S2325 incorrectly advises Global.asax.cs Application_XXX methods be made static

csharp

(Paul Hickman) #1

Version 7.5.0.6605

In the Global.asax.cs file of an MVC application, rule S2325 advises that methods such as Application_Start that are entry points for ASP.Net be made static in they reference no member variables. However, if you do this, they cease to work.

This also applies to methods added to support3rd party libraries such as NWebSec that follow the same pattern of adding additional entry points to global.asax.cs - e.g.

Could this rule be updated to not apply to global.asax.cs files, or do at least not apply to the built-in Application_XXX methods if that is deemed too generic.

namespace MyApp
{
    public class MvcApplication : System.Web.HttpApplication
    {
        protected void Application_Start()
        {
            RouteConfig.RegisterRoutes(RouteTable.Routes);
        }
		
        protected void NWebSecHttpHeaderSecurityModule_CspViolationReported(object sender, CspViolationReportEventArgs e)
        {
            CspReporting.Report(e,typeof(MvcApplication).Assembly.FullName);
        }
    }
}

(Valeri Hristov) #2

Hi Paul, you are right, the methods in global.asax should be excluded from reporting by S2325. I created a new ticket for this issue: https://github.com/SonarSource/sonar-csharp/issues/1839