stacktrace-disclosure-csharp

Sakshis · Sakshis · commit 3f9dec70bede · 2024-12-11T07:16:02.000Z
diff --git a/rules/csharp/security/stacktrace-disclosure-csharp.yml b/rules/csharp/security/stacktrace-disclosure-csharp.yml
@@ -0,0 +1,27 @@
+id: stacktrace-disclosure-csharp
+severity: warning
+language: csharp
+message: >-
+  Stacktrace information is displayed in a non-Development environment.
+  Accidentally disclosing sensitive stack trace information in a production
+  environment aids an attacker in reconnaissance and information gathering.
+note: >-
+  [CWE-209] Generation of Error Message Containing Sensitive Information.
+  [REFERENCES]
+    - https://cwe.mitre.org/data/definitions/209.html
+    - https://owasp.org/Top10/A04_2021-Insecure_Design/
+utils:
+    $APP.UseDeveloperExceptionPage(...):
+     kind: expression_statement
+     pattern: $APP.UseDeveloperExceptionPage($$$);
+     inside:
+         stopBy: neighbor
+         kind: block
+         not:
+          follows:
+            stopBy: end
+            kind: invocation_expression
+            pattern: $ENV.IsDevelopment()
+rule:
+    kind: expression_statement
+    matches: $APP.UseDeveloperExceptionPage(...)
diff --git a/tests/__snapshots__/stacktrace-disclosure-csharp-snapshot.yml b/tests/__snapshots__/stacktrace-disclosure-csharp-snapshot.yml
@@ -0,0 +1,72 @@
+id: stacktrace-disclosure-csharp
+snapshots:
+  ? "if (!env.IsDevelopment())  \n    {\n        app.UseDeveloperExceptionPage();  \n    }\n"
+  : labels:
+    - source: app.UseDeveloperExceptionPage();
+      style: primary
+      start: 42
+      end: 74
+    - source: "{\n        app.UseDeveloperExceptionPage();  \n    }"
+      style: secondary
+      start: 32
+      end: 82
+  ? "if (DateTime.Now.DayOfWeek == DayOfWeek.Monday) \n    {\n        app.UseDeveloperExceptionPage(); \n    }\n"
+  : labels:
+    - source: app.UseDeveloperExceptionPage();
+      style: primary
+      start: 63
+      end: 95
+    - source: "{\n        app.UseDeveloperExceptionPage(); \n    }"
+      style: secondary
+      start: 53
+      end: 102
+  ? "if (DateTime.Now.DayOfWeek == DayOfWeek.Monday)  \n    {\n        app.UseDeveloperExceptionPage();\n    }\n"
+  : labels:
+    - source: app.UseDeveloperExceptionPage();
+      style: primary
+      start: 64
+      end: 96
+    - source: |-
+        {
+                app.UseDeveloperExceptionPage();
+            }
+      style: secondary
+      start: 54
+      end: 102
+  ? "if (env.IsProduction())  \n    {\n        app.UseDeveloperExceptionPage(); \n    }\n"
+  : labels:
+    - source: app.UseDeveloperExceptionPage();
+      style: primary
+      start: 40
+      end: 72
+    - source: "{\n        app.UseDeveloperExceptionPage(); \n    }"
+      style: secondary
+      start: 30
+      end: 79
+  ? "if (environment == \"dev\")  \n    {\n        app.UseDeveloperExceptionPage();  \n    }\n"
+  : labels:
+    - source: app.UseDeveloperExceptionPage();
+      style: primary
+      start: 42
+      end: 74
+    - source: "{\n        app.UseDeveloperExceptionPage();  \n    }"
+      style: secondary
+      start: 32
+      end: 82
+  ? |
+    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
+    {
+    app.UseDeveloperExceptionPage();
+    }
+  : labels:
+    - source: app.UseDeveloperExceptionPage();
+      style: primary
+      start: 74
+      end: 106
+    - source: |-
+        {
+        app.UseDeveloperExceptionPage();
+        }
+      style: secondary
+      start: 72
+      end: 108
diff --git a/tests/csharp/stacktrace-disclosure-csharp-test.yml b/tests/csharp/stacktrace-disclosure-csharp-test.yml
@@ -0,0 +1,39 @@
+id: stacktrace-disclosure-csharp
+valid:
+  - |
+    if (env.IsDevelopment())
+        {
+            app.UseExceptionHandler("/Error"); 
+        }
+invalid:
+  - |
+    if (env.IsProduction())  
+        {
+            app.UseDeveloperExceptionPage(); 
+        }
+  - |
+    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
+    {
+    app.UseDeveloperExceptionPage();
+    }
+  - |
+    if (!env.IsDevelopment())  
+        {
+            app.UseDeveloperExceptionPage();  
+        }
+  - |
+    if (DateTime.Now.DayOfWeek == DayOfWeek.Monday)  
+        {
+            app.UseDeveloperExceptionPage();
+        }
+  - |
+    if (DateTime.Now.DayOfWeek == DayOfWeek.Monday) 
+        {
+            app.UseDeveloperExceptionPage(); 
+        }
+  - |
+    if (environment == "dev")  
+        {
+            app.UseDeveloperExceptionPage();  
+        }
+
