What

This ticket has been created as part of the False Negative review of the WebGoat.NET benchmark.

The current implementation for S4507 only support some settings of the android manifest. However, other XML configuration files exist for other kinds of projects that we also want to support. As an example, web.config files, as seen in ASP.NET applications, can also declare development settings.

This ticket aims at supporting the customErrors setting.

Detection logic

Find a customErrors element with a mode attribute set to Off.

This should correspond to the following XPath query: .//customErrors[@mode="Off"]

All files whose name is web.debug.config - case insensitive - should be excluded from the detection.

Example code

RSPEC

Once implemented, please merge the following RSPEC PR:

Note

This change should remove 1 false negative from the aforementioned benchmark:

• "S4507","WebGoat.Net:Web.config",53