Rule S4529: Exposing HTTP endpoints is security-sensitive

[valhristov]

RSPEC-4529

Exposing HTTP endpoints is security-sensitive. It has led in the past to the following vulnerabilities:

[PeterRockstars]

@valhristov We are seeing this pop up in SonarCloud, but not in Visual Studio, any idea why that is?

[Evangelink]

@PeterRockstars The hotspot rules are not displayed in SonarLint because they are a special kind of rules that might generate more FPs and so lower having a good experience inside the IDE.

[PeterRockstars]

That makes sense, thanks. Our build server is logging those errors during the build however, and if I run the same dotnet build command on my machine, the warnings are not logged. Is that because of something the "Prepare Sonar Analysis" step does?

[videepthMSFT]

Any Update on this issue. @PeterRockstars ?

[duncanp-lseg]

FYI the hotspot rules are only executed when an analysis is being run and the results pushed to SonarQube/Cloud.
For local builds, this happens when you execute the SonarScanner for MSBuild begin step before running MSBuild. For Azure Pipeline builds, it happens when the Prepare Sonar Analysis step is executed before the MSBuild step.

@vishnu2017 if you have an issue/question about using the scanner, please start a thread on the community forum.