S3257 does not regonize MinimalAPI routing

Rules and Languages Report False-positive / False-negative...
,
1

When defining a MinimalAPI route, S3257 fails to detect that the parameter is used in the route. Therefor is wrongly states that the parameter can be removed.

Obviously, it is strange that nothing is done with a parameter in the route when executing the request, but removing it from the method, breaks the code.

using Microsoft.AspNetCore.Mvc;

namespace Tjip.AspNetCore.ExampleApi.WebFeatures;

internal sealed class MinimalApiHandler
{
    /// <inheritdoc />
    public void Use(WebApplication app)
    {
        app.MapGet("some-route/{id}", ([FromRoute] Guid id) => true); // Compliant
    }
}

Reported by SonarAnalyzer.CSharp v10.20.0.135146

Sonar Community Roundup, March 21 - 27
4

Hi @Corniel,

Thanks for the report — this is indeed a false positive. We plan to fix this by suppressing the diagnostic for any lambda parameter that carries an attribute, with the exception of a few well-known nullable annotation attributes (such as [NotNull], [MaybeNull]) that carry no runtime semantics. We have created an internal reproducer and the fix has been added to our backlog.

8

You might also want to exclude VallidationAttributes. Good luck with improving this rule.

1 Like