Skip to content
This repository was archived by the owner on Jan 5, 2026. It is now read-only.

Fix CodeQL alert SM03926: Security sensitive JsonWebTokenHandler validations are disabled#6550

Merged
tracyboehrer merged 1 commit into
mainfrom
southworks/fix/sm03926-alerts
Nov 14, 2022
Merged

Fix CodeQL alert SM03926: Security sensitive JsonWebTokenHandler validations are disabled#6550
tracyboehrer merged 1 commit into
mainfrom
southworks/fix/sm03926-alerts

Conversation

@ceciliaavila

Copy link
Copy Markdown
Collaborator

Fixes #6513 #6507 #6505 #6504 #6503 #6502 #6501

Description

This PR suppresses the CodeQL SM03926 alerts related to disabled ValidateAudience properties in TokenValidationParameters class.
The alerts can't be fixed because the validations take place manually in the code.

Specific Changes

  • Added comment to suppress SM03926 alerts in the following classes:
    • ChannelValidation
    • EmulatorValidation
    • EnterpriseChannelValidation
    • GovernmentChannelValidation
    • ParameterizedBotFrameworkAuthentication
    • SkillValidation

Testing

The unit tests passed after the changes.
image

@coveralls

Copy link
Copy Markdown
Collaborator

Pull Request Test Coverage Report for Build 329256

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • 127 unchanged lines in 8 files lost coverage.
  • Overall coverage decreased (-0.05%) to 79.009%

Files with Coverage Reduction New Missed Lines %
/libraries/AdaptiveExpressions/BuiltinFunctions/GetNextViableTime.cs 1 90.91%
/libraries/AdaptiveExpressions/BuiltinFunctions/GetPreviousViableTime.cs 1 90.91%
/libraries/Microsoft.Bot.Connector.Streaming/TaskExtensions.cs 1 82.61%
/libraries/Microsoft.Bot.Connector.Streaming/Transport/TransportHandler.cs 2 96.39%
/libraries/Microsoft.Bot.Connector/Authentication/SkillValidation.cs 7 47.3%
/libraries/Microsoft.Bot.Connector.Streaming/Session/StreamingSession.cs 8 89.62%
/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs 35 32.35%
/libraries/Microsoft.Bot.Connector/Authentication/ParameterizedBotFrameworkAuthentication.cs 72 0%
Totals Coverage Status
Change from base Build 328982: -0.05%
Covered Lines: 25603
Relevant Lines: 32405

💛 - Coveralls

@BruceHaley

Copy link
Copy Markdown
Contributor

✔️ No Binary Compatibility issues for Microsoft.Bot.Connector.dll

@tracyboehrer tracyboehrer merged commit 73e629c into main Nov 14, 2022
@tracyboehrer tracyboehrer deleted the southworks/fix/sm03926-alerts branch November 14, 2022 19:09
This was referenced May 14, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.