Summary

ASP.NET Core Razor Page handler method parameters (OnGet, OnPost, etc.) were not modeled as remote flow sources, causing security queries like SQL injection to miss vulnerabilities in PageModel subclasses.

What we now detect as sources

public class MyPageModel : PageModel
{
    // ✅ All handler method parameters are now recognized as remote flow sources
    public void OnGet(string id) { }
    public void OnPost(string command, int count) { }
    public async Task OnPostAsync(string data) { }
    public void OnPut(string value) { }
    public void OnDelete(string itemId) { }

    // ✅ Works through PageModel inheritance chains
    public class DerivedPage : MyPageModel
    {
        public void OnPost(string derivedParam) { }
    }

    // ❌ Regular methods are correctly excluded
    public void GetUser(string userId) { }

    // ❌ [NonHandler] attribute is respected
    [NonHandler]
    public void OnGetExcluded(string param) { }
}

Problem

AspNetCoreActionMethodParameter in Remote.qll only covers MicrosoftAspNetCoreMvcController.getAnActionMethod().getAParameter() — MVC controllers only. Razor Pages extend PageModel, not a controller, so handler method parameters like OnPost([FromForm] string command) were invisible to taint tracking.

This was discovered when a known SQL injection vulnerability in a Razor Page was not detected by cs/sql-injection.

Fix

Adds AspNetCorePageHandlerMethodParameter, analogous to AspNetCoreActionMethodParameter, using the existing PageModelClass.getAHandlerMethod() from Razor.qll. This properly handles:

• All HTTP verb handlers (OnGet, OnPost, OnPut, OnDelete, etc.) and async variants
• Subtypes of PageModel (including derived classes)
• [NonHandler] exclusions (via the existing getAHandlerMethod() predicate)

Testing

• Added positive test cases for OnGet, OnPost, OnPostAsync, OnPut, OnDelete handler parameters
• Added negative test cases for non-handler methods and [NonHandler]-attributed methods
• Added subtype test (DerivedPageModel extending MyPageModel)
• Existing aspremote and remote flow source tests pass with no regressions