Fixes docs for directoryBrowse enabled examples

[jzabroski]

Fixes #22418

[Copilot]

Pull request overview

Corrects the IIS directoryBrowse attribute documentation for issue #22418.

Changes:

• Replaces enable with enabled in examples and guidance.
• Updates the reference to Microsoft Learn.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
Web.config.good	Corrects the disabled configuration example.
Web.config.bad	Corrects the enabled configuration example.
ASPNetDirectoryListing.qhelp	Updates guidance and reference documentation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jzabroski]

Fix closing tag

[redsun82]

Many thanks!

[github-actions]

QHelp previews:

csharp/ql/src/Security Features/CWE-548/ASPNetDirectoryListing.qhelp

ASP.NET config file enables directory browsing

ASP.NET applications that enable directory browsing can leak sensitive information to an attacker. The precise nature of the vulnerability depends on which files are listed and accessible.

Recommendation

If this configuration may be used in production, remove the directoryBrowse element from the Web.config file or set the value to false.

Example

The following example shows the directoryBrowse enabled attribute set to true in a Web.config file for ASP.NET:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.webServer>
    <directoryBrowse enabled="true"/>
   ...
  </system.webServer>
</configuration>

To fix this problem, the enabled attribute should be set to false, or the directoryBrowse element should be removed completely:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.webServer>
    <directoryBrowse enabled="false"/>
   ...
  </system.webServer>
</configuration>

References

• Microsoft Learn: directoryBrowse element.
• Common Weakness Enumeration: CWE-548.