C# static code analysis | cwe: Server-side requests should not be vulnerable to forging attacks

link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

相关文章推荐

逆袭的红酒 · 如何用C++分割一个字符串？ | 风萧古道 ...· 3 天前 ·

玩滑板的啄木鸟 · java如何从字符串获得行数 | ...· 3 天前 ·

灰常酷的显示器 · 怒肝一夜，关于Java字符串的全部，都在这份 ...· 3 天前 ·

坚韧的啤酒 · 表达式和函数 - Azure Data ...· 3 天前 ·

帅气的小熊猫 · XSSFRichTextString ...· 15 小时前 ·

讲道义的鞭炮 · SAP ...· 11 月前 ·

玉树临风的小虾米 · 杭州私立国际学校一年多少钱？速看2024学费 ...· 11 月前 ·

小胡子的麦片 · 会计学-哈尔滨工业大学经济与管理学院· 1 年前 ·

低调的斑马 · 网上下载的mobi电子书资源为什么无法推送到 ...· 1 年前 ·

酷酷的仙人球 · java ...· 1 年前 ·

</noscript><div id="___gatsby"><div style="outline:none" tabindex="-1" id="gatsby-focus-wrapper"><div class="Appstyles__StyledWrapper-sc-1hw7s22-0 frrgQA"><div class="LanguagesListstyles__NavContainer-sc-11m8914-0 kRGzMD"><div class="LanguagesListstyles__TopNav-sc-11m8914-8 NhogU"><div class="top-nav-container"><a class="LanguagesListstyles__HomeLink-sc-11m8914-2 eKxmRI" href="/"><img src="/images/sonar-light-bg.svg" alt="SonarSource Rules" width="156" height="35"/></a><ul><li class="products"><span>Products <svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 12 12" width="12px" height="12px"><path fill="currentColor" d="M6 8.9c-.3 0-.5-.1-.7-.3L1.4 4.7c-.4-.3-.4-1 0-1.4s1-.4 1.4 0L6 6.5l3.2-3.2c.4-.4 1-.4 1.4 0s.4 1 0 1.4l-3.9 4c-.2.1-.4.2-.7.2z"/></svg></span><div class="page-sub-header"><div class="Discoverstyle__DiscoverContainer-sc-1lyqj30-0 dIaSbf"><div class="discover"><div class="product"><h3>In-IDE</h3><div class="image-container"><img class="product-logo" src="/images/logos/discover/sonarlint-black.svg" alt="Code Quality and Security in your IDE with SonarLint" title="Code Quality and Security in your IDE with SonarLint"/></div><p>IDE extension that lets you fix coding issues before they exist!</p><div class="index-product-link-wrap"><a class="index-product-link index-product-link-with-arrow" href="https://www.sonarlint.org/">Discover SonarLint <svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 24 24"><path fill="#347cab" d="M20 11.32l-4.71-5a1 1 0 0 0-1.41 0 1 1 0 0 0-.05 1.41L16.92 11H4.76a1 1 0 1 0 0 2h12.16l-3.14 3.35a1 1 0 0 0 .05 1.41 1 1 0 0 0 1.41-.05l4.71-5a1 1 0 0 0 .05-1.39z"/></svg></a></div></div><div class="product"><h3>SaaS</h3><div class="image-container"><img class="product-logo" src="/images/logos/discover/sonarcloud-black.svg" alt="Code Quality and Security in the cloud with SonarCloud" title="Code Quality and Security in the cloud with SonarCloud"/></div><p>Setup is effortless and analysis is automatic for most languages</p><div class="index-product-link-wrap"><a class="index-product-link index-product-link-with-arrow external" href="https://sonarcloud.io">Discover SonarCloud <svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 24 24"><path fill="#347cab" d="M20 11.32l-4.71-5a1 1 0 0 0-1.41 0 1 1 0 0 0-.05 1.41L16.92 11H4.76a1 1 0 1 0 0 2h12.16l-3.14 3.35a1 1 0 0 0 .05 1.41 1 1 0 0 0 1.41-.05l4.71-5a1 1 0 0 0 .05-1.39z"/></svg></a></div></div><div class="product"><h3>Self-Hosted</h3><div class="image-container"><img class="product-logo" src="/images/logos/discover/sonarqube-black.svg" alt="Code Quality and Security Self-Hosted with SonarQube" title="Code Quality and Security Self-Hosted with SonarQube"/></div><p>Fast, accurate analysis; enterprise scalability</p><div class="index-product-link-wrap"><a class="index-product-link index-product-link-with-arrow external" href="https://www.sonarqube.org/">Discover SonarQube <svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 24 24"><path fill="#347cab" d="M20 11.32l-4.71-5a1 1 0 0 0-1.41 0 1 1 0 0 0-.05 1.41L16.92 11H4.76a1 1 0 1 0 0 2h12.16l-3.14 3.35a1 1 0 0 0 .05 1.41 1 1 0 0 0 1.41-.05l4.71-5a1 1 0 0 0 .05-1.39z"/></svg></a></div></div></div></div></div></li></ul></div></div><nav class="LanguagesListstyles__Nav-sc-11m8914-1 itNfGC"><ul class="LanguagesListstyles__Ul-sc-11m8914-3 bmtTkj"><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/secrets/"><img width="24" height="24" alt="Secrets" src="/images/language-logos/secrets.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Secrets</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/abap/"><img width="24" height="24" alt="ABAP" src="/images/language-logos/abap.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>ABAP</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/apex/"><img width="24" height="24" alt="Apex" src="/images/language-logos/apex.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Apex</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/azureresourcemanager/"><img width="24" height="24" alt="AzureResourceManager" src="/images/language-logos/azureresourcemanager.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>AzureResourceManager</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/c/"><img width="24" height="24" alt="C" src="/images/language-logos/c.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>C</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/cpp/"><img width="24" height="24" alt="C++" src="/images/language-logos/cpp.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>C++</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/cloudformation/"><img width="24" height="24" alt="CloudFormation" src="/images/language-logos/cloudformation.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>CloudFormation</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/cobol/"><img width="24" height="24" alt="COBOL" src="/images/language-logos/cobol.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>COBOL</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><span class="LanguagesListstyles__Selected-sc-11m8914-7 hUyayR"><img width="24" height="24" alt="C#" src="/images/language-logos/csharp.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>C#</span></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/css/"><img width="24" height="24" alt="CSS" src="/images/language-logos/css.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>CSS</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/docker/"><img width="24" height="24" alt="Docker" src="/images/language-logos/docker.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Docker</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/flex/"><img width="24" height="24" alt="Flex" src="/images/language-logos/flex.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Flex</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/go/"><img width="24" height="24" alt="Go" src="/images/language-logos/go.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Go</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/html/"><img width="24" height="24" alt="HTML" src="/images/language-logos/html.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>HTML</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/java/"><img width="24" height="24" alt="Java" src="/images/language-logos/java.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Java</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/javascript/"><img width="24" height="24" alt="JavaScript" src="/images/language-logos/javascript.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>JavaScript</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/kotlin/"><img width="24" height="24" alt="Kotlin" src="/images/language-logos/kotlin.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Kotlin</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/kubernetes/"><img width="24" height="24" alt="Kubernetes" src="/images/language-logos/kubernetes.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Kubernetes</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/objective-c/"><img width="24" height="24" alt="Objective C" src="/images/language-logos/objective-c.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Objective C</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/php/"><img width="24" height="24" alt="PHP" src="/images/language-logos/php.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>PHP</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/pli/"><img width="24" height="24" alt="PL/I" src="/images/language-logos/pli.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>PL/I</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/plsql/"><img width="24" height="24" alt="PL/SQL" src="/images/language-logos/plsql.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>PL/SQL</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/python/"><img width="24" height="24" alt="Python" src="/images/language-logos/python.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Python</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/rpg/"><img width="24" height="24" alt="RPG" src="/images/language-logos/rpg.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>RPG</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/ruby/"><img width="24" height="24" alt="Ruby" src="/images/language-logos/ruby.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Ruby</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/scala/"><img width="24" height="24" alt="Scala" src="/images/language-logos/scala.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Scala</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/swift/"><img width="24" height="24" alt="Swift" src="/images/language-logos/swift.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Swift</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/terraform/"><img width="24" height="24" alt="Terraform" src="/images/language-logos/terraform.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Terraform</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/text/"><img width="24" height="24" alt="Text" src="/images/language-logos/text.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>Text</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/typescript/"><img width="24" height="24" alt="TypeScript" src="/images/language-logos/typescript.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>TypeScript</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/tsql/"><img width="24" height="24" alt="T-SQL" src="/images/language-logos/tsql.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>T-SQL</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/vbnet/"><img width="24" height="24" alt="VB.NET" src="/images/language-logos/vbnet.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>VB.NET</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/vb6/"><img width="24" height="24" alt="VB6" src="/images/language-logos/vb6.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>VB6</a></li><li class="LanguagesListstyles__Li-sc-11m8914-4 gZkmcQ"><a class="LanguagesListstyles__A-sc-11m8914-6 iaRaTX" href="/xml/"><img width="24" height="24" alt="XML" src="/images/language-logos/xml.svg" class="LanguagesListstyles__Logo-sc-11m8914-5 jomiLG"/>XML</a></li></ul></nav></div><div class="Rulesstyles__RulesListAndDetailsDiv-sc-19l1ytm-4 eYmcDD"><nav class="Rulesstyles__RulesListStyledNav-sc-19l1ytm-5 cXglau"><header class="Rulesstyles__RulesListHeader-sc-19l1ytm-1 cHhttW"><img alt="C#" height="auto" src="/images/language-logos/color/csharp.svg" width="72"/><div><h2>C# static code analysis</h2><h3>Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C# code</h3></div></header><div class="Rulesstyles__RulesFiltersDiv-sc-19l1ytm-2 VcfSy"><div class="FilterMenustyles__StyledFilterMenu-sc-qpatog-0 irFsls"><div><ul class="nav--issue-type"><a aria-selected="true" href="/csharp/"><li>All rules <span>452</span></li></a><a aria-selected="false" href="/csharp/type/Vulnerability/"><li><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" class="FilterMenustyles__StyledFilterIcon-sc-qpatog-1 flggRS" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg>Vulnerability<span>34</span></li></a><a aria-selected="false" href="/csharp/type/Bug/"><li><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16" class="FilterMenustyles__StyledFilterIcon-sc-qpatog-1 flggRS"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg>Bug<span>80</span></li></a><a aria-selected="false" href="/csharp/type/Security Hotspot/"><li><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16" class="FilterMenustyles__StyledFilterIcon-sc-qpatog-1 flggRS"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg>Security Hotspot<span>30</span></li></a><a aria-selected="false" href="/csharp/type/Code Smell/"><li><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16" class="FilterMenustyles__StyledFilterIcon-sc-qpatog-1 flggRS"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg>Code Smell<span>308</span></li></a><div class="FilterQuickFixLinkstyles__StyledFilterQuickFixContainer-sc-1cwvc76-0 dsGgSH"><hr/><a aria-selected="false" href="/csharp/quickfix/"><li><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16" class="FilterMenustyles__StyledFilterIcon-sc-qpatog-1 flggRS"><path d="M14.6 7.5c0 3.9-3.2 7-7.1 7s-7-3.2-7-7v-.1c0-3.9 3.2-7 7.1-7s7 3.2 7 7.1zm-5.4-.6h2.5c.2 0 .4.3.2.5l-5.5 5.5c-.2.2-.5 0-.5-.2V8.2H3.4c-.2 0-.4-.3-.2-.5l5.5-5.4c.2-.2.5 0 .5.2v4.4z" style="fill-rule:evenodd;clip-rule:evenodd;fill:#2d3032"/></svg>Quick Fix <span>57</span></li></a></div></ul></div></div></div><div class="Rulesstyles__FilterTypesTagsMenuStyledDiv-sc-19l1ytm-0 dDKYSH"><div class="FoundRulesCountstyles__FoundRulesCountStyledDiv-sc-10zag93-0 dEWcZL">Filtered: 78 rules found</div><div class="Rulesstyles__FilterSearchContainer-sc-19l1ytm-6 crYJLS"><div><div class="FilterSelectTagstyles__FilterSelectTagHeader-sc-1qqoake-4 bUGdxZ"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 1000 941" class="FilterSelectTagstyles__StyledFilterSelectTagIcon-sc-1qqoake-0 jUdNbW"><path d="M0 367.259l0 -287.091q1.953 -31.248 24.413 -53.708t51.755 -22.46l287.091 0q87.885 5.859 132.804 54.684l425.754 472.626q19.53 27.342 19.53 57.614t-19.53 51.755l-333.963 333.963q-25.389 21.483 -56.637 21.483t-52.731 -21.483l-423.801 -474.579q-54.684 -64.449 -54.684 -132.804zm124.992 -164.052q1.953 31.248 23.436 51.755t50.778 20.506q31.248 0 51.755 -22.46t20.506 -49.802q0 -33.201 -22.46 -53.708t-49.802 -20.506q-33.201 1.953 -53.708 23.436t-20.506 50.778z"/></svg><span class="FilterSelectTagstyles__FilterSelectTagTitle-sc-1qqoake-1 eQaCFy">cwe</span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewbox="0 0 1000 1000" enable-background="new 0 0 1000 1000" class="FilterSelectTagstyles__StyledArrowIcon-sc-1qqoake-3 cjtkgk"><g><path d="M965.1,360.2l-400,401c-17.9,17.9-41.7,25.4-65.2,24c-23.4,1.4-47.2-6.1-65.1-24l-400-401c-33.2-33.3-33.2-87.4,0-120.7c33.2-33.3,87.1-33.3,120.4,0L500,585.2l344.8-345.7c33.2-33.3,87.1-33.3,120.4,0S998.3,326.9,965.1,360.2z"/></g></svg></div><ul class="nav--issue-type"/></div><div class="SearchTermsInputstyles__SearchContainer-sc-1whde2t-0 hvKqjT"><div class="SearchTermsInputstyles__Div-sc-1whde2t-1 icHPLJ Rulesstyles__RulesSearchTerm-sc-19l1ytm-3 btjPEL"><form><input placeholder="Search by name..." type="search" class="SearchTermsInputstyles__Input-sc-1whde2t-2 fEdolY" value=""/></form><svg class="SearchTermsInputstyles__SmallMagnifyingGlassIcon-sc-1whde2t-4 hsEBSQ" xmlns="http://www.w3.org/2000/svg" viewbox="0 0 24 24"><g><path d="M19.58,18.19,15.69,14.3a6.51,6.51,0,1,0-1.42,1.41l3.89,3.9a1,1,0,0,0,.71.29,1,1,0,0,0,.71-.29A1,1,0,0,0,19.58,18.19ZM6,10.45a4.5,4.5,0,1,1,4.5,4.5A4.51,4.51,0,0,1,6,10.45Z"/></g></svg></div></div></div></div><ol class="RulesListstyles__StyledOl-sc-6thbbv-0 fqPwoD"><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-6096/"><h3>Extracting archives should not lead to zip slip vulnerabilities</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5334/"><h3>Dynamic code execution should not be vulnerable to injection attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5146/"><h3>HTTP request redirections should not be open to forging attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5135/"><h3>Deserialization should not be vulnerable to injection attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5131/"><h3>Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-3649/"><h3>Database queries should not be vulnerable to injection attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2755/"><h3>XML parsers should not be vulnerable to XXE attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2115/"><h3>A secure password should be used when connecting to a database</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2091/"><h3>XPath expressions should not be vulnerable to injection attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2083/"><h3>I/O function calls should not be vulnerable to path injection attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2078/"><h3>LDAP queries should not be vulnerable to injection attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2076/"><h3>OS commands should not be vulnerable to command injection attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2930/"><h3>"IDisposables" should be disposed</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2068/"><h3>Hard-coded credentials are security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5659/"><h3>JWT should be signed and verified with strong cipher algorithms</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5547/"><h3>Cipher algorithms should be robust</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5542/"><h3>Encryption algorithms should be used with secure mode and padding scheme</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5445/"><h3>Insecure temporary file creation methods should not be used</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4830/"><h3>Server certificates should be verified during SSL/TLS connections</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4433/"><h3>LDAP connections should be authenticated</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4426/"><h3>Cryptographic keys should be robust</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4423/"><h3>Weak SSL/TLS protocols should not be used</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-3329/"><h3>Cipher Block Chaining IVs should be unpredictable</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2631/"><h3>Regular expressions should not be vulnerable to Denial of Service attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2053/"><h3>Hashes should include an unpredictable salt</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2222/"><h3>Locks should be released on all paths</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5443/"><h3>Using publicly writable directories is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5332/"><h3>Using clear-text protocols is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5042/"><h3>Expanding archive files without controlling resource consumption is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4792/"><h3>Configuring loggers is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4790/"><h3>Using weak hashing algorithms is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4502/"><h3>Disabling CSRF protections is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2257/"><h3>Using non-standard cryptographic algorithms is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2245/"><h3>Using pseudorandom number generators (PRNGs) is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4487/"><h3>Unread "private" fields should be removed</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1944/"><h3>Invalid casts should be avoided</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-6287/"><h3>Applications should not create session cookies from untrusted input</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5773/"><h3>Types allowed to be deserialized should be restricted</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 iDCDuL"><a aria-current="page" class="" href="/csharp/tag/cwe/RSPEC-5144/"><h3>Server-side requests should not be vulnerable to forging attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-3655/"><h3>Empty nullable value should not be accessed</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2583/"><h3>Conditionally executed code should be reachable</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2445/"><h3>Blocks should be synchronized on read-only fields</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2259/"><h3>Null pointers should not be dereferenced</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2225/"><h3>"ToString()" method should not return null</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-6444/"><h3>Not specifying a timeout for regular expressions is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-6350/"><h3>Constructing arguments of system commands from user input is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5766/"><h3>Deserializing objects without performing data validation is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5753/"><h3>Disabling ASP.NET "Request Validation" feature is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5693/"><h3>Allowing requests with excessive content length is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2612/"><h3>Setting loose file permissions is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2077/"><h3>Formatting SQL queries is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2681/"><h3>Multiline blocks should be enclosed in curly braces</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2589/"><h3>Boolean expressions should not be gratuitous</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1854/"><h3>Unused assignments should be removed</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1134/"><h3>Track uses of "FIXME" tags</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1121/"><h3>Assignments should not be made from within sub-expressions</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-112/"><h3>General exceptions should never be thrown</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5883/"><h3>OS commands should not be vulnerable to argument injection attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5145/"><h3>Logging should not be vulnerable to injection attacks</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg> Vulnerability</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2184/"><h3>Results of integer division should not be assigned to floating point variables</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1206/"><h3>"Equals(Object)" and "GetHashCode()" should be overridden in pairs</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-5122/"><h3>Having a permissive Cross-Origin Resource Sharing policy is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4507/"><h3>Delivering code in production with debug features activated is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-4036/"><h3>Searching OS commands in PATH is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-3330/"><h3>Creating cookies without the "HttpOnly" flag is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2092/"><h3>Creating cookies without the "secure" flag is security-sensitive</h3><span><svg version="1.1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewbox="0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M14.08,3.23a1,1,0,0,0-.67-.77L8.16,1a1.06,1.06,0,0,0-.5,0L2.41,2.46a.94.94,0,0,0-.67.77C1.66,3.8,1,8.86,2.88,11.54A9,9,0,0,0, 7.68,15a.85.85,0,0,0,.23,0,.78.78,0,0,0,.22,0,8.93,8.93,0,0,0,4.81-3.46C14.79,8.86,14.15,3.8,14.08,3.23ZM12.21,8a6.15,6.15,0,0,1-.86,2.42A7.92,7.92,0,0,1,8,13V8ZM8,3V8L3.59,8a24.29, 24.29,0,0,1,0-3.82Z"/></svg> Security Hotspot</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2486/"><h3>Generic exceptions should not be ignored</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2386/"><h3>Mutable fields should not be "public static"</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1104/"><h3>Fields should not have public accessibility</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1135/"><h3>Track uses of "TODO" tags</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2931/"><h3>Classes with "IDisposable" members should implement "IDisposable"</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1147/"><h3>Exit methods should not be called</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2952/"><h3>Classes should "Dispose" of members from the classes' own "Dispose" methods</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-131/"><h3>"switch/Select" statements should contain a "default/Case Else" clauses</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-6507/"><h3>Blocks should not be synchronized on local variables</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path d="M10.09,1.88A2.86,2.86,0,0,0,8,1a2.87,2.87,0,0,0-2.11.87A2.93,2.93,0,0,0,5,4h6A2.93,2.93,0,0,0,10.09,1.88Z"/><path d="M14.54,9H13V5.6L14.3,4.42a.5.5,0,0,0,0-.71.49.49,0,0,0-.7,0L12.17,5H3.82L2.34,3.66a.5.5,0,0,0-.67.74L2.94,5.55V9H1.46a.5.5,0,0,0,0,1H3a5.2,5.2,0,0,0,1.05 ,2.32l-2,1.81a.5.5,0,1,0,.67.74l2-1.82A4.62,4.62,0,0,0,7,14.1V8A1,1,0,0,1,8,7a.94.94,0,0,1,1,.9v6.17A4.55,4.55,0,0,0,11.18,13l2,1.83a.51.51,0,0,0,.33.13.48.48,0,0,0, .37-.17.49.49,0,0,0,0-.7l-2-1.8a5.34,5.34,0,0,0,1-2.29h1.64a.5.5,0,0,0,0-1Z"/></svg> Bug</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1696/"><h3>NullReferenceException should not be caught</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-2221/"><h3>"Exception" should not be caught</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li><li class="RulesListstyles__StyledLi-sc-6thbbv-1 kJerpM"><a href="/csharp/tag/cwe/RSPEC-1698/"><h3>"==" should not be used when "Equals" is overridden</h3><span><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M8,15.1a7,7,0,1,0-7-7A7,7,0,0,0,8,15.1Zm.74-8.9,1.46-2.52a.29.29,0,0,1, .25-.14.3.3,0,0,1,.15,0,5.26,5.26,0,0,1,2.61,4.53.28.28,0,0,1-.29.29H10a.28.28,0,0,1-.29-.29,1.78,1.78,0,0,0-.88-1.51A.29.29,0,0,1,8.75,6.2Zm.11, 3.44A.23.23,0,0,1,9,9.6a.29.29,0,0,1,.25.14l1.46,2.52a.18.18,0,0,1,0,.13.3.3,0,0,1-.15.27,5.3,5.3,0,0,1-5.23,0,.3.3,0,0,1-.1-.4L6.73, 9.74A.29.29,0,0,1,7,9.6a.23.23,0,0,1,.14,0A1.79,1.79,0,0,0,8.86,9.64ZM5.33,3.59a.3.3,0,0,1,.41.1L7.2,6.21a.29.29,0,0,1-.1.4,1.79,1.79,0,0,0-.87, 1.51.28.28,0,0,1-.29.29H3a.32.32,0,0,1-.32-.29A5.26,5.26,0,0,1,5.33,3.59Z"/></svg> Code Smell</span></a></li></ol><main class="RuleDetailsstyles__StyledRuleDetail-sc-r16ye-0 fkjTCm"><div class="RuleDetailsstyles__StyledContainer-sc-r16ye-1 bKMAh"><section class="RuleDetailsstyles__StyledHeader-sc-r16ye-4 fVKzHe"><h1>Server-side requests should not be vulnerable to forging attacks</h1><button class="RuleDetailsstyles__StyledCTAButton-sc-r16ye-9 lgvrXF">Analyze your code</button></section><div class="RuleDetailsstyles__StyledMetaDataContainer-sc-r16ye-8 fQAJxR"><div class="RuleDetailsstyles__StyledType-sc-r16ye-3 dKJsMZ"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 16 16" enable-background="new 0 0 16 16"><path xmlns="http://www.w3.org/2000/svg" d="M12,7.05H6V5a2,2,0,1,1,4,0,1,1,0,0,0,2,0A4,4,0,1,0,4,5V7.06A1.12,1.12,0,0,0,3,8.17V14a1.12,1.12,0,0,0, 1.12,1.12H12A1.12,1.12,0,0,0,13.1,14V8.17A1.12,1.12,0,0,0,12,7.05ZM8,13a2,2,0,1,1,2-2A2,2,0,0,1,8,13Z"/></svg>Vulnerability</div><div class="RuleDetailsstyles__StyledSeverity-sc-r16ye-2 bOnkxi"><svg width="12px" height="12px" viewbox="0 0 12 12" version="1.1" xmlns="http://www.w3.org/2000/svg" xlink:href="http://www.w3.org/1999/xlink" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:1.41421"><path fill="#d4333f" d="M6,0C9.311,0 12,2.689 12,6C12,9.311 9.311,12 6,12C2.689,12 0,9.311 0,6C0,2.689 2.689,0 6,0ZM6.08,2.903C6.151,2.911 6.22,2.922 6.288,2.942C6.426,2.984 6.548,3.056 6.658,3.147C7.902,4.293 9.084,5.504 10.297,6.683C10.397,6.786 10.478,6.901 10.531,7.035C10.576,7.151 10.6,7.275 10.6,7.399C10.6,7.524 10.577,7.648 10.532,7.763C10.493,7.863 10.438,7.956 10.37,8.038C10.129,8.33 9.732,8.461 9.363,8.372C9.188,8.329 9.035,8.239 8.903,8.117L6,5.295L3.097,8.117C3.058,8.153 3.058,8.153 3.017,8.187C2.902,8.273 2.777,8.337 2.637,8.372C2.516,8.401 2.39,8.408 2.267,8.391C1.928,8.345 1.63,8.124 1.489,7.813C1.452,7.732 1.427,7.646 1.413,7.558C1.396,7.453 1.396,7.345 1.413,7.24C1.445,7.044 1.535,6.87 1.666,6.721C2.847,5.51 4.09,4.362 5.303,3.183C5.355,3.135 5.409,3.09 5.47,3.052C5.623,2.956 5.794,2.91 5.973,2.9C6.027,2.9 6.027,2.9 6.08,2.903Z"/></svg> Major<a class="Severitystyles__StyledExternalLink-sc-1vscb4r-2 dXbWXT" href="https://blog.sonarsource.com/we-are-adjusting-rules-severities"><span class="Severitystyles__TooltipText-sc-1vscb4r-1 dIvnht">SonarSource default severity<br/>click to learn more</span><svg class="Severitystyles__StyledHelpIcon-sc-1vscb4r-0 eEEibN" viewbox="-3 -3 18 18"><g transform="matrix(0.0364583,0,0,0.0364583,1,-0.166667)"><path d="M224,344L224,296C224,293.667 223.25,291.75 221.75,290.25C220.25,288.75 218.333,288 216,288L168,288C165.667,288 163.75,288.75 162.25,290.25C160.75,291.75 160,293.667 160,296L160,344C160,346.333 160.75,348.25 162.25,349.75C163.75,351.25 165.667,352 168,352L216,352C218.333,352 220.25,351.25 221.75,349.75C223.25,348.25 224,346.333 224,344ZM288,176C288,161.333 283.375,147.75 274.125,135.25C264.875,122.75 253.333,113.083 239.5,106.25C225.667,99.417 211.5,96 197,96C156.5,96 125.583,113.75 104.25,149.25C101.75,153.25 102.417,156.75 106.25,159.75L139.25,184.75C140.417,185.75 142,186.25 144,186.25C146.667,186.25 148.75,185.25 150.25,183.25C159.083,171.917 166.25,164.25 171.75,160.25C177.417,156.25 184.583,154.25 193.25,154.25C201.25,154.25 208.375,156.417 214.625,160.75C220.875,165.083 224,170 224,175.5C224,181.833 222.333,186.917 219,190.75C215.667,194.583 210,198.333 202,202C191.5,206.667 181.875,213.875 173.125,223.625C164.375,233.375 160,243.833 160,255L160,264C160,266.333 160.75,268.25 162.25,269.75C163.75,271.25 165.667,272 168,272L216,272C218.333,272 220.25,271.25 221.75,269.75C223.25,268.25 224,266.333 224,264C224,260.833 225.792,256.708 229.375,251.625C232.958,246.542 237.5,242.417 243,239.25C248.333,236.25 252.417,233.875 255.25,232.125C258.083,230.375 261.917,227.458 266.75,223.375C271.583,219.292 275.292,215.292 277.875,211.375C280.458,207.458 282.792,202.417 284.875,196.25C286.958,190.083 288,183.333 288,176ZM384,224C384,258.833 375.417,290.958 358.25,320.375C341.083,349.792 317.792,373.083 288.375,390.25C258.958,407.417 226.833,416 192,416C157.167,416 125.042,407.417 95.625,390.25C66.208,373.083 42.917,349.792 25.75,320.375C8.583,290.958 0,258.833 0,224C0,189.167 8.583,157.042 25.75,127.625C42.917,98.208 66.208,74.917 95.625,57.75C125.042,40.583 157.167,32 192,32C226.833,32 258.958,40.583 288.375,57.75C317.792,74.917 341.083,98.208 358.25,127.625C375.417,157.042 384,189.167 384,224Z"/></g></svg></a></div><section class="RuleDetailsstyles__StyledMetaData-sc-r16ye-5 Cynlv"><nav><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 1000 941"><path d="M0 367.259l0 -287.091q1.953 -31.248 24.413 -53.708t51.755 -22.46l287.091 0q87.885 5.859 132.804 54.684l425.754 472.626q19.53 27.342 19.53 57.614t-19.53 51.755l-333.963 333.963q-25.389 21.483 -56.637 21.483t-52.731 -21.483l-423.801 -474.579q-54.684 -64.449 -54.684 -132.804zm124.992 -164.052q1.953 31.248 23.436 51.755t50.778 20.506q31.248 0 51.755 -22.46t20.506 -49.802q0 -33.201 -22.46 -53.708t-49.802 -20.506q-33.201 1.953 -53.708 23.436t-20.506 50.778z"/></svg><ul class="RuleDetailsstyles__StyledMetadataTags-sc-r16ye-6 ZXSEv"><li><a href="/csharp/tag/injection/RSPEC-5144/"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 1000 941" class="RuleTagLinkstyles__StyledTagIcon-sc-3pp7t4-0 kWnxux"><path d="M0 367.259l0 -287.091q1.953 -31.248 24.413 -53.708t51.755 -22.46l287.091 0q87.885 5.859 132.804 54.684l425.754 472.626q19.53 27.342 19.53 57.614t-19.53 51.755l-333.963 333.963q-25.389 21.483 -56.637 21.483t-52.731 -21.483l-423.801 -474.579q-54.684 -64.449 -54.684 -132.804zm124.992 -164.052q1.953 31.248 23.436 51.755t50.778 20.506q31.248 0 51.755 -22.46t20.506 -49.802q0 -33.201 -22.46 -53.708t-49.802 -20.506q-33.201 1.953 -53.708 23.436t-20.506 50.778z"/></svg> injection</a></li><li><a aria-current="page" class="" href="/csharp/tag/cwe/RSPEC-5144/"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 1000 941" class="RuleTagLinkstyles__StyledTagIcon-sc-3pp7t4-0 kWnxux"><path d="M0 367.259l0 -287.091q1.953 -31.248 24.413 -53.708t51.755 -22.46l287.091 0q87.885 5.859 132.804 54.684l425.754 472.626q19.53 27.342 19.53 57.614t-19.53 51.755l-333.963 333.963q-25.389 21.483 -56.637 21.483t-52.731 -21.483l-423.801 -474.579q-54.684 -64.449 -54.684 -132.804zm124.992 -164.052q1.953 31.248 23.436 51.755t50.778 20.506q31.248 0 51.755 -22.46t20.506 -49.802q0 -33.201 -22.46 -53.708t-49.802 -20.506q-33.201 1.953 -53.708 23.436t-20.506 50.778z"/></svg> cwe</a></li></ul></nav></section></div><section class="RuleDetailsstyles__StyledDescription-sc-r16ye-7 fNexAX"><h2>Why is this an issue?</h2> <p>Server-Side Request Forgery (SSRF) occurs when attackers can coerce a server to perform arbitrary requests on their behalf.<br/></p> <p>An SSRF vulnerability can either be basic or blind, depending on whether the server’s fetched data is directly returned in the web application’s response.<br/> The absence of the corresponding response for the coerced request on the application is not a barrier to exploitation and thus must be treated in the same way as basic SSRF.</p> <h3>What is the potential impact?</h3> <p>SSRF usually results in unauthorized actions or data disclosure in the vulnerable application or on a different system it can reach. Conditional to what is reachable, remote command execution can be achieved, although it often requires chaining with further exploitations.</p> <p>Information disclosure is SSRF’s core outcome. Depending on the extracted data, an attacker can perform a variety of different actions that can range from low to critical severity.</p> <p>Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the vulnerability.</p> <h4>Local file read to host takeover</h4> <p>An attacker manipulates an application into performing a local request for a sensitive file, such as <code>~/.ssh/id_rsa</code>, by using the File URI scheme <code>file://</code>.<br/> Once in possession of the SSH keys, the attacker establishes a remote connection to the system hosting the web application.</p> <h4>Internal Network Reconnaissance</h4> <p>An attacker enumerates internal accessible ports from the affected server or others to which the server can communicate by iterating over the port field in the URL <code>http://127.0.0.1:{port}</code>.<br/> Taking advantage of other supported URL schemas (dependent on the affected system), for example, <code>gopher://127.0.0.1:3306</code>, an attacker would be able to connect to a database service and perform queries on it.</p> <h2>How to fix it in ASP.NET</h2> <h3>Code examples</h3> <p>The following code is vulnerable to SSRF as it performs an HTTP request to a URL defined by untrusted data.</p> <h4>Noncompliant code example</h4> using System.Web; using System.Web.Mvc; public class ExampleController: Controller [HttpGet] public IActionResult ImageFetch(string location) HttpWebRequest request = (HttpWebRequest)WebRequest.Create(location); return Ok(); <h4>Compliant solution</h4> using System.Web; using System.Web.Mvc; public class ExampleController: Controller private readonly string[] allowedSchemes = { "https" }; private readonly string[] allowedDomains = { "trusted1.example.com", "trusted2.example.com" }; [HttpGet] public IActionResult ImageFetch(string location) Uri uri = new Uri(location); if (!allowedDomains.Contains(uri.Host) &amp;&amp; !allowedSchemes.Contains(uri.Scheme)) return BadRequest(); HttpWebRequest request = (HttpWebRequest)WebRequest.Create(uri); return Ok(); <h3>How does this work?</h3> <p>The application should avoid opening URLs that are constructed with untrusted data.</p> <p>When such a feature is strictly necessary, SSRF can be mitigated by applying an allow-list of trustable schemes and domains.</p> <p>The compliant code example uses such an approach.</p> <h3>Pitfalls</h3> <h4>The trap of 'StartsWith' and equivalents</h4> <p>When validating untrusted URLs by checking if they start with a trusted scheme and authority pair <code>scheme://authority</code>, <strong>ensure that the validation string contains a path separator <code>/</code> as the last character</strong>.<br/></p> <p>If the validation string does not contain a terminating path separator, the SSRF vulnerability remains; only the exploitation technique changes.</p> <p>Thus, a validation like <code>startsWith("https://example.com")</code> or an equivalent with the regex <code>^https://example\.com.*</code> can be exploited with the following URL <code>https://example.commit.malicious.io</code>.</p> <h2>Resources</h2> <h3>Standards</h3> <li> <a href="https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/">OWASP Top 10 2021 Category A10</a> - Server-Side Request Forgery (SSRF) </li> <li> <a href="https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control">OWASP Top 10 2017 Category A5</a> - Broken Access Control </li> <li> <a href="https://cwe.mitre.org/data/definitions/20">MITRE, CWE-20</a> - Improper Input Validation </li>