보안코딩 가이드, 스캔 방법

Security Code Scan - static code analyzer for .NET
https://security-code-scan.github.io/#Rules

Security Code Scan

 

 

SCS0001 - Command Injection
If a malicious user controls either the FileName or Arguments, he might be able to execute unwanted commands or add unwanted argument. This behavior would not be possible if input parameter are validate against a white-list of characters.

SCS0003 - XPath Injection

The dynamic value passed to the XPath query should be validated.Risk

If the user input is not properly filtered, a malicious user could extend the XPath query.

SCS0007 - XML eXternal Entity Injection (XXE)

The XML parser is configured incorrectly. The operation could be vulnerable to XML eXternal Entity (XXE) processing.

SCS0018 - Path Traversal

A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the expected directory.By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files

 

등등 각종 취약점 코드 detect