False positive: "Missing cross-site request forgery token validation" does not recognize [RequireAntiforgeryToken]

[daiplusplus]

Description of the false positive

ASP.NET Core 8 introduced [RequireAntiforgeryToken] (aka Microsoft.AspNetCore.Antiforgery.RequireAntiforgeryTokenAttribute with IAntiforgeryMetadata) which is identified by the built-in Anti-Forgery Middleware (see Microsoft.AspNetCore.Builder.AntiforgeryApplicationBuilderExtensions.UseAntiforgery); I understand this new attribute is meant to replace the older ValidateAntiforgeryTokenAttribute.

However, the current CodeQL rule is hardcoded to detect only ValidateAntiForgeryTokenAttribute or ValidateAntiForgeryAttribute - so it does not recognise RequireAntiforgeryTokenAttribute, and so raises false-positives.

Example:

using Microsoft.AspNetCore.Antiforgery;

public class MyController : ControllerBase
{
    [HttpPost( "/foo" )]
    [RequireAntiforgeryToken]
    public IActionResult DoSomething()
    {
        return this.Ok();
    }
}