Skip to content
This repository was archived by the owner on Jan 5, 2026. It is now read-only.

[#6510] Suppress CodeQL SM03926 alerts#6555

Merged
tracyboehrer merged 1 commit into
mainfrom
southworks/fix/codeql-sm03926-alerts
Nov 18, 2022
Merged

[#6510] Suppress CodeQL SM03926 alerts#6555
tracyboehrer merged 1 commit into
mainfrom
southworks/fix/codeql-sm03926-alerts

Conversation

@ceciliaavila
Copy link
Copy Markdown
Collaborator

Fixes #6510

Description

This PR suppresses the CodeQL SM03926 alerts related to disabled ValidateAudience properties in TokenValidationParameters class.
The alert can't be fixed because the validations take place manually in the code.

Specific Changes

  • Added comment to suppress SM03926 alerts in the following classes:
    • ParameterizedBotFrameworkAuthentication
    • JwtTokenExtractorTests

Testing

Unit tests passed.
image

@ceciliaavila ceciliaavila added the Automation: No parity PR does not need to be applied to other languages. label Nov 17, 2022
@ceciliaavila ceciliaavila requested a review from a team as a code owner November 17, 2022 17:39
@tracyboehrer
Copy link
Copy Markdown
Member

@ceciliaavila I have no clue why this won't build yet. It builds locally. I'll dig into it and let you know.

@tracyboehrer tracyboehrer merged commit a057f9c into main Nov 18, 2022
@tracyboehrer tracyboehrer deleted the southworks/fix/codeql-sm03926-alerts branch November 18, 2022 15:05
This was referenced May 14, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Automation: No parity PR does not need to be applied to other languages.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CodeQL alert SM03926: Security sensitive JsonWebTokenHandler validations are disabled in microsoft/microsoft/botbuilder-dotnet/botbuilder-dotnet

3 participants