C#: ControllerBase should still be considered a controller as we need Redirect methods to be considered sinks.

michaelnebel · michaelnebel · commit 29639a0ad51d · 2022-09-26T14:55:29.000+02:00
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll
@@ -205,7 +205,7 @@ class MicrosoftAspNetCoreMvcController extends Class {
       )
     ) and
     this.isPublic() and
-    not this.isAbstract() and
+    (not this.isAbstract() or this instanceof MicrosoftAspNetCoreMvcControllerBaseClass) and
     not this instanceof Generic and
     (
       this.getABaseType*() instanceof MicrosoftAspNetCoreMvcControllerBaseClass

Original file line number	Diff line number	Diff line change
`@@ -205,7 +205,7 @@ class MicrosoftAspNetCoreMvcController extends Class {`
`205`	`205`	`)`
`206`	`206`	`) and`
`207`	`207`	`this.isPublic() and`
`208`		`- not this.isAbstract() and`
	`208`	`+ (not this.isAbstract() or this instanceof MicrosoftAspNetCoreMvcControllerBaseClass) and`
`209`	`209`	`not this instanceof Generic and`
`210`	`210`	`(`
`211`	`211`	`this.getABaseType*() instanceof MicrosoftAspNetCoreMvcControllerBaseClass`