Extend aspnetcore controller definition

JarLob · michaelnebel · commit 105462a1fc73 · 2022-09-26T14:55:27.000+02:00
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll
@@ -62,6 +62,14 @@ class MicrosoftAspNetCoreMvcNonActionAttribute extends MicrosoftAspNetCoreMvcAtt
   MicrosoftAspNetCoreMvcNonActionAttribute() { this.getType().hasName("NonActionAttribute") }
 }
 
+class MicrosoftAspNetCoreMvcNonControllerAttribute extends MicrosoftAspNetCoreMvcAttribute {
+  MicrosoftAspNetCoreMvcNonControllerAttribute() { getType().hasName("NonControllerAttribute") }
+}
+
+class MicrosoftAspNetCoreMvcControllerAttribute extends MicrosoftAspNetCoreMvcAttribute {
+  MicrosoftAspNetCoreMvcControllerAttribute() { getType().hasName("ControllerAttribute") }
+}
+
 /** The `Microsoft.AspNetCore.Antiforgery` namespace. */
 class MicrosoftAspNetCoreAntiforgeryNamespace extends Namespace {
   MicrosoftAspNetCoreAntiforgeryNamespace() {
@@ -185,7 +193,12 @@ class MicrosoftAspNetCoreMvcControllerBaseClass extends Class {
 /** A subtype of `Microsoft.AspNetCore.Mvc.Controller` or `Microsoft.AspNetCore.Mvc.ControllerBase`. */
 class MicrosoftAspNetCoreMvcController extends Class {
   MicrosoftAspNetCoreMvcController() {
-    this.getABaseType*() instanceof MicrosoftAspNetCoreMvcControllerBaseClass
+    (
+      getABaseType*() instanceof MicrosoftAspNetCoreMvcControllerBaseClass or
+      getABaseType*().hasName("%Controller") or
+      getABaseType*().getAnAttribute() instanceof MicrosoftAspNetCoreMvcControllerAttribute
+    ) and
+    not getABaseType*().getAnAttribute() instanceof MicrosoftAspNetCoreMvcNonControllerAttribute
   }
 
   /** Gets an action method for this controller. */
