Must-share information (formatted with Markdown ): which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension) SonarQube 7.9.3 (build 33349), what are you trying to achieve I am new to SonarQube and am interested whether or how SonarQube helps to spot missing input valid…

Hello @Joachim , Welcome to the SonarQube community. You are currently using SonarQube 7.9.3 which is the former LTS version. Especially when you are asking questions about “do you raise an issue in such context”, it’s highly recommended to use the very latest version which contains all our enhance…

[image] Joachim: Tracking Untrusted Data fr Hello @Alexandre_Gigleux , thanks. I asked the IT folks why they are still on the old version and to upgrade asap otherwise. But is there a public instance where you/we can demo code and the findings? A list of all checks? Thanks Joachim

You can use SonarCloud.io which runs always the latest versions of our SAST engines.

Hello @Alexandre_Gigleux , I created some examples at sonarjo · GitHub and imported the stuff to https://sonarcloud.io/organizations/sonarjo/issues?resolved=false . The code in XmlNonValidatingInputController is very close to the bad code I typically see in real application code: construct an xml d…

I added two more tests for Sonarqube: XmlValidatingWithExternalResolverController.cs - direct reference to XmlUrlResolver is detected, good XmlValidatingWithCachingResolverController.cs - but an indirect reference is not detected, bad, especially as this is an example from Microsoft.

Hello, Thanks for the detailed report and the repo. This is exactly what we love here at SonarSource to be able to exchange about real test cases. For the test case XmlNonValidatingInputController, this is expected that nothing is raised. The following syntax is not safe only for .Net Framework < …

Here is the ticket to cover the case of XmlValidatingWithCachingResolverController.

It really depends on what you are trying to sell/market. If you market Sonarqube protects against XEE, then ok (after S2755 should raise an issue when a custom Resolver is calling XmlUrlResolver.getEntity(...) · Issue #4686 · SonarSource/sonar-dotnet · GitHub is resolved - thanks for opening that). …

Thanks, @Alexandre_Gigleux , Thanks for the list. Ok, looks like input validation is only supported where lack of would lead to a vulnerability, correct? We do have a standard requirement to validate all input, thus checking for vulnerabilities only is not sufficient. Avoiding errors in subsequent…

Input validations in C#/.NET web applications

SonarQube Server / Community Build

Alexandre_Gigleux (Alexandre Gigleux) July 15, 2021, 3:01pm 10

Here are the 14 rules for which SonarQube Developer Edition or SonarCloud can detect “not sanitized user inputs” reaching a sink for C#.

Topic		Replies	Views
Does sonarqube support input validations SonarQube Server / Community Build sonarqube , scanner	1	420	September 23, 2021
Rules to detect missing Java input validation SonarQube Server / Community Build java , owasp	4	2258	November 2, 2022
Help SonarCloud with understanding the usage of untrusted and tainted input SonarQube Cloud security , false-positive , sonarqube-cloud	7	11203	October 25, 2021
OWASP Top 10 Vulnerabilities for C# code SonarQube Server / Community Build sonarqube	1	1075	November 5, 2019
Unable to trigger injection flaws for C# with Developer Edition SonarQube Server / Community Build	3	1744	May 21, 2019

Input validations in C#/.NET web applications

Related topics