False positive Java. SpringBoot CSRF

首先定位名为 "Disabled Spring CSRF protection" 的 CodeQL 查询，并检查它如何识别 Spring Security 配置。然后复现所提供的 stateless JWT/OIDC resource-server 示例，接着验证对于此配置，禁用 CSRF 不再触发该查询，同时报告的情况仍然被覆盖。

Description of the false positive

Given a SpringBoot application that acts solely as an API/OIDC Resource Server and does not utilize cookies or state, where CSRF is disabled, the CodeQL / Disabled Spring CSRF protection should not be triggered.

Code samples or links to source code

  @Bean
  SecurityFilterChain securityFilterChain(
      final HttpSecurity http,
      final String privateScope,
      final AppUserPrincipalJwtAuthenticationConverter appUserPrincipalJwtAuthenticationConverter) {
    http.formLogin(AbstractHttpConfigurer::disable)
        .httpBasic(AbstractHttpConfigurer::disable)
        .csrf(AbstractHttpConfigurer::disable) // NOSONAR stateless JWT, no CSRF cookies
        .logout(AbstractHttpConfigurer::disable)
        .sessionManagement(
            session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .authorizeHttpRequests(
            authorize ->
                authorize
                    .dispatcherTypeMatchers(DispatcherType.ERROR, DispatcherType.FORWARD)
                    .permitAll()
                    .requestMatchers(RuntimeEndpointPaths.unauthenticatedPaths())
                    .permitAll()
                    .requestMatchers(
                        new RegexRequestMatcher(
                            RuntimeEndpointPaths.versionedInternalRouteRegex(), null))
                    .access(interactiveUserAuthorizationManager())
                    .requestMatchers(
                        new RegexRequestMatcher(
                            RuntimeEndpointPaths.versionedPrivateRouteRegex(), null))
                    .access(
                        callerTypeAuthorizationManager(
                            OidcCallerType.CLIENT_CREDENTIALS, privateScope))
                    .anyRequest()
                    .authenticated())
        .oauth2ResourceServer(
            oauth2 ->
                oauth2.jwt(
                    jwt ->
                        jwt.jwtAuthenticationConverter(
                            appUserPrincipalJwtAuthenticationConverter)));
    return http.build();
  }