C#: The cs/web/missing-token-validation query now recognizes an ASP.NET Core AutoValidateAntiforgeryTokenAttribute.

[michaelnebel]

The content of this PR addresses the comment seen here. There exists a "global" auto validate for ASP.NET as explained here.

The compilation is now also taken into account when auto "global" validation is enabled. However, it is worth noting that only works fully for traced extraction (as we only create one compilation in build-mode: none extracted databases).

It appears that the OrchardCMS/OrchardCore has some global configuration enabled, which removes all results. This can be seen here.

[Copilot]

Copilot review overview

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	csharp/​ql/​src/​Security Features/​CWE-352/​MissingAntiForgeryTokenValidation.ql — FilterCollection.Add(Type) is a supported overload (and is present in the loaded stub), but…

What changed in this PR

Adds ASP.NET Core global antiforgery-filter recognition to reduce false positives in the C# CSRF query.

Changes:

• Models MVC registrations and global AutoValidateAntiforgeryTokenAttribute filters.
• Scopes global filters and middleware to the controller compilation.
• Adds regression coverage and a change note.

File	Description
MissingAntiForgeryTokenValidation.ql	Detects compilation-scoped global filters.
AspNetCore.qll	Models filter registrations and generic Add.
global-aspnetcore/​options	Loads ASP.NET Core stubs.
global-aspnetcore/​MissingAntiForgeryTokenValidation.qlref	Selects the tested query.
global-aspnetcore/​MissingAntiForgeryTokenValidation.expected	Expects no alerts.
global-aspnetcore/​MissingAntiForgeryTokenValidation.cs	Adds a global-filter regression case.
2026-08-27-csrf-autovalidate.md	Documents the analysis improvement.

Suppressed comments (2)

csharp/ql/src/Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql:146

• A global AutoValidateAntiforgeryTokenAttribute can be overridden on a controller or action with [IgnoreAntiforgeryToken], but this condition removes every POST action in the compilation before action metadata is considered. Consequently, explicitly unprotected actions are never reported. Model the effective ignore attribute and exempt those actions from the global-filter suppression.

    not hasGlobalAspNetMvcAntiForgeryFilter(compilation)

csharp/ql/src/Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql:59

• The test only exercises Add(new AutoValidateAntiforgeryTokenAttribute()), while the new generic-target branch for Filters.Add<AutoValidateAntiforgeryTokenAttribute>() has no existing coverage. Add an isolated generic-registration case so the object registration cannot mask whether generic method extraction works.

      addGlobalFilter.getTarget().(ConstructedGeneric).getTypeArgument(0) instanceof
        AspNetCore::AutoValidateAntiforgeryTokenAttribute

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[hvitved]

However, it is worth noting that only works fully for traced extraction (as we only create one compilation in build-mode: none extracted databases).

What this means is that in buildless we assume global handling if there is a registration of AutoValidateAntiforgeryTokenAttribute anywhere in the codebase, right?

[michaelnebel]

However, it is worth noting that only works fully for traced extraction (as we only create one compilation in build-mode: none extracted databases).

What this means is that in buildless we assume global handling if there is a registration of AutoValidateAntiforgeryTokenAttribute anywhere in the codebase, right?

Yes, that is correct. It is worth noting that prior to the changes in this PR, the predicate hasGlobalAntiForgeryFilter wasn't compilation aware (this is the System.Web.Mvc version of a global handling). So with the changes in the PR we

• Introduce a check for the Microsoft.AspNetCore.Mvc version of global handling.
• Make the global handling compilation aware to the extent possible.