From b4c169b742aaad2744c20a3729a42beaffdc7a72 Mon Sep 17 00:00:00 2001 From: "Galina Paskaleva (INFRAGISTICS INC)" Date: Wed, 8 Jul 2026 12:45:21 +0300 Subject: [PATCH 1/3] Add CodeQL comments to clarify trusted input handling in ResourcesGenerator and UidManager --- .../Microsoft/Build/Tasks/Windows/ResourcesGenerator.cs | 2 +- .../Microsoft/Build/Tasks/Windows/UidManager.cs | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/ResourcesGenerator.cs b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/ResourcesGenerator.cs index 6f31dc30cfc..9ee48fdc6e5 100644 --- a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/ResourcesGenerator.cs +++ b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/ResourcesGenerator.cs @@ -290,7 +290,7 @@ private bool ValidResourceFiles(ITaskItem[] inputFiles) strFileName = inputFile.ItemSpec; - if (!File.Exists(TaskHelper.CreateFullFilePath(strFileName, SourceDir))) + if (!File.Exists(TaskHelper.CreateFullFilePath(strFileName, SourceDir))) // CodeQL [SM00414] Trusted build-time input: ItemSpec is developer-authored MSBuild markup, not attacker-controlled { bValid = false; Log.LogErrorWithCodeFromResources(nameof(SR.FileNotFound), strFileName); diff --git a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs index 8ef2af92084..c2a6fa5fddc 100644 --- a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs +++ b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs @@ -243,7 +243,7 @@ private bool ManageUids() using (Stream uidStream = new FileStream(tempFile, FileMode.Create)) { - using (Stream source = File.OpenRead(inputFile.ItemSpec)) + using (Stream source = File.OpenRead(inputFile.ItemSpec)) // CodeQL [SM00414] Trusted build-time input: ItemSpec is developer-authored MSBuild markup, not attacker-controlled { UidWriter writer = new UidWriter(collector, source, uidStream); writer.UpdateUidWrite(); @@ -297,7 +297,7 @@ private bool ManageUids() using (Stream uidStream = new FileStream(tempFile, FileMode.Create)) { - using (Stream source = File.OpenRead(inputFile.ItemSpec)) + using (Stream source = File.OpenRead(inputFile.ItemSpec)) // CodeQL [SM00414] Trusted build-time input: ItemSpec is developer-authored MSBuild markup, not attacker-controlled { UidWriter writer = new UidWriter(collector, source, uidStream); writer.RemoveUidWrite(); @@ -371,9 +371,9 @@ private void RenameFile(string src, string dest) private void RemoveFile(string fileName) { - if (File.Exists(fileName)) + if (File.Exists(fileName)) // CodeQL [SM00414] Trusted build-time input: path derived from developer-authored MSBuild ItemSpec, not attacker-controlled { - File.Delete(fileName); + File.Delete(fileName); // CodeQL [SM00414] Trusted build-time input: path derived from developer-authored MSBuild ItemSpec, not attacker-controlled } } From 6efdf8c7b5e684748d66eef0e9c5261bde26ac35 Mon Sep 17 00:00:00 2001 From: "Galina Paskaleva (INFRAGISTICS INC)" Date: Mon, 20 Jul 2026 12:06:57 +0300 Subject: [PATCH 2/3] Added a missing codeql comment --- .../Microsoft/Build/Tasks/Windows/UidManager.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs index c2a6fa5fddc..2ca3308fc9a 100644 --- a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs +++ b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs @@ -476,7 +476,7 @@ private UidCollector ParseFile(string fileName) { UidCollector collector = new UidCollector(fileName ); - using (Stream xamlStream = File.OpenRead(fileName)) + using (Stream xamlStream = File.OpenRead(fileName)) // CodeQL [SM00414] Trusted build-time input: ItemSpec is developer-authored MSBuild markup, not attacker-controlled { XmlNamespaceManager nsmgr = new XmlNamespaceManager(new NameTable()); XmlParserContext context = new XmlParserContext( From 42c80489f385d4071a566e8b1fdd5cc617048390 Mon Sep 17 00:00:00 2001 From: "Galina Paskaleva (INFRAGISTICS INC)" Date: Mon, 20 Jul 2026 14:45:23 +0300 Subject: [PATCH 3/3] Shorten the comment for better readability --- .../Build/Tasks/Windows/ResourcesGenerator.cs | 2 +- .../Microsoft/Build/Tasks/Windows/UidManager.cs | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/ResourcesGenerator.cs b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/ResourcesGenerator.cs index 9ee48fdc6e5..f78adda7dda 100644 --- a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/ResourcesGenerator.cs +++ b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/ResourcesGenerator.cs @@ -290,7 +290,7 @@ private bool ValidResourceFiles(ITaskItem[] inputFiles) strFileName = inputFile.ItemSpec; - if (!File.Exists(TaskHelper.CreateFullFilePath(strFileName, SourceDir))) // CodeQL [SM00414] Trusted build-time input: ItemSpec is developer-authored MSBuild markup, not attacker-controlled + if (!File.Exists(TaskHelper.CreateFullFilePath(strFileName, SourceDir))) // CodeQL [SM00414] Trusted build-time input, not attacker-controlled { bValid = false; Log.LogErrorWithCodeFromResources(nameof(SR.FileNotFound), strFileName); diff --git a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs index 2ca3308fc9a..eb9c948ba88 100644 --- a/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs +++ b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/Microsoft/Build/Tasks/Windows/UidManager.cs @@ -243,7 +243,7 @@ private bool ManageUids() using (Stream uidStream = new FileStream(tempFile, FileMode.Create)) { - using (Stream source = File.OpenRead(inputFile.ItemSpec)) // CodeQL [SM00414] Trusted build-time input: ItemSpec is developer-authored MSBuild markup, not attacker-controlled + using (Stream source = File.OpenRead(inputFile.ItemSpec)) // CodeQL [SM00414] Trusted build-time input, not attacker-controlled { UidWriter writer = new UidWriter(collector, source, uidStream); writer.UpdateUidWrite(); @@ -297,7 +297,7 @@ private bool ManageUids() using (Stream uidStream = new FileStream(tempFile, FileMode.Create)) { - using (Stream source = File.OpenRead(inputFile.ItemSpec)) // CodeQL [SM00414] Trusted build-time input: ItemSpec is developer-authored MSBuild markup, not attacker-controlled + using (Stream source = File.OpenRead(inputFile.ItemSpec)) // CodeQL [SM00414] Trusted build-time input, not attacker-controlled { UidWriter writer = new UidWriter(collector, source, uidStream); writer.RemoveUidWrite(); @@ -371,9 +371,9 @@ private void RenameFile(string src, string dest) private void RemoveFile(string fileName) { - if (File.Exists(fileName)) // CodeQL [SM00414] Trusted build-time input: path derived from developer-authored MSBuild ItemSpec, not attacker-controlled + if (File.Exists(fileName)) // CodeQL [SM00414] Trusted build-time path, not attacker-controlled { - File.Delete(fileName); // CodeQL [SM00414] Trusted build-time input: path derived from developer-authored MSBuild ItemSpec, not attacker-controlled + File.Delete(fileName); // CodeQL [SM00414] Trusted build-time path, not attacker-controlled } } @@ -476,7 +476,7 @@ private UidCollector ParseFile(string fileName) { UidCollector collector = new UidCollector(fileName ); - using (Stream xamlStream = File.OpenRead(fileName)) // CodeQL [SM00414] Trusted build-time input: ItemSpec is developer-authored MSBuild markup, not attacker-controlled + using (Stream xamlStream = File.OpenRead(fileName)) // CodeQL [SM00414] Trusted build-time input, not attacker-controlled { XmlNamespaceManager nsmgr = new XmlNamespaceManager(new NameTable()); XmlParserContext context = new XmlParserContext(