在 SonarQube 的安全热点中收到警告，确保此处安全控制

Question

    ClaimsPrincipal principal = new ClaimsPrincipal(identity);
    

控制权限是安全敏感的。它在过去导致了以下漏洞：

 CVE-2018-12999
 CVE-2018-10285
 CVE-2017-7455

建议是这样的。 类 SecurityPrincipalDemo { class MyIdentity : IIdentity // 应审查敏感的自定义 IIdentity 实现 { // ... }

class MyPrincipal : IPrincipal // Sensitive, custom IPrincipal implementations should be reviewed
{
    // ...
}
[System.Security.Permissions.PrincipalPermission(SecurityAction.Demand, Role = "Administrators")] // Sensitive. The access restrictions enforced by this attribute should be reviewed.
static void CheckAdministrator()
{
    WindowsIdentity MyIdentity = WindowsIdentity.GetCurrent(); // Sensitive
    HttpContext.User = ...; // Sensitive: review all reference (set and get) to System.Web HttpContext.User
    AppDomain domain = AppDomain.CurrentDomain;
    domain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal); // Sensitive
    MyIdentity identity = new MyIdentity(); // Sensitive
    MyPrincipal MyPrincipal = new MyPrincipal(MyIdentity); // Sensitive
    Thread.CurrentPrincipal = MyPrincipal; // Sensitive
    domain.SetThreadPrincipal(MyPrincipal); // Sensitive

    // All instantiation of PrincipalPermission should be reviewed.
    PrincipalPermission principalPerm = new PrincipalPermission(null, "Administrators"); // Sensitive
    principalPerm.Demand();

    SecurityTokenHandler handler = ...;
    // Sensitive: this creates an identity.
    ReadOnlyCollection<ClaimsIdentity> identities = handler.ValidateToken(…);
}

 // Sensitive: review how this function uses the identity and principal.
void modifyPrincipal(MyIdentity identity, MyPrincipal principal)
{
    // ...
}

}

Answer 1

没关系。我通过 delacraing private read only 来解决这个问题

Answer 2

声纳

首先让我澄清一下，安全热点并不等同于“错误”。这实际上是您代码中的一个区域，由于存在潜在的安全威胁，我们希望引起您的注意，并要求您手动检查它，因为 SonarQube 无法单独确定这是否是您上下文中真正的威胁。