Add test cases for webforms auth via web.config files

Author: joefarebrother

csharp/ql/lib/semmle/code/csharp/security/auth/MissingFunctionLevelAccessControlQuery.qll

@@ -122,7 +122,7 @@ predicate hasAuthViaCode(ActionMethod m) {
   )
 }
 
-/** An `<authorization>` XML element that */
+/** An `<authorization>` XML element. */
 class AuthorizationXmlElement extends XmlElement {
   AuthorizationXmlElement() {
     this.getParent() instanceof SystemWebXmlElement and

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MissingAccessControl.expected

@@ -1,2 +1,3 @@
 | Test1/EditProfile.aspx.cs:9:20:9:29 | btn1_Click | This action is missing an authorization check. |
-| Test1/ViewProfile.aspx.cs:14:20:14:36 | btn_delete1_Click | This action is missing an authorization check. |
+| Test1/ViewProfile.aspx.cs:12:20:12:36 | btn_delete1_Click | This action is missing an authorization check. |
+| Test3/B/EditProfile.aspx.cs:7:20:7:29 | btn1_Click | This action is missing an authorization check. |

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test1/ViewProfile.aspx.cs

@@ -5,8 +5,6 @@
 class ViewProfile : System.Web.UI.Page {
     private void doThings() { }
 
-    public System.Security.Principal.IPrincipal User { get; } // TODO: this should be in the stubs
-
     protected void btn_safe_Click(object sender, EventArgs e) {
         doThings();
     }

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test2/EditProfile.aspx.cs

@@ -0,0 +1,10 @@
+using System;
+using System.Web.UI;
+
+class EditProfile2 : System.Web.UI.Page {
+    private void doThings() { }
+
+    protected void btn1_Click(object sender, EventArgs e) {
+        doThings();
+    }
+} 

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test2/Web.config

@@ -0,0 +1,12 @@
+<?xml version="1.0"?>
+
+<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
+ 
+  <system.web>
+
+      <authorization>
+        <deny users="?" />
+      </authorization>
+
+  </system.web>
+</configuration>

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test3/A/EditProfile.aspx.cs

@@ -0,0 +1,10 @@
+using System;
+using System.Web.UI;
+
+class EditProfile3 : System.Web.UI.Page {
+    private void doThings() { }
+
+    protected void btn1_Click(object sender, EventArgs e) {
+        doThings();
+    }
+} 

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test3/B/EditProfile.aspx.cs

@@ -0,0 +1,10 @@
+using System;
+using System.Web.UI;
+
+class EditProfile4 : System.Web.UI.Page {
+    private void doThings() { }
+
+    protected void btn1_Click(object sender, EventArgs e) {
+        doThings();
+    }
+} 

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test3/C/EditProfile.aspx.cs

@@ -0,0 +1,10 @@
+using System;
+using System.Web.UI;
+
+class EditProfile5 : System.Web.UI.Page {
+    private void doThings() { }
+
+    protected void btn1_Click(object sender, EventArgs e) {
+        doThings();
+    }
+} 

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test3/Global.asax.cs

@@ -0,0 +1,26 @@
+using System;
+using System.Web;
+using System.Web.Routing;
+
+public class Global : System.Web.HttpApplication {
+
+    void Application_Start(object sender, EventArgs e) {
+        RegisterRoutes(RouteTable.Routes);
+    }
+
+    void Application_End(object sender, EventArgs e) { }
+
+    void Application_Error(object sender, EventArgs e) { }
+
+    void Session_Start(object sender, EventArgs e) { }
+
+    void Session_End(object sender, EventArgs e) { }
+
+    static void RegisterRoutes(RouteCollection routes) {
+        routes.MapPageRoute("VirtualEditProfile",
+            "Virtual/Edit",
+            "~/C/EditProfile.aspx",
+            false
+            );
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/Test3/Web.config

@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+
+<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
+ 
+  <location path="A">
+    <system.web>
+      <authorization>
+        <deny users="?" />
+      </authorization>
+    </system.web>
+  </location>
+  <location path="Virtual">
+    <system.web>
+      <authorization>
+        <deny users="?" />
+      </authorization>
+    </system.web>
+  </location>
+</configuration>