📝 Query Information

• Language: C#
• Query ID: csharp/web/insecure-ssl-validation
• Category: security
• Severity: error (8.1/10)
• CWE/CVE (if applicable): CWE-295 (Improper Certificate Validation)

🎯 Description

What This Query Detects

Assignments to ServicePointManager.ServerCertificateValidationCallback that unconditionally return true, disabling SSL/TLS certificate validation globally and exposing all HTTPS requests to MITM attacks.

Example Vulnerable Code

// Lambda always returning true
ServicePointManager.ServerCertificateValidationCallback += 
    (sender, certificate, chain, sslPolicyErrors) => true;

// Method reference to unconditional true
ServicePointManager.ServerCertificateValidationCallback = AlwaysAccept;

private static bool AlwaysAccept(object sender, X509Certificate cert, 
    X509Chain chain, SslPolicyErrors errors) => true;

Example Safe Code

// Actual validation logic
ServicePointManager.ServerCertificateValidationCallback = 
    (sender, cert, chain, errors) => {
        if (errors == SslPolicyErrors.None) return true;
        
        // Development-only: validate specific thumbprint
        return IsDevelopment && 
               cert.GetCertHashString() == KnownDevCertThumbprint;
    };

// Or null (reset to default behavior)
ServicePointManager.ServerCertificateValidationCallback = null;

🧪 Testing

• Positive test cases included
• Negative test cases included
• Edge cases covered
• All tests pass

📋 Checklist

• Query compiles without errors
• Documentation complete (.md and .qhelp)
• Metadata properly set (@name, @id, @kind, etc.)
• Tests validate query behavior
• No false positives in test cases

🔗 References

• CWE-295: Improper Certificate Validation
• OWASP: Improper Certificate Validation
• StackOverflow reference from issue

Note: This query was developed using Test-Driven Development methodology.

• Fixes [Query Create]: C# - Global SSL disable is bad #1

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.