Jaroslav Lobačevski

Example from https://docs.microsoft.com/en-us/dotnet/api/system.web.httprequest?view=netframework-4.7.2 ```cs public partial class RestrictedPage : Page { protected void Page_Load(object sender, EventArgs e) { if (!Request.IsAuthenticated) { var rawUrl = Request.RawUrl; Response.Redirect("/Account/Login?ru=" + Server.HtmlEncode(rawUrl)); } }...

Currently the pattern is to `someType.ToString() == "System.Type"`. Reverse the logic everywhere by [XXEAnalyzer example](https://github.com/security-code-scan/security-code-scan/blob/master/SecurityCodeScan/Analyzers/XxeAnalyzer.cs#L97) - search the type symbol by string once and compare then only types. Should reduce...

Warnings on deserialization where only one argument of two is tainted

1

For some deserializers like `XmlSerializer` and `DataContractSerializer` both `type` and `serialized data` have to be tainted to make it exploitable. Currently it gives false positives if only one is: ```cs...

There should be no warning because it serializes. ```cs static void Serialize(Type type, object data) { XmlSerializer xs = new XmlSerializer(type); StreamWriter writer = File.CreateText(""); xs.Serialize(writer, data); writer.Flush(); writer.Close(); }...

This should not give a waring: ```cs class Test { public static readonly string Safe = ""Safe""; static void TestMethod() { new SqlCommand(Safe); } } ```

Add DSA, DSASignatureFormatter, HMACMD5, TripleDES, RIPEMD160 and HMACRIPEMD160.

Although it doesn't clone private members... ```cs public T DeepClone(T source) { var serializeSettings = new JsonSerializerSettings {TypeNameHandling = TypeNameHandling.All}; var serialized = JsonConvert.SerializeObject(source, serializeSettings); return JsonConvert.DeserializeObject(serialized, serializeSettings); } ```...

```cs class WeakHashing { static string Sha256Name { get { return ""System.Security.Cryptography.SHA256""; } } static void Foo(string name) { var sha = HashAlgorithm.Create(Sha256Name); } } ``` Taint analyzer should be...

`certificateValidationMode` and `customCertificateValidatorType`: https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/wcf/authentication-of-clientcertificate-element https://msdn.microsoft.com/en-us/library/system.servicemodel.security.x509servicecertificateauthentication.certificatevalidationmode(v=vs.110).aspx and https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/windows-identity-foundation/certificatevalidation https://msdn.microsoft.com/en-us/library/system.servicemodel.security.x509servicecertificateauthentication.customcertificatevalidator(v=vs.110).aspx https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.selectors.x509certificatevalidator?view=netframework-4.7.2