Jaroslav Lobačevski

Thanks for the link, I'll investigate it. I just quickly skimmed through it and find some statements confusing, like ".NET Framework applications should use the TLS version the operating system...

Also consider the example: ```cs public T Deserialize(string xmlString) { var serializer = new XmlSerializer(typeof(T)); StringReader reader = new StringReader(xmlString); return (T) serial.Deserialize(reader); } ``` It is tricky to call...

I would rather say of #208 but there is no repro scenario provided.

Sorry it took me so long to look at the attached project. Unfortunately I cannot reproduce. Some thoughts why: 1. If this is really dup of #208 I think the...

Yes, the tests are disabled for this case, for example: https://github.com/security-code-scan/security-code-scan/blob/5fecefe194ce3b1519d52cd4b758e40a38bf5af6/SecurityCodeScan.Test/Tests/XssPreventionAnalyzerTest.cs#L123-L125 There are two reasons for this: 1. Technical. Current taint tracking engine doesn't support sink on return. It possible...

I'll keep the issue as a work item additionally to the `todo`. Ideally all todo in the code have to have corresponding issues. :)

Yes, web.config rules are more complex than currently supported. See for example https://weblogs.asp.net/jongalloway/10-things-asp-net-developers-should-know-about-web-config-inheritance-and-overrides Also there are xml transformations in place. Ideal solution probably should use https://github.com/nil4/dotnet-transform-xdt before analysis too.

Thanks, I can reproduce it. It happens because any input from DbContext is always marked as tainted in [config](https://github.com/security-code-scan/security-code-scan/blob/ada966b20782dacb04b7d0411d45b956439d9823/SecurityCodeScan/Config/Main.yml#L108) which leads to this weird effect. It is not something easy...

Thank you for bringing it up. Since you are installing it globally I guess you have multiple options: 1. Install .net 5 2. If you have full dotnet framework installed...

Hi, I can reproduce it, but it is not clear to me why exactly it doesn't find the `DisposeAsync`:   | Name | Value | Type -- | -- | --...