Merge pull request #904 from AzureAD/avdunn/codeql-fixes

Add CodeQL suppressions for false positives

Author: Avery-Dunn

msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AcquireTokenByInteractiveFlowSupplier.java

@@ -163,6 +163,7 @@ private static void openDefaultSystemBrowserInWindows(URL url){
     private static void openDefaultSystemBrowserInMac(URL url){
         Runtime runtime = Runtime.getRuntime();
         try {
+            // CodeQL [SM00680] False positive: this URL is validated earlier in the interactive flow
             runtime.exec("open " + url);
         } catch (IOException e) {
             throw new RuntimeException(e);
@@ -182,6 +183,7 @@ private static void openDefaultSystemBrowserInLinux(URL url){
             if (openToolPath != null) {
                 Runtime runtime = Runtime.getRuntime();
                 try {
+                    // CodeQL [SM00680] False positive: this URL is validated earlier in the interactive flow
                     runtime.exec(openTool + " " + url);
                 } catch (IOException e) {
                     throw new RuntimeException(e);

msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/DefaultHttpClientManagedIdentity.java

@@ -29,6 +29,7 @@
  */
 class DefaultHttpClientManagedIdentity extends DefaultHttpClient {
 
+    // CodeQL [SM03767] False positive: in addTrustedCertificateThumbprint() we create a TrustManager that only trusts a certificate with specified thumbprint.
     public static final HostnameVerifier ALL_HOSTS_ACCEPT_HOSTNAME_VERIFIER;
 
     static {

msal4j-sdk/src/samples/msal-b2c-web-sample/src/main/java/com/microsoft/azure/msalwebsample/CookieHelper.java

@@ -32,6 +32,7 @@ static void removeStateNonceCookies(HttpServletResponse httpResponse){
         Cookie stateCookie = new Cookie(MSAL_WEB_APP_STATE_COOKIE, "");
         stateCookie.setMaxAge(0);
 
+        // CodeQL [java/insecure-cookie]: Suppressing CodeQL warning since this is just a sample
         httpResponse.addCookie(stateCookie);
 
         Cookie nonceCookie = new Cookie(MSAL_WEB_APP_NONCE_COOKIE, "");

msal4j-sdk/src/samples/msal-obo-sample/src/main/java/com/microsoft/azure/msalobosample/ApiController.java

@@ -25,6 +25,7 @@ public String graphMeApi() throws MalformedURLException {
 
         String oboAccessToken = msalAuthHelper.getOboToken("https://graph.microsoft.com/.default");
 
+        // CodeQL [java/xss]: Suppressing CodeQL warning since this is just a sample
         return callMicrosoftGraphMeEndpoint(oboAccessToken);
     }
 

msal4j-sdk/src/samples/msal-web-sample/src/main/java/com/microsoft/azure/msalwebsample/CookieHelper.java

@@ -32,6 +32,7 @@ static void removeStateNonceCookies(HttpServletResponse httpResponse){
         Cookie stateCookie = new Cookie(MSAL_WEB_APP_STATE_COOKIE, "");
         stateCookie.setMaxAge(0);
 
+        // CodeQL [java/insecure-cookie]: Suppressing CodeQL warning since this is just a sample
         httpResponse.addCookie(stateCookie);
 
         Cookie nonceCookie = new Cookie(MSAL_WEB_APP_NONCE_COOKIE, "");