Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions WEB/Src/Web/Web/AccountIdActivityProcessor.cs
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,8 @@
}

var context = HttpContext.Current;
if (context == null)
var request = context.GetRequest();
if (request == null)

Check failure

Code scanning / CodeQL

User-controlled bypass of sensitive method High

This condition guards a sensitive
action
, but a
user-provided value
controls it.
This condition guards a sensitive
action
, but a
user-provided value
controls it.
This condition guards a sensitive
action
, but a
user-provided value
controls it.
Comment thread
harsimar marked this conversation as resolved.
Dismissed
{
return;
}
Expand All @@ -42,7 +43,7 @@
var existingAccountId = activity.GetTagItem("enduser.id");
if (existingAccountId == null || string.IsNullOrEmpty(existingAccountId.ToString()))
{
var authUserCookie = context.Request.UnvalidatedGetCookie(RequestTrackingConstants.WebAuthenticatedUserCookieName);
var authUserCookie = request.UnvalidatedGetCookie(RequestTrackingConstants.WebAuthenticatedUserCookieName);
if (authUserCookie != null && !string.IsNullOrEmpty(authUserCookie.Value))
{
var authUserCookieString = HttpUtility.UrlDecode(authUserCookie.Value);
Expand Down
5 changes: 3 additions & 2 deletions WEB/Src/Web/Web/AuthenticatedUserIdActivityProcessor.cs
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,8 @@
}

var context = HttpContext.Current;
if (context == null)
var request = context.GetRequest();
if (request == null)

Check failure

Code scanning / CodeQL

User-controlled bypass of sensitive method High

This condition guards a sensitive
action
, but a
user-provided value
controls it.
This condition guards a sensitive
action
, but a
user-provided value
controls it.
This condition guards a sensitive
action
, but a
user-provided value
controls it.
Comment thread
harsimar marked this conversation as resolved.
Dismissed
{
return;
}
Expand All @@ -40,7 +41,7 @@
var existingUserId = activity.GetTagItem("enduser.id");
if (existingUserId == null || string.IsNullOrEmpty(existingUserId.ToString()))
{
var authUserCookie = context.Request.UnvalidatedGetCookie(RequestTrackingConstants.WebAuthenticatedUserCookieName);
var authUserCookie = request.UnvalidatedGetCookie(RequestTrackingConstants.WebAuthenticatedUserCookieName);
if (authUserCookie != null && !string.IsNullOrEmpty(authUserCookie.Value))
{
var authUserCookieString = HttpUtility.UrlDecode(authUserCookie.Value);
Expand Down
9 changes: 5 additions & 4 deletions WEB/Src/Web/Web/ClientIpHeaderActivityProcessor.cs
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,8 @@ public override void OnEnd(Activity activity)
}

var context = HttpContext.Current;
if (context == null)
var request = context.GetRequest();
if (request == null)
{
return;
}
Expand All @@ -90,10 +91,10 @@ public override void OnEnd(Activity activity)
foreach (var clientIpHeaderName in this.HeaderNames)
{
// Try Unvalidated first, fall back to regular Headers for test environments
var clientIpsFromHeader = context.Request.UnvalidatedGetHeader(clientIpHeaderName);
var clientIpsFromHeader = request.UnvalidatedGetHeader(clientIpHeaderName);
if (string.IsNullOrWhiteSpace(clientIpsFromHeader))
{
clientIpsFromHeader = context.Request.Headers[clientIpHeaderName];
clientIpsFromHeader = request.Headers[clientIpHeaderName];
}

if (!string.IsNullOrWhiteSpace(clientIpsFromHeader))
Expand All @@ -111,7 +112,7 @@ public override void OnEnd(Activity activity)

if (string.IsNullOrEmpty(resultIp))
{
resultIp = context.Request.GetUserHostAddress();
resultIp = request.GetUserHostAddress();
}

if (!string.IsNullOrEmpty(resultIp))
Expand Down
24 changes: 20 additions & 4 deletions WEB/Src/Web/Web/Implementation/HttpContextExtensions.cs
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,28 @@ internal static class HttpContextExtensions
{
/// <summary>
/// Gets the HttpRequest from the HttpContext.
/// Returns null if no request is available (e.g., when called outside of a
/// request context such as during <c>Application_Start</c>), in which case
/// <see cref="HttpContext.Request"/> throws <see cref="HttpException"/>.
/// </summary>
/// <param name="context">The HttpContext.</param>
/// <returns>The HttpRequest.</returns>
/// <returns>The HttpRequest, or null if not available.</returns>
public static HttpRequest GetRequest(this HttpContext context)
{
return context?.Request;
if (context == null)
{
return null;
}

try
{
return context.Request;
}
catch (HttpException)
{
// "Request is not available in this context" — e.g., Application_Start.
return null;
}
}

/// <summary>
Expand All @@ -26,12 +42,12 @@ public static HttpRequest GetRequest(this HttpContext context)
/// <returns>The request name in format "VERB Controller/Action" or "VERB Path".</returns>
public static string CreateRequestNamePrivate(this HttpContext context)
{
if (context?.Request == null)
var request = context.GetRequest();
if (request == null)
{
return string.Empty;
}

var request = context.Request;
string verb = request.HttpMethod ?? "GET";

// Try to get controller and action from route data
Expand Down
5 changes: 3 additions & 2 deletions WEB/Src/Web/Web/SessionActivityProcessor.cs
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,8 @@ public override void OnEnd(Activity activity)
}

var context = HttpContext.Current;
if (context == null)
var request = context.GetRequest();
if (request == null)
{
return;
}
Expand All @@ -45,7 +46,7 @@ public override void OnEnd(Activity activity)
if (existingSessionId == null || string.IsNullOrEmpty(existingSessionId.ToString()))
{
// Try Unvalidated first, fall back to regular Cookies for test environments
var sessionCookie = context.Request.UnvalidatedGetCookie(WebSessionCookieName) ?? context.Request.Cookies[WebSessionCookieName];
var sessionCookie = request.UnvalidatedGetCookie(WebSessionCookieName) ?? request.Cookies[WebSessionCookieName];
if (sessionCookie != null && !string.IsNullOrWhiteSpace(sessionCookie.Value))
{
var parts = sessionCookie.Value.Split('|');
Expand Down
5 changes: 3 additions & 2 deletions WEB/Src/Web/Web/UserActivityProcessor.cs
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,8 @@ public override void OnEnd(Activity activity)
}

var context = HttpContext.Current;
if (context == null)
var request = context.GetRequest();
if (request == null)
{
return;
}
Expand All @@ -43,7 +44,7 @@ public override void OnEnd(Activity activity)
if (existingUserId == null || string.IsNullOrEmpty(existingUserId.ToString()))
{
// Try Unvalidated first, fall back to regular Cookies for test environments
var userCookie = context.Request.UnvalidatedGetCookie(WebUserCookieName) ?? context.Request.Cookies[WebUserCookieName];
var userCookie = request.UnvalidatedGetCookie(WebUserCookieName) ?? request.Cookies[WebUserCookieName];
if (userCookie != null && !string.IsNullOrEmpty(userCookie.Value))
{
var cookieParts = userCookie.Value.Split('|');
Expand Down
Loading