Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://docs.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5399 below:

CA5399: Definitely disable HttpClient certificate revocation list check (code analysis) - .NET

Using System.Net.Http.HttpClient while providing a platform specific handler (System.Net.Http.WinHttpHandler or System.Net.Http.HttpClientHandler) whose CheckCertificateRevocationList property is not set to true will allow revoked certificates to be accepted by the HttpClient as valid.

This rule is similar to CA5400, but analysis can determine that the CheckCertificateRevocationList property is definitely false or not set.

A revoked certificate isn't trusted anymore. It could be used by attackers passing some malicious data or stealing sensitive data in HTTPS communication.

Set the System.Net.Http.HttpClientHandler.CheckCertificateRevocationList property to true explicitly. If the CheckCertificateRevocationList property is unavailable, you need to upgrade your target framework.

Do not suppress this rule.

Use the following options to configure which parts of your codebase to run this rule on.

• Exclude specific symbols
• Exclude specific types and their derived types

You can configure these options for just this rule, for all rules they apply to, or for all rules in this category (Security) that they apply to. For more information, see Code quality rule configuration options.

You can exclude specific symbols, such as types and methods, from analysis by setting the excluded_symbol_names option. For example, to specify that the rule should not run on any code within types named MyType, add the following key-value pair to an .editorconfig file in your project:

dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType

Note

Replace the XXXX part of CAXXXX with the ID of the applicable rule.

Allowed symbol name formats in the option value (separated by |):

• Symbol name only (includes all symbols with the name, regardless of the containing type or namespace).
• Fully qualified names in the symbol's documentation ID format. Each symbol name requires a symbol-kind prefix, such as M: for methods, T: for types, and N: for namespaces.
• .ctor for constructors and .cctor for static constructors.

Examples:

You can exclude specific types and their derived types from analysis by setting the excluded_type_names_with_derived_types option. For example, to specify that the rule should not run on any methods within types named MyType and their derived types, add the following key-value pair to an .editorconfig file in your project:

dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType

Note

Replace the XXXX part of CAXXXX with the ID of the applicable rule.

Allowed symbol name formats in the option value (separated by |):

• Type name only (includes all types with the name, regardless of the containing type or namespace).
• Fully qualified names in the symbol's documentation ID format, with an optional T: prefix.

Examples:

using System.Net.Http;

class ExampleClass
{
    void ExampleMethod()
    {
        WinHttpHandler winHttpHandler = new WinHttpHandler();
        winHttpHandler.CheckCertificateRevocationList = false;
        HttpClient httpClient = new HttpClient(winHttpHandler);
    }
}

using System.Net.Http;

class ExampleClass
{
    void ExampleMethod()
    {
        WinHttpHandler winHttpHandler = new WinHttpHandler();
        winHttpHandler.CheckCertificateRevocationList = true;
        HttpClient httpClient = new HttpClient(winHttpHandler);
    }
}

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4