DISA STIG version 5 IDs mapped to Klocwork C# checkers
This article maps DISA Security Technical Implementation Guide version 5 IDs to Klocwork C# checkers. For more information about DISA STIG, see the STIG web site.
| Rule | Checker name and description |
|---|---|
| V-222396 (APSC-DV-000160) |
CS.RCA Risky cryptographic algorithm used |
| V-222397 (APSC-DV-000170) |
CS.RCA Risky cryptographic algorithm used |
| V-222542 (APSC-DV-001740) |
CS.HCC Use of hardcoded credentials CS.HCC.PWD Use of a hardcoded password CS.HCC.USER Use of a hardcoded user name CS.RCA Risky cryptographic algorithm used |
| V-222543 (APSC-DV-001750) |
CS.HCC Use of hardcoded credentials CS.HCC.PWD Use of a hardcoded password CS.HCC.USER Use of a hardcoded user name CS.RCA Risky cryptographic algorithm used |
| V-222555 (APSC-DV-001860) |
CS.HCC Use of hardcoded credentials CS.HCC.PWD Use of a hardcoded password CS.HCC.USER Use of a hardcoded user name |
| V-222566 (APSC-DV-001980) |
CS.RLK Resource leak |
| V-222568 (APSC-DV-002000) |
CS.RLK Resource leak |
| V-222571 (APSC-DV-002030) |
CS.RCA Risky cryptographic algorithm used |
| V-222572 (APSC-DV-002040) |
CS.RCA Risky cryptographic algorithm used |
| V-222583 (APSC-DV-002290) |
CS.RCA Risky cryptographic algorithm used |
| V-222589 (APSC-DV-002350) |
CS.RCA Risky cryptographic algorithm used |
| V-222594 (APSC-DV-002400) |
CS.SV.TAINTED.ALLOC_SIZE Use of unvalidated integer in memory allocation |
| V-222602 (APSC-DV-000160) |
CS.XSS.PERSIST Cross-site Scripting Persisting Vulnerability CS.XSS.REFLECT Cross-site Scripting Reflecting Vulnerability |
| V-222603 (APSC-DV-002500) |
CS.CSRF.ATTR.NOATTR AntiForgery attribute should be added to class or method. CS.CSRF.ATTR.POST AntiForgery attribute should be added to class or method. CS.CSRF.VALIDATE Validation of 'POST request data access' is not done. CS.CSRF.VSUK.CONSTASSIGN A const string is assigned to property 'ViewStateUserKey'. CS.CSRF.VSUK.NOASSIGN Property 'ViewStateUserKey' is not set. |
| V-222604 (APSC-DV-002510) |
CS.SV.TAINTED.INJECTION C# command injection |
| V-222606 (APSC-DV-002530) |
CS.SV.TAINTED.ALLOC_SIZE Use of unvalidated integer in memory allocation CS.SV.TAINTED.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.INDEX_ACCESS Use of unvalidated integer as array index by function call CS.SV.TAINTED.CALL.LOOP_BOUND Use of unvalidated integer in loop condition through a function call CS.SV.TAINTED.FMTSTR Use of unvalidated data in a format string CS.SV.TAINTED.INDEX_ACCESS Use of unvalidated integer as array index CS.SV.TAINTED.LOOP_BOUND Use of unvalidated integer in loop condition CS.SV.TAINTED.PATH_TRAVERSAL Use of unvalidated data in a path traversal |
| V-222607 (APSC-DV-002540) |
CS.SV.USAGERULES.PERMISSIONS Use of Privilege Elevation |
| V-222609 (APSC-DV-002560) |
CS.SV.TAINTED.ALLOC_SIZE Use of unvalidated integer in memory allocation CS.SV.TAINTED.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.INDEX_ACCESS Use of unvalidated integer as array index by function call CS.SV.TAINTED.CALL.LOOP_BOUND Use of unvalidated integer in loop condition through a function call CS.SV.TAINTED.DESERIALIZATION Use of unvalidated integer during deserialization in object creation CS.SV.TAINTED.FMTSTR Use of unvalidated data in a format string CS.SV.TAINTED.INDEX_ACCESS Use of unvalidated integer as array index CS.SV.TAINTED.LOOP_BOUND Use of unvalidated integer in loop condition CS.SV.TAINTED.PATH_TRAVERSAL Use of unvalidated data in a path traversal |
| V-222612 (APSC-DV-002590) |
CS.SV.TAINTED.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.INDEX_ACCESS Use of unvalidated integer as array index by function call CS.SV.TAINTED.CALL.LOOP_BOUND Use of unvalidated integer in loop condition through a function call CS.SV.TAINTED.INDEX_ACCESS Use of unvalidated integer as array index CS.SV.TAINTED.LOOP_BOUND Use of unvalidated integer in loop condition |
| V-222625 (APSC-DV-002950) |
CS.BANNED.INVOKE Prefer asynchronous calls to synchronized calls |
| V-222641 (APSC-DV-003100) |
CS.RCA Risky cryptographic algorithm used |
| V-254803 (APSC-DV-002010) |
CS.RCA Risky cryptographic algorithm used |
