRequestLength sets the limit for the input stream buffering threshold in KB. Attackers can use large requests to cause denial-of-service attacks.

This PR includes a CodeQL query to detect applications with larger values than the recommended one:
https://docs.microsoft.com/en-us/dotnet/api/system.web.configuration.httpruntimesection.maxrequestlength?view=netframework-4.8

[hvitved]

Closing this PR, as it is a duplicate of #2200.

[cldrn]

Closed the other issue as I removed that local copy and started doing each PR in their own branch. At this point I have deleted the original branch for that PR. I've addressed the comments in there but can we keep working on this one?

The other PR was on master branch which became a mess when I added others there by mistake. Hence, why I started from stratch with each PR in their own branch.

[hvitved]

OK, let's close the other PR, and continue with this one.

[hvitved]

Please also copy over the test files from the other PR, i.e.

csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength.cs
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength.expected
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength.qlref
csharp/ql/test/query-tests/Security Features/CWE-016/Web.config
csharp/ql/test/query-tests/Security Features/CWE-016/bad/Web.config

[cldrn]

Addressed the pending issues.

Thanks for the feedback. Are security test cases needed for all codeql queries?

[hvitved]

Are security test cases needed for all codeql queries?

Yes, we like to have test cases for all queries.

[hvitved]

Thanks again for your contribution 🎉

[cldrn]

Thanks for the help getting ready. These were from a real sca I had to do so I thought it would be a great way to get familiar with the framework.