Add documentation

Author: joefarebrother

csharp/ql/src/Security Features/CWE-639/InsecureDirectObjectReference.qhelp

@@ -0,0 +1,30 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>When an action method accepts an ID parameter used to control which resource (e.g. a comment, a user profile, etc) 
+is being accessed/modified, checks should me made to ensure that the current user is authorized to access that resource. 
+Otherwise, an attacker could access an arbitrary resource by modifying the ID parameter.</p>
+
+</overview>
+<recommendation>
+<p>
+Ensure that the current user is authorized to access the resource of the provided ID.
+</p>
+
+</recommendation>
+<example>
+<p>In the following example, in the case marked BAD, there is no authorization check, so any user is able to edit any comment.
+In the case marked GOOD, there is a check that the current usr matches the author of the comment.</p>
+<sample src="WebFormsExample.cs" />
+
+
+</example>
+<references>
+
+  <li>OWASP - <a href="https://wiki.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References">Insecure Direct Object Refrences</a>.</li>
+  <li>OWASP - <a href="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References">Testing for Insecure Direct Object References</a>.</li>
+
+</references>
+</qhelp>

csharp/ql/src/Security Features/CWE-639/WebFormsExample.cs

@@ -0,0 +1,15 @@
+    // BAD - Any user can access this method.
+    protected void btn1_Click(object sender, EventArgs e) {
+        string commentId = Request.QueryString["Id"];
+        Comment comment = getCommentById(commentId);
+        comment.Body = inputCommentBody.Text;
+    }
+
+    // GOOD - The user ID is verified.
+    protected void btn2_Click(object sender, EventArgs e) {
+        string commentId = Request.QueryString["Id"];
+        Comment comment = getCommentById(commentId);
+        if (comment.AuthorName == User.Identity.Name){
+            comment.Body = inputCommentBody.Text;
+        }
+    }