Restrict Append calls to string arguments

Author: joefarebrother

csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.ql

@@ -82,7 +82,8 @@ predicate nonHttpOnlyCookieCall(Call c) {
         or
         // IResponseCookies.Append(String, String) was called, `HttpOnly` is set to `false` by default
         mc = c and
-        mc.getNumberOfArguments() < 3
+        mc.getNumberOfArguments() < 3 and
+        mc.getTarget().getParameter(0).getType() instanceof StringType
       )
     )
     or

csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql

@@ -57,7 +57,8 @@ predicate insecureCookieAppend(Expr sink) {
   exists(MethodCall mc, MicrosoftAspNetCoreHttpResponseCookies iResponse |
     mc = sink and
     iResponse.getAppendMethod() = mc.getTarget() and
-    mc.getNumberOfArguments() < 3
+    mc.getNumberOfArguments() < 3 and
+    mc.getTarget().getParameter(0).getType() instanceof StringType
   )
 }