CodeQL Suppression for DefaultAzureCredential usage (#3233)

souvikghosh04 · web-flow · commit 25270b197ce9 · 2026-03-12T05:54:44.000Z
## Why make this change? - Closes on #3232 - This PR addresses a CodeQL false positive regarding - the usage of `DefaultAzureCredential()` - Reference documentation: - https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/codeql/codeql-semmle - [CodeQL suppression syntax](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#suppressing-or-resolving-alerts) - [DefaultAzureCredential documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.defaultazurecredential) - https://liquid.microsoft.com/Web/Object/Read/Campaign.Requirements/Requirements/SSIRP.floss ## What is this change? - Suppresses the CodeQL warnings: - Adds a suppression rule to the relevant file - No logic or runtime code is changed; this is a configuration only update to streamline code analysis. ## How was this tested? - [x] Integration Tests - [x] Unit Tests The change will be validated by running the full test suite and triggering a CodeQL analysis to confirm the warning is suppressed and no new issues are introduced as part of a next build. ## Sample Request(s) - NA
diff --git a/src/Service/Startup.cs b/src/Service/Startup.cs
@@ -521,7 +521,7 @@ private static async Task<IConnectionMultiplexer> CreateConnectionMultiplexerAsy
 
             if (ShouldUseEntraAuthForRedis(options))
             {
-                options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());
+                options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential()); // CodeQL [SM05137] DefaultAzureCredential will use Managed Identity if available or fallback to default.
             }
 
             return await ConnectionMultiplexer.ConnectAsync(options);

Original file line number	Diff line number	Diff line change
`@@ -521,7 +521,7 @@ private static async Task<IConnectionMultiplexer> CreateConnectionMultiplexerAsy`
`521`	`521`
`522`	`522`	`if (ShouldUseEntraAuthForRedis(options))`
`523`	`523`	`{`
`524`		`- options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());`
	`524`	`+ options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential()); // CodeQL [SM05137] DefaultAzureCredential will use Managed Identity if available or fallback to default.`
`525`	`525`	`}`
`526`	`526`
`527`	`527`	`return await ConnectionMultiplexer.ConnectAsync(options);`