Skip to content

csharp ssrf - #236

Draft
Lindsay Simpkins (LWSimpkins) wants to merge 8 commits into
mainfrom
lsimpkins/csharp-ssrf
Draft

csharp ssrf#236
Lindsay Simpkins (LWSimpkins) wants to merge 8 commits into
mainfrom
lsimpkins/csharp-ssrf

Conversation

@LWSimpkins

@LWSimpkins Lindsay Simpkins (LWSimpkins) commented May 23, 2025

Copy link
Copy Markdown
Collaborator

Open source the Microsoft csharp SSRF libraries

  • MaD for Azure SDK
    • The sinks are intentionally split into several categories that are used on the Microsoft side
  • Library for String Concatenation (generate the fully concatenated string)
  • Library for String Concatenation sanitization
  • Base SSRF library
  • URL Host Barrier library
  • Azure Barrier library
  • Queries for SSRF with authorization header, and for Azure sinks
  • Unit tests and test resources

TODO:

  • Merge existing RequestForgery.qll and RequestForgery.ql with the Microsoft versions

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix typo in file name: "ConcatenateStringSanitizer.qll‎"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would like to review this and merge it into github/codeql. Would you be willing to retarget it to github/codeql? Also, I see it is quite old, so I wanted to check if there were any updates you wanted to push before I review it.

@owen-mc

Copy link
Copy Markdown

Lindsay Simpkins (@LWSimpkins) Did you see my message above about retargeting this to github/codeql?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants