Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings
This repository was archived by the owner on Jan 5, 2026. It is now read-only.

[#6510] Suppress CodeQL SM03926 alerts - #6555

#6555
Merged
tracyboehrer merged 1 commit into
mainmicrosoft/botbuilder-dotnet:mainfrom
southworks/fix/codeql-sm03926-alertsmicrosoft/botbuilder-dotnet:southworks/fix/codeql-sm03926-alertsCopy head branch name to clipboard
Nov 18, 2022
Merged

[#6510] Suppress CodeQL SM03926 alerts#6555
tracyboehrer merged 1 commit into
mainmicrosoft/botbuilder-dotnet:mainfrom
southworks/fix/codeql-sm03926-alertsmicrosoft/botbuilder-dotnet:southworks/fix/codeql-sm03926-alertsCopy head branch name to clipboard

Conversation

@ceciliaavila

Copy link
Copy Markdown
Collaborator

Fixes #6510

Description

This PR suppresses the CodeQL SM03926 alerts related to disabled ValidateAudience properties in TokenValidationParameters class.
The alert can't be fixed because the validations take place manually in the code.

Specific Changes

  • Added comment to suppress SM03926 alerts in the following classes:
    • ParameterizedBotFrameworkAuthentication
    • JwtTokenExtractorTests

Testing

Unit tests passed.
image

@ceciliaavila ceciliaavila added the Automation: No parity PR does not need to be applied to other languages. label Nov 17, 2022
@ceciliaavila
ceciliaavila requested a review from a team as a code owner November 17, 2022 17:39
@tracyboehrer

Copy link
Copy Markdown
Member

@ceciliaavila I have no clue why this won't build yet. It builds locally. I'll dig into it and let you know.

@tracyboehrer
tracyboehrer merged commit a057f9c into main Nov 18, 2022
@tracyboehrer
tracyboehrer deleted the southworks/fix/codeql-sm03926-alerts branch November 18, 2022 15:05
This was referenced May 14, 2026
This was referenced May 14, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Automation: No parity PR does not need to be applied to other languages.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CodeQL alert SM03926: Security sensitive JsonWebTokenHandler validations are disabled in microsoft/microsoft/botbuilder-dotnet/botbuilder-dotnet

3 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.