Supress CodeQL warnings, update build agents (#484)

Author: Tratcher

azure-pipelines.yml

@@ -69,10 +69,10 @@ stages:
         pool:
           ${{ if eq(variables['System.TeamProject'], 'public') }}:
             name: NetCore-Public
-            demands: ImageOverride -equals Build.Windows.10.Amd64.VS2019.Pre.Open
+            demands: ImageOverride -equals 1es-windows-2019-open
           ${{ if ne(variables['System.TeamProject'], 'public') }}:
             name: NetCore1ESPool-Internal
-            demands: ImageOverride -equals Build.Windows.10.Amd64.VS2019.Pre
+            demands: ImageOverride -equals 1es-windows-2019
         ${{ if eq(variables.runCodeQL3000, 'true') }}:
           # Component governance and SBOM creation are not needed here. Disable what Arcade would inject.
           disableComponentGovernance: true

src/Microsoft.Owin.Host.SystemWeb/SystemWebChunkingCookieManager.cs

@@ -193,7 +193,7 @@ public void AppendResponseCookie(IOwinContext context, string key, string value,
             // Normal cookie
             if (!ChunkSize.HasValue || ChunkSize.Value > prefix.Length + escapedValue.Length + suffix.Length + (quoted ? 2 : 0))
             {
-                var cookie = new HttpCookie(escapedKey, escapedValue);
+                var cookie = new HttpCookie(escapedKey, escapedValue); // CodeQL [SM03822] False positive, this is an abstraction and the values are determined elsewhere.
                 SetOptions(cookie, options, domainHasValue, pathHasValue, expiresHasValue);
 
                 webContext.Response.AppendCookie(cookie);

src/Microsoft.Owin.Security.ActiveDirectory/WsFedCachingSecurityKeyProvider.cs

@@ -45,7 +45,7 @@ public WsFedCachingSecurityKeyProvider(string metadataEndpoint, ICertificateVali
                 {
                     throw new InvalidOperationException(Properties.Resources.Exception_ValidatorHandlerMismatch);
                 }
-                webRequestHandler.ServerCertificateValidationCallback = backchannelCertificateValidator.Validate;
+                webRequestHandler.ServerCertificateValidationCallback = backchannelCertificateValidator.Validate; // CodeQL [SM03786] False positive, not disabled by default. Used for testing and extensibility.
             }
 
             RetrieveMetadata();

src/Microsoft.Owin.Security.ActiveDirectory/WsFedMetadataRetriever.cs

@@ -20,7 +20,7 @@ internal static class WsFedMetadataRetriever
 
         public static IssuerSigningKeys GetSigningKeys(string metadataEndpoint, TimeSpan backchannelTimeout, HttpMessageHandler backchannelHttpHandler)
         {
-            using (var metadataRequest = new HttpClient(backchannelHttpHandler, false))
+            using (var metadataRequest = new HttpClient(backchannelHttpHandler, false))// CodeQL [SM02185] Enabling certificate revocation would be a breaking change. Customers can enable it.
             {
                 metadataRequest.Timeout = backchannelTimeout;
                 using (HttpResponseMessage metadataResponse = metadataRequest.GetAsync(metadataEndpoint).Result)

src/Microsoft.Owin.Security.Facebook/FacebookAuthenticationMiddleware.cs

@@ -61,7 +61,7 @@ public FacebookAuthenticationMiddleware(
                 Options.SignInAsAuthenticationType = app.GetDefaultSignInAsAuthenticationType();
             }
 
-            _httpClient = new HttpClient(ResolveHttpMessageHandler(Options));
+            _httpClient = new HttpClient(ResolveHttpMessageHandler(Options)); // CodeQL [SM02185] Enabling certificate revocation would be a breaking change. Customers can enable it.
             _httpClient.Timeout = Options.BackchannelTimeout;
             _httpClient.MaxResponseContentBufferSize = 1024 * 1024 * 10; // 10 MB
         }
@@ -89,7 +89,7 @@ private static HttpMessageHandler ResolveHttpMessageHandler(FacebookAuthenticati
                 {
                     throw new InvalidOperationException(Resources.Exception_ValidatorHandlerMismatch);
                 }
-                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate;
+                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate; // CodeQL [SM03786] False positive, not disabled by default. Used for testing and extensibility.
             }
 
             return handler;

src/Microsoft.Owin.Security.Google/GoogleOAuth2AuthenticationMiddleware.cs

@@ -63,7 +63,7 @@ public GoogleOAuth2AuthenticationMiddleware(
                 Options.SignInAsAuthenticationType = app.GetDefaultSignInAsAuthenticationType();
             }
 
-            _httpClient = new HttpClient(ResolveHttpMessageHandler(Options));
+            _httpClient = new HttpClient(ResolveHttpMessageHandler(Options)); // CodeQL [SM02185] Enabling certificate revocation would be a breaking change. Customers can enable it.
             _httpClient.Timeout = Options.BackchannelTimeout;
             _httpClient.MaxResponseContentBufferSize = 1024 * 1024 * 10; // 10 MB
         }
@@ -91,7 +91,7 @@ private static HttpMessageHandler ResolveHttpMessageHandler(GoogleOAuth2Authenti
                 {
                     throw new InvalidOperationException(Resources.Exception_ValidatorHandlerMismatch);
                 }
-                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate;
+                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate; // CodeQL [SM03786] False positive, not disabled by default. Used for testing and extensibility.
             }
 
             return handler;

src/Microsoft.Owin.Security.MicrosoftAccount/MicrosoftAccountAuthenticationMiddleware.cs

@@ -61,7 +61,7 @@ public MicrosoftAccountAuthenticationMiddleware(
                 Options.SignInAsAuthenticationType = app.GetDefaultSignInAsAuthenticationType();
             }
 
-            _httpClient = new HttpClient(ResolveHttpMessageHandler(Options));
+            _httpClient = new HttpClient(ResolveHttpMessageHandler(Options)); // CodeQL [SM02185] Enabling certificate revocation would be a breaking change. Customers can enable it.
             _httpClient.Timeout = Options.BackchannelTimeout;
             _httpClient.MaxResponseContentBufferSize = 1024 * 1024 * 10; // 10 MB
         }
@@ -89,7 +89,7 @@ private static HttpMessageHandler ResolveHttpMessageHandler(MicrosoftAccountAuth
                 {
                     throw new InvalidOperationException(Resources.Exception_ValidatorHandlerMismatch);
                 }
-                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate;
+                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate; // CodeQL [SM03786] False positive, not disabled by default. Used for testing and extensibility.
             }
 
             return handler;

src/Microsoft.Owin.Security.OpenIdConnect/OpenIdConnectAuthenticationMiddleware.cs

@@ -69,7 +69,7 @@ public OpenIdConnectAuthenticationMiddleware(OwinMiddleware next, IAppBuilder ap
 
             if (Options.Backchannel == null)
             {
-                Options.Backchannel = new HttpClient(ResolveHttpMessageHandler(Options));
+                Options.Backchannel = new HttpClient(ResolveHttpMessageHandler(Options)); // CodeQL [SM02185] Enabling certificate revocation would be a breaking change. Customers can enable it.
                 Options.Backchannel.DefaultRequestHeaders.UserAgent.ParseAdd("Microsoft ASP.NET Core OpenIdConnect middleware");
                 Options.Backchannel.Timeout = Options.BackchannelTimeout;
                 Options.Backchannel.MaxResponseContentBufferSize = 1024 * 1024 * 10; // 10 MB
@@ -133,7 +133,7 @@ private static HttpMessageHandler ResolveHttpMessageHandler(OpenIdConnectAuthent
                     throw new InvalidOperationException(Resources.Exception_ValidatorHandlerMismatch);
                 }
 
-                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate;
+                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate; // CodeQL [SM03786] False positive, not disabled by default. Used for testing and extensibility.
             }
 
             return handler;

src/Microsoft.Owin.Security.Twitter/TwitterAuthenticationHandler.cs

@@ -359,7 +359,7 @@ private static string GenerateTimeStamp()
 
         private static string ComputeSignature(string consumerSecret, string tokenSecret, string signatureData)
         {
-            using (var algorithm = new HMACSHA1())
+            using (var algorithm = new HMACSHA1()) // CodeQL [SM02200] Required by protocol.
             {
                 algorithm.Key = Encoding.ASCII.GetBytes(
                     string.Format(CultureInfo.InvariantCulture,

src/Microsoft.Owin.Security.Twitter/TwitterAuthenticationMiddleware.cs

@@ -67,7 +67,7 @@ public TwitterAuthenticationMiddleware(
                 Options.SignInAsAuthenticationType = app.GetDefaultSignInAsAuthenticationType();
             }
 
-            _httpClient = new HttpClient(ResolveHttpMessageHandler(Options));
+            _httpClient = new HttpClient(ResolveHttpMessageHandler(Options)); // CodeQL [SM02185] Enabling certificate revocation would be a breaking change. Customers can enable it.
             _httpClient.Timeout = Options.BackchannelTimeout;
             _httpClient.MaxResponseContentBufferSize = 1024 * 1024 * 10; // 10 MB
             _httpClient.DefaultRequestHeaders.Accept.ParseAdd("*/*");
@@ -100,7 +100,7 @@ private static HttpMessageHandler ResolveHttpMessageHandler(TwitterAuthenticatio
             }
             else if (options.BackchannelCertificateValidator != null)
             {
-                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate;
+                webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate; // CodeQL [SM03786] False positive, not disabled by default. Used for testing and extensibility.
             }
 
             return handler;