Skip to content

BSL180 — Disable safe mode

← All rules

Summary

Disable safe mode

Identifiers

Field Value
Rule code BSL180
Compatible alias DisableSafeMode
Severity WARNING
Enabled by default Yes
Implemented Yes
Tags security

Behavior

  • The public identifier BSL180 and alias DisableSafeMode are stable.
  • The rule reports the cases documented on this page.
  • Suppressions and project configuration are applied before publication.
  • The rule requires neither an external analyzer nor network access.

Configuration and suppression

BSL### is the primary stable identifier. The compatible alias is accepted in select, ignore, and compatible block suppression comments.

[tool.onec-hbk-bsl]
select = ["BSL180"]
ignore = ["DisableSafeMode"]

All three suppression families support both a current line and a range. When an opening comment follows code, it affects only that line. Use any one form:

  • noqa:
Value = "example";  // noqa: BSL180
  • bsl-disable:
Value = "example";  // bsl-disable: BSL180
  • compatible BSLLS form:
Value = "example";  // BSLLS:DisableSafeMode-off

When the same opening comment is on a line by itself, it starts a range. Close it with the matching marker from the same family:

// noqa: BSL180
// code without this diagnostic
// noqa-enable: BSL180

// bsl-disable: BSL180
// code without this diagnostic
// bsl-enable: BSL180

// BSLLS:DisableSafeMode-off
// code without this diagnostic
// BSLLS:DisableSafeMode-on

To disable the rule until the end of the file, omit the closing noqa-enable, bsl-enable, or BSLLS:…-on marker.

Opening and closing markers must belong to the same family.

Description

In addition to configuration code, the application solution can execute third-party program code, which can be connected in various ways (external reports and data processing, extensions, external components, etc.). The developer cannot guarantee the reliability of this code. An attacker can include various destructive actions in it that can harm user computers, servers, and data in the program.

The listed security problems are especially critical when operating configurations in the service model, because Having gained access to the service, malicious code can immediately gain access to all applications of all users of the service.

It is important to control the execution of such external code in safe mode, in exceptional cases (after verification) allowing code to be executed in unsafe mode.

The rule diagnoses calls to the methods SetSafeMode and SetDisableSafeMode in the mode of disabling safe mode control - Method call SetDisableSafeMode(true) is ignored - Method call SetDisableSafeMode(false) is ignored

Examples

    SetSafeMode (False); // is error

    Value = False;
    SetSafeMode(Value); // is error

    SetSafeMode (True); // no error

    SetDisableSafeMode(True); //  is error

    Value = True;
    SetDisableSafeMode(Value); //  is error

    SetDisableSafeMode(False); // no error

Sources