add code ql comment about TypeNameHandling.None (#6843)

microsoft · Aug 20, 2024 · 5717a10 · 5717a10
1 parent dd28f3a
commit 5717a10
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/libraries/Microsoft.Bot.Builder.Azure.Queues/AzureQueueStorage.cs b/libraries/Microsoft.Bot.Builder.Azure.Queues/AzureQueueStorage.cs
@@ -45,7 +45,7 @@ public AzureQueueStorage(string queuesStorageConnectionString, string queueName,
 
             _jsonSettings = jsonSerializerSettings ?? new JsonSerializerSettings
             {
-                TypeNameHandling = TypeNameHandling.None,
+                TypeNameHandling = TypeNameHandling.None, // CODEQL [cs/unsafe-type-name-handling] We use None to prevent any type information from being serialized, ensuring that no arbitrary types are deserialized, which mitigates security risks.
                 NullValueHandling = NullValueHandling.Ignore,
                 MaxDepth = null
             };
@@ -67,7 +67,7 @@ internal AzureQueueStorage(QueueClient queueClient, JsonSerializerSettings jsonS
             _queueClient = queueClient;
             _jsonSettings = jsonSerializerSettings ?? new JsonSerializerSettings
             {
-                TypeNameHandling = TypeNameHandling.None,
+                TypeNameHandling = TypeNameHandling.None, // CODEQL [cs/unsafe-type-name-handling] We use None to prevent any type information from being serialized, ensuring that no arbitrary types are deserialized, which mitigates security risks.
                 NullValueHandling = NullValueHandling.Ignore
             };
         }