Skip to content

csharp ssrf#236

Draft
LWSimpkins wants to merge 8 commits intomainfrom
lsimpkins/csharp-ssrf
Draft

csharp ssrf#236
LWSimpkins wants to merge 8 commits intomainfrom
lsimpkins/csharp-ssrf

Conversation

@LWSimpkins
Copy link
Collaborator

@LWSimpkins LWSimpkins commented May 23, 2025

Open source the Microsoft csharp SSRF libraries

  • MaD for Azure SDK
    • The sinks are intentionally split into several categories that are used on the Microsoft side
  • Library for String Concatenation (generate the fully concatenated string)
  • Library for String Concatenation sanitization
  • Base SSRF library
  • URL Host Barrier library
  • Azure Barrier library
  • Queries for SSRF with authorization header, and for Azure sinks
  • Unit tests and test resources

TODO:

  • Merge existing RequestForgery.qll and RequestForgery.ql with the Microsoft versions

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix typo in file name: "ConcatenateStringSanitizer.qll‎"

Copy link

@owen-mc owen-mc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would like to review this and merge it into github/codeql. Would you be willing to retarget it to github/codeql? Also, I see it is quite old, so I wanted to check if there were any updates you wanted to push before I review it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants