From e0777f1249f7007593a29487169373e67f2b29b3 Mon Sep 17 00:00:00 2001 From: Ryan Lucia Date: Fri, 5 Mar 2021 12:14:23 -0500 Subject: Update CredScan suppressions (#403) Remove from list in cases where we have a fix pending or an exemption granted w/ inline supression --- .config/CredScanSuppressions.json | 10 ---------- .../src/Interop/Windows/winhttp/Interop.winhttp_types.cs | 2 ++ .../src/System/Data/SqlClient/TdsEnums.cs | 1 + .../System/DirectoryServices/AccountManagement/constants.cs | 1 + 4 files changed, 4 insertions(+), 10 deletions(-) diff --git a/.config/CredScanSuppressions.json b/.config/CredScanSuppressions.json index f2d218ded4..2df68d7bef 100644 --- a/.config/CredScanSuppressions.json +++ b/.config/CredScanSuppressions.json @@ -3,22 +3,12 @@ "suppressions": [ { "file": [ - "/src/Common/src/Interop/Windows/winhttp/Interop.winhttp_types.cs", "/src/Common/tests/System/Net/Configuration.Certificates.cs", - "/src/System.Data.SqlClient/src/System/Data/SqlClient/TdsEnums.cs", - "/src/System.Data.SqlClient/tests/FunctionalTests/DiagnosticTest.cs", - "/src/System.Data.SqlClient/tests/FunctionalTests/ExceptionTest.cs", "/src/System.Data.SqlClient/tests/FunctionalTests/SqlConnectionBasicTests.cs", "/src/System.Data.SqlClient/tests/Tools/TDS/TDS.Servers/TDSServerArguments.cs", "/src/System.Data.SqlClient/tests/Tools/TDS/TDS.Servers/TdsServerCertificate.pfx", - "/src/System.Diagnostics.Process/tests/ProcessStartInfoTests.cs", - "/src/System.DirectoryServices.AccountManagement/src/System/DirectoryServices/AccountManagement/constants.cs", - "/src/System.DirectoryServices.AccountManagement/tests/PrincipalTest.cs", "/src/System.Net.Http.WinHttpHandler/tests/UnitTests/ClientCertificateHelper.cs", - "/src/System.Net.Http/tests/FunctionalTests/HttpClientHandlerTest.cs", - "/src/System.Net.Http/tests/FunctionalTests/HttpClientHandlerTest.DefaultProxyCredentials.cs", "/src/System.Net.Http/tests/FunctionalTests/HttpClientHandlerTest.Proxy.cs", - "/src/System.Net.Http/tests/FunctionalTests/PostScenarioTest.cs", "/src/System.Net.Http/tests/UnitTests/DigestAuthenticationTests.cs", "/src/System.Net.Requests/src/System/Net/FtpWebRequest.cs", "/src/System.Private.Uri/tests/ExtendedFunctionalTests/UriRelativeResolutionTest.cs", diff --git a/src/Common/src/Interop/Windows/winhttp/Interop.winhttp_types.cs b/src/Common/src/Interop/Windows/winhttp/Interop.winhttp_types.cs index 34bea12145..8eb597c186 100644 --- a/src/Common/src/Interop/Windows/winhttp/Interop.winhttp_types.cs +++ b/src/Common/src/Interop/Windows/winhttp/Interop.winhttp_types.cs @@ -131,8 +131,10 @@ internal partial class Interop public const uint WINHTTP_AUTH_TARGET_PROXY = 0x00000001; public const uint WINHTTP_OPTION_USERNAME = 0x1000; + // [SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification="It is property descriptor, not secret value.")] public const uint WINHTTP_OPTION_PASSWORD = 0x1001; public const uint WINHTTP_OPTION_PROXY_USERNAME = 0x1002; + // [SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification="It is property descriptor, not secret value.")] public const uint WINHTTP_OPTION_PROXY_PASSWORD = 0x1003; public const uint WINHTTP_OPTION_SERVER_SPN_USED = 106; diff --git a/src/System.Data.SqlClient/src/System/Data/SqlClient/TdsEnums.cs b/src/System.Data.SqlClient/src/System/Data/SqlClient/TdsEnums.cs index 946262310b..bc4442337f 100644 --- a/src/System.Data.SqlClient/src/System/Data/SqlClient/TdsEnums.cs +++ b/src/System.Data.SqlClient/src/System/Data/SqlClient/TdsEnums.cs @@ -567,6 +567,7 @@ namespace System.Data.SqlClient // Login data validation Rules // internal const ushort MAXLEN_HOSTNAME = 128; // the client machine name + // [SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification="Not a username.")] internal const ushort MAXLEN_USERNAME = 128; // the client user id internal const ushort MAXLEN_PASSWORD = 128; // the password supplied by the client internal const ushort MAXLEN_APPNAME = 128; // the client application name diff --git a/src/System.DirectoryServices.AccountManagement/src/System/DirectoryServices/AccountManagement/constants.cs b/src/System.DirectoryServices.AccountManagement/src/System/DirectoryServices/AccountManagement/constants.cs index 597120fd57..b041ac54a7 100644 --- a/src/System.DirectoryServices.AccountManagement/src/System/DirectoryServices/AccountManagement/constants.cs +++ b/src/System.DirectoryServices.AccountManagement/src/System/DirectoryServices/AccountManagement/constants.cs @@ -96,6 +96,7 @@ namespace System.DirectoryServices.AccountManagement // these two are not publicly exposed properties, but are used internally to track ResetPassword/ExpirePasswordNow // operations against unpersisted principals, so that they can be performed once the principal has been Saved + // [SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification="Not a password.")] internal const string PwdInfoPassword = "AuthenticablePrincipal.PasswordInfo.Password"; internal const string PwdInfoExpireImmediately = "AuthenticablePrincipal.PasswordInfo.ExpireImmediately"; } -- cgit v1.2.3