.NET: Annotate DevUI aggregator static-analysis false positives - #7864
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b1089839-7a12-4a45-b492-1a984e702bd5
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b1089839-7a12-4a45-b492-1a984e702bd5
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (2 commit(s)): a9692d81242f, 8d95f8256ab7
Model: gpt-5.6-sol
Overview
This PR only adds and relocates CodeQL suppression comments without changing executable behavior. The redirect remains relative and same-origin, while proxy requests are guarded by fail-closed host, scheme, and port validation with automatic redirects disabled. Existing source and proxy tests support the suppression rationale, and no publishable runtime, architectural, or security defect was established.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
There was a problem hiding this comment.
Pull request overview
Annotates two DevUI static-analysis false positives without changing runtime behavior.
Changes:
- Adds justification for the trailing-slash redirect.
- Repositions and reformats the proxy suppression.
Suppressed comments (1)
dotnet/src/Aspire.Hosting.AgentFramework.DevUI/DevUIAggregatorHostedService.cs:730
- This standalone comment covers only line 729, while the reported
SendAsyncexpression is now on line 730. CodeQL's C# alert-suppression query scopes the annotation to the comment's source line, so moving it above the call still leaves SM03781 unsuppressed. Keep the collapsed call, but put the annotation after that statement so it overlaps the finding.
// CodeQL [SM03781] False positive: ValidateProxyTarget confirms the target host, scheme, and port match the configured backend, so the user-supplied path and query cannot change the destination.
using var response = await client.SendAsync(request, completionOption, context.RequestAborted).ConfigureAwait(false);
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Motivation & Context
Static analysis reports two findings in the Aspire DevUI aggregator that are false positives — the existing guards already constrain both destinations, but the analyzer does not model them. This records the reasoning inline, using the repo's existing suppression pattern, so the alerts stop adding noise.
Description & Review Guide
Related Issue
No tracking issue; small static-analysis triage follow-up to #6771 and #7505. No other open PR covers these findings.
Contribution Checklist
breaking changelabel (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.