C#: Detect possible global auto validate configuration to remove FPs.

Author: michaelnebel

csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll

@@ -144,6 +144,15 @@ class ValidateAntiForgeryAttribute extends Attribute {
   }
 }
 
+/**
+ * The `Microsoft.AspNetCore.Mvc.AutoValidateAntiforgeryTokenAttribute` class.
+ */
+class AutoValidateAntiforgeryTokenAttribute extends Class {
+  AutoValidateAntiforgeryTokenAttribute() {
+    this.hasFullyQualifiedName("Microsoft.AspNetCore.Mvc", "AutoValidateAntiforgeryTokenAttribute")
+  }
+}
+
 /**
  * A class that has a name like `[Auto...]Validate[...]Anti[Ff]orgery[...Token]` and implements `IFilterMetadata` interface
  * This class can be added to a collection of global `MvcOptions.Filters` collection.
@@ -230,11 +239,20 @@ private Assembly getAnAssemblyFor(Type type) {
   result = getACompilationFor(type).getOutputAssembly()
 }
 
-private predicate isMicrosoftAspNetCoreMvcRegistration(MethodCall call) {
-  call.getTarget()
-      .hasFullyQualifiedName("Microsoft.Extensions.DependencyInjection",
-        ["MvcServiceCollectionExtensions", "MvcCoreServiceCollectionExtensions"],
-        ["AddControllers", "AddControllersWithViews", "AddMvc", "AddMvcCore"])
+/**
+ * A method that is a registration of an ASP.NET Core MVC service, i.e. `AddControllers`, `AddControllersWithViews`, `AddMvc`, or `AddMvcCore`.
+ */
+class MicrosoftAspNetCoreMvcRegistration extends Method {
+  MicrosoftAspNetCoreMvcRegistration() {
+    this.hasFullyQualifiedName("Microsoft.Extensions.DependencyInjection",
+      ["MvcServiceCollectionExtensions", "MvcCoreServiceCollectionExtensions"],
+      ["AddControllers", "AddControllersWithViews", "AddMvc", "AddMvcCore"])
+  }
+}
+
+/** Holds if the method call is a registration of an ASP.NET Core MVC service. */
+predicate isMicrosoftAspNetCoreMvcRegistration(MethodCall call) {
+  call.getTarget() instanceof MicrosoftAspNetCoreMvcRegistration
 }
 
 private predicate isMicrosoftAspNetCoreMvcApplication(Compilation compilation) {

csharp/ql/src/Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql

@@ -36,8 +36,6 @@ private Method getAStartedMethod() {
 
 /**
  * Holds if the project has a global anti forgery filter.
- *
- * No AspNetCore case here as the corresponding class doesn't seem to exist.
  */
 predicate hasGlobalAntiForgeryFilter() {
   // A global filter added
@@ -49,6 +47,18 @@ predicate hasGlobalAntiForgeryFilter() {
     // The filter is added by the Application_Start() method
     getAStartedMethod() = addGlobalFilter.getEnclosingCallable()
   )
+  or
+  exists(MethodCall addGlobalFilter, MethodCall registrationCall |
+    addGlobalFilter.getTarget() =
+      any(AspNetCore::MicrosoftAspNetCoreMvcFilterCollection collection).getAddMethod() and
+    // The filter is the `AutoValidateAntiforgeryTokenAttribute` filter.
+    addGlobalFilter.getArgument(0).getType() instanceof
+      AspNetCore::AutoValidateAntiforgeryTokenAttribute and
+    // The filter is added in an ASP.NET Core registration call, which is provided as a lambda argument
+    // to the Mvc registration method.
+    registrationCall.getTarget() instanceof AspNetCore::MicrosoftAspNetCoreMvcRegistration and
+    registrationCall.getAnArgument() = addGlobalFilter.getEnclosingCallable()
+  )
 }
 
 private class RequireAntiforgeryTokenAttribute extends Attribute {