You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
agigleux
changed the title
Rules S3330 and S2092 should report missing security flags on CookieOptions object
Rules S3330 and S2092 should support CookieOptions object (missing HttpOnly or Secure flags)
Oct 28, 2019
Description
Improvement of the detection engine for S3330 and S2092 to support CookieOptions object.
Repro steps
You will find non-compliant source code for S3330 and S2092 in this repository:
https://github.com/SonarSource/security-expected-issues/tree/master/dotnet/rules/hotspots
Expected behavior
HttpOnly
property is set to false or if it is not defined (by default the property value isfalse
)Secure
property is set to false or if it is not defined (by default the property value isfalse
)Actual behavior
Currently S3330 and S2092 didn't raise issues while CookieOptions object is used in an insecure way.
The text was updated successfully, but these errors were encountered: