Csharp Codeql Cwe

Context

CodeQL is a SAST (Static Application Security Testing) tool that analyses code as data. It finds classes of vulnerability reliably but misses logic flaws, business rule violations, and configuration issues. CodeQL output should be treated as:

• A baseline triage starting point, not a complete security review.
• High-confidence findings for the patterns it covers (injection, path traversal, hardcoded credentials).
• A complement to manual review — not a replacement.

Best used for

All C#/.NET repositories with CodeQL enabled. Use this skill when triaging CodeQL alerts, reviewing PRs with CodeQL findings, deciding which findings require manual investigation, and understanding what CodeQL does not cover.

Primary references

• GitHub Docs — C# queries for CodeQL: https://docs.github.com/en/code-security/reference/code-scanning/codeql/codeql-queries/csharp-built-in-queries
• CodeQL for C#: https://codeql.github.com/docs/codeql-language-guides/codeql-for-csharp/
• Microsoft Learn — custom CodeQL queries: https://learn.microsoft.com/en-us/azure/devops/repos/security/github-advanced-security-code-scanning-queries?view=azure-devops

Patterns

C# CodeQL built-in query categories

Key query suites for C#:

• csharp-security-extended.qls — full security query suite.
• csharp-security-and-quality.qls — security + code quality.

Individual query categories relevant to review:

When a CodeQL finding requires manual review

• SQL injection (CWE-89): Always verify — CodeQL finds the data flow but the fix (parameterisation) must be confirmed correct.
• Path traversal (CWE-22): Verify the full path normalisation chain — Path.GetFullPath() alone is insufficient if the result isn't checked against an allowed root.
• Insecure deserialization (CWE-502): BinaryFormatter is banned in .NET 8+ by default; older code using it should be flagged Critical. JsonConvert with TypeNameHandling.All is High regardless.
• Hardcoded credentials (CWE-798): Check if the finding is a real credential or a test fixture. Real credentials = Critical.

When custom query/model work is justified

• Large codebase with custom ORM or query builder: CodeQL needs a model for the custom source/sink.
• Custom serialisation libraries: model the deserialise method as a sink.
• Internal framework with non-standard request handling: model entry points as sources.

CodeQL in CI/CD (operational fit)

• Run on every PR via github/codeql-action — catch new findings before merge.
• security-extended query suite for thorough coverage.
• Suppress findings only with documented rationale (// lgtm[cs/sql-injection] style annotations are deprecated — use security-alerts dismissal in GitHub UI with reason).
• Alert triage: High/Critical CodeQL findings should block merge until reviewed.

Anti-Patterns

False-confidence traps — things CodeQL does NOT catch

• IDOR / missing ownership checks: CodeQL cannot determine whether a user is authorised to access a specific record.
• Business logic flaws: CodeQL does not understand the intended behaviour.
• Missing authorization: CodeQL can detect [AllowAnonymous] but cannot reason about whether authorization is adequate.
• Race conditions: most are not detectable statically.
• JWT misconfiguration: CodeQL does not evaluate runtime TokenValidationParameters.
• Second-order injection: data stored to DB then retrieved and used unsanitised in a later request — CodeQL may not trace the full flow.

Over-reliance on CodeQL

• Treating a clean CodeQL scan as proof of security.
• Skipping manual review because CodeQL reported no findings.
• Dismissing CodeQL alerts without investigation ("probably a false positive").

Examples

CodeQL-detected SQL injection (CWE-89):

// BAD — CodeQL will flag this
var query = $"SELECT * FROM Users WHERE Name = '{userInput}'";
var result = context.Users.FromSqlRaw(query).ToList();

// GOOD — parameterised query
var result = context.Users
    .FromSqlRaw("SELECT * FROM Users WHERE Name = {0}", userInput)
    .ToList();

CodeQL-detected path traversal (CWE-22):

// BAD — CodeQL will flag this
var filePath = Path.Combine(uploadsDir, userFileName);
var content = File.ReadAllText(filePath);

// GOOD — validate resolved path is under allowed root
var filePath = Path.GetFullPath(Path.Combine(uploadsDir, userFileName));
if (!filePath.StartsWith(Path.GetFullPath(uploadsDir) + Path.DirectorySeparatorChar))
    throw new UnauthorizedAccessException();

CodeQL-detected insecure deserialization (CWE-502):

// BAD — BinaryFormatter is banned in .NET 8+
var formatter = new BinaryFormatter();
var obj = formatter.Deserialize(stream);

// BAD — TypeNameHandling.All enables type injection
var obj = JsonConvert.DeserializeObject<Payload>(json,
    new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.All });

// GOOD — System.Text.Json (no type-name handling by default)
var obj = JsonSerializer.Deserialize<Payload>(json);

Review cues

• CodeQL alert on a PR → investigate the full data flow, not just the flagged line.
• Multiple alerts of the same CWE → likely a systemic pattern; recommend a codebase-wide fix.
• Alert dismissed without comment → flag for re-review.
• No CodeQL alerts but manual review finds injection → consider custom query.
• Clean scan on a codebase with complex data flows → verify CodeQL models cover the ORM/framework in use.

Good looks like

• Every PR is scanned with csharp-security-extended.qls.
• High/Critical findings block merge and require documented resolution.
• False positives are dismissed in the GitHub UI with a written rationale, not suppressed in code.
• Manual review complements CodeQL — reviewers check for IDOR, business logic, and authorization gaps that CodeQL cannot detect.
• Custom CodeQL models exist for internal frameworks and ORMs.

Common findings / likely remediations