Skip to content

C#: Add Razor Page handler method parameters as remote flow sources #21984

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
felickz wants to merge 2 commits into
base: main
Choose a base branch
from
+56 −0
Open

C#: Add Razor Page handler method parameters as remote flow sources #21984

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ce9e61d
C#: Add Razor Page handler method parameters as remote flow sources
felickz Jun 12, 2026
23567eb
C#: Add change note for Razor Page handler flow sources
felickz Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions csharp/ql/lib/change-notes/2026-06-12-razor-page-handler-sources.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: majorAnalysis
---
* Added Razor Page handler method parameters (e.g., `OnGet`, `OnPost`, `OnPostAsync`) as remote flow sources, enabling security queries such as `cs/sql-injection` to detect vulnerabilities in `PageModel` subclasses.
17 changes: 17 additions & 0 deletions csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ private import semmle.code.csharp.frameworks.system.web.ui.WebControls
private import semmle.code.csharp.frameworks.WCF
private import semmle.code.csharp.frameworks.microsoft.Owin
private import semmle.code.csharp.frameworks.microsoft.AspNetCore
private import semmle.code.csharp.frameworks.Razor
private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources

Expand Down Expand Up @@ -314,6 +315,22 @@ class AspNetCoreActionMethodParameter extends AspNetCoreRemoteFlowSource, DataFl
override string getSourceType() { result = "ASP.NET Core MVC action method parameter" }
}

/** A parameter to a Razor Page handler method, viewed as a source of remote user input. */
class AspNetCorePageHandlerMethodParameter extends AspNetCoreRemoteFlowSource,
DataFlow::ParameterNode
{
AspNetCorePageHandlerMethodParameter() {
exists(Parameter p |
p = this.getParameter() and
p.fromSource()
|
p = any(PageModelClass pm).getAHandlerMethod().getAParameter()
)
}
Comment thread
felickz marked this conversation as resolved.

override string getSourceType() { result = "ASP.NET Core Razor Page handler method parameter" }
}

private class ExternalRemoteFlowSource extends RemoteFlowSource {
ExternalRemoteFlowSource() { sourceNode(this, "remote") }

Expand Down
28 changes: 28 additions & 0 deletions csharp/ql/test/library-tests/dataflow/flowsources/aspremote/AspRemoteFlowSource.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,4 +63,32 @@ public abstract class AbstractTestController : Controller
{
public void MyActionMethod(string param) { }
}

// Razor Page handler tests
public class MyPageModel : Microsoft.AspNetCore.Mvc.RazorPages.PageModel
{
// BAD: handler method parameters are user-controlled
public void OnGet(string id) { }

public void OnPost(string command, int count) { }

public void OnPostAsync(string data) { }
Comment thread
felickz marked this conversation as resolved.

public void OnPut(string value) { }

public void OnDelete(string itemId) { }

// GOOD: not a handler method (doesn't start with On)
public void GetUser(string userId) { }

// GOOD: marked with NonHandler attribute
[Microsoft.AspNetCore.Mvc.RazorPages.NonHandlerAttribute]
public void OnGetNonHandler(string param) { }
}

// Subclass of a PageModel subclass
public class DerivedPageModel : MyPageModel
{
public void OnPost(string derivedParam) { }
}
}
7 changes: 7 additions & 0 deletions csharp/ql/test/library-tests/dataflow/flowsources/aspremote/aspRemoteFlowSource.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,3 +14,10 @@ remoteFlowSources
| AspRemoteFlowSource.cs:54:69:54:82 | mapDeleteParam |
| AspRemoteFlowSource.cs:56:41:56:44 | item |
| AspRemoteFlowSource.cs:64:43:64:47 | param |
| AspRemoteFlowSource.cs:71:34:71:35 | id |
| AspRemoteFlowSource.cs:73:35:73:41 | command |
| AspRemoteFlowSource.cs:73:48:73:52 | count |
| AspRemoteFlowSource.cs:75:40:75:43 | data |
| AspRemoteFlowSource.cs:77:34:77:38 | value |
| AspRemoteFlowSource.cs:79:37:79:42 | itemId |
| AspRemoteFlowSource.cs:92:35:92:46 | derivedParam |
Loading