Merge pull request #1842 from mjcheetham/codeql-fix

mjcheetham · web-flow · commit 401bd387795d · 2025-06-24T09:52:50.000+01:00
GitAuthentication.cs: suppress CodeQL alert about cert validation
diff --git a/GVFS/GVFS.Common/Git/GitAuthentication.cs b/GVFS/GVFS.Common/Git/GitAuthentication.cs
@@ -233,7 +233,7 @@ public void ConfigureHttpClientHandlerSslIfNeeded(ITracer tracer, HttpClientHand
             {
                 if (this.GitSsl != null && !this.GitSsl.ShouldVerify)
                 {
-                    httpClientHandler.ServerCertificateCustomValidationCallback =
+                    httpClientHandler.ServerCertificateCustomValidationCallback = // CodeQL [SM02184] TLS verification can be disabled by Git itself, so this is just mirroring a feature already exposed.
                         (httpRequestMessage, c, cetChain, policyErrors) =>
                         {
                             return true;

Original file line number	Diff line number	Diff line change
`@@ -233,7 +233,7 @@ public void ConfigureHttpClientHandlerSslIfNeeded(ITracer tracer, HttpClientHand`
`233`	`233`	`{`
`234`	`234`	`if (this.GitSsl != null && !this.GitSsl.ShouldVerify)`
`235`	`235`	`{`
`236`		`- httpClientHandler.ServerCertificateCustomValidationCallback =`
	`236`	`+ httpClientHandler.ServerCertificateCustomValidationCallback = // CodeQL [SM02184] TLS verification can be disabled by Git itself, so this is just mirroring a feature already exposed.`
`237`	`237`	`(httpRequestMessage, c, cetChain, policyErrors) =>`
`238`	`238`	`{`
`239`	`239`	`return true;`