Rule 'Disabling CSRF protections is security-sensitive' does not seem to be working

[alexvaccaro]

• ALM used: Azure DevOps - Git
• Languages of the repository: C# .Net MVC 4.8.1

This rule does not seem to be picking up issues: C# static code analysis

We have an example of a .Net framework MVC project (4.8.1) with unsafe http POST actions on the controller and no ValidateAntiforgeryToken attributes defined on the action, or globally (there is no global.cs) and neither on the cshtml view, yet when SonarCloud performs the scan no ‘Security Hotspots’ are flagged.

We have found this by running an alternative SAST tool (CAST) which identifies this issue correctly.

Is this because in SonarCloud the rule only applies to .Net Core MVC projects rather than .Net Framework MVC?
If not, can you suggest a way I can investigate why this is happening and how I can ensure this potential vulnerability can be detected?

[Colin]

Hey there.

We would ask that you provide code that reproduces the (lack of) issue where you would expect an issue to be raised (whether it is the original code or not). I’ve moved your post to the section on reporting false-negatives.

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

[alexvaccaro]

Hi @Colin , I have attached a sample app that demonstrates the issue.

CSRF-Sonar.zip (4.1 MB)

[sebastien.andrivet]

Hi,

Thank you for providing an example of code.

@alexvaccaro

Is this because in SonarCloud the rule only applies to .Net Core MVC projects rather than .Net Framework MVC?

This rule detects when the anti-CSRF protection is actively disabled and thus, in the case of an .NET Framework application, it does not detect that by default it is unsafe.

[alexvaccaro]

OK, thanks @sebastien.andrivet. I assume therefore that Sonar does not have any other rules to detect this if it is unsafe by default.

[sebastien.andrivet]

We do not have such a rule for .NET Framework. I have created an internal ticket for this false negative. We will address it in the future but I can’t tell you when.