C#: Improve ASP.NET Core MVC controller discovery

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/AttributeWebApp/AttributePocoController.cs

@@ -0,0 +1,8 @@
+using Microsoft.AspNetCore.Mvc;
+
+[Route("api/attribute")]
+public class AttributePocoController
+{
+    [HttpGet]
+    public void Action(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/AttributeWebApp/AttributeWebApp.csproj

@@ -0,0 +1,5 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+</Project>

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/AttributeWebApp/ConventionOnlyController.cs

@@ -0,0 +1,4 @@
+public class ConventionOnlyController
+{
+    public void Action(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/AttributeWebApp/Program.cs

@@ -0,0 +1,9 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.DependencyInjection;
+
+var builder = WebApplication.CreateBuilder(args);
+builder.Services.AddControllers();
+
+var app = builder.Build();
+app.MapControllers();
+app.Run();

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/Controllers.expected

@@ -0,0 +1,7 @@
+| AdminAreaFallbackController.cs | AreaFallbackController |
+| AttributePocoController.cs | AttributePocoController |
+| FallbackOnlyController.cs | FallbackOnlyController |
+| GeneratedController.cs | GeneratedController |
+| IncludedController.cs | IncludedController |
+| StructuralController.cs | StructuralController |
+| WebPocoController.cs | WebPocoController |

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/Controllers.ql

@@ -0,0 +1,6 @@
+import csharp
+import semmle.code.csharp.frameworks.microsoft.AspNetCore
+
+from MicrosoftAspNetCoreMvcController controller
+where controller.fromSource()
+select controller.getFile().getBaseName(), controller.getName()

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/GeneratedControllers/GeneratedController.cs

@@ -0,0 +1,6 @@
+namespace GeneratedControllers;
+
+public class GeneratedController
+{
+    public void Action(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/GeneratedControllers/GeneratedControllers.csproj

@@ -0,0 +1,5 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+</Project>

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/IncludedControllers/IncludedController.cs

@@ -0,0 +1,6 @@
+namespace IncludedControllers;
+
+public class IncludedController
+{
+    public void Action(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/IncludedControllers/IncludedControllers.csproj

@@ -0,0 +1,5 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+</Project>

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/AdminAreaFallbackController.cs

@@ -0,0 +1,9 @@
+using Microsoft.AspNetCore.Mvc;
+
+namespace AdminArea;
+
+[Area("Admin")]
+public class AreaFallbackController
+{
+    public void Index(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/FallbackOnlyController.cs

@@ -0,0 +1,4 @@
+public class FallbackOnlyController
+{
+    public void Index(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/OtherAreaFallbackController.cs

@@ -0,0 +1,9 @@
+using Microsoft.AspNetCore.Mvc;
+
+namespace OtherArea;
+
+[Area("Other")]
+public class AreaFallbackController
+{
+    public void Index(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/Program.cs

@@ -0,0 +1,10 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.DependencyInjection;
+
+var builder = WebApplication.CreateBuilder(args);
+builder.Services.AddControllers();
+
+var app = builder.Build();
+app.MapFallbackToController("Index", "FallbackOnly");
+app.MapFallbackToAreaController("admin/{*path:nonfile}", "Index", "AreaFallback", "Admin");
+app.Run();

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/StructuralController.cs

@@ -0,0 +1,6 @@
+using Microsoft.AspNetCore.Mvc;
+
+public class StructuralController : ControllerBase
+{
+    public void Action(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/UnmappedPocoController.cs

@@ -0,0 +1,4 @@
+public class UnmappedPocoController
+{
+    public void Action(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/UnmappedWebApp.csproj

@@ -0,0 +1,5 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+</Project>

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/Unrelated/ThrottlingController.cs

@@ -0,0 +1,4 @@
+public class ThrottlingController
+{
+    public void Initialize(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/Unrelated/Unrelated.csproj

@@ -0,0 +1,5 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+</Project>

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/WebApp/ApplicationParts.cs

@@ -0,0 +1,3 @@
+using Microsoft.AspNetCore.Mvc.ApplicationParts;
+
+[assembly: ApplicationPart("GeneratedControllers")]

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/WebApp/Program.cs

@@ -0,0 +1,12 @@
+using IncludedControllers;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.DependencyInjection;
+
+var builder = WebApplication.CreateBuilder(args);
+builder.Services
+    .AddControllers()
+    .AddApplicationPart(typeof(IncludedController).Assembly);
+
+var app = builder.Build();
+app.MapControllerRoute("default", "{controller}/{action}");
+app.Run();

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/WebApp/WebApp.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="../GeneratedControllers/GeneratedControllers.csproj" />
+    <ProjectReference Include="../IncludedControllers/IncludedControllers.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/WebApp/WebPocoController.cs

@@ -0,0 +1,4 @@
+public class WebPocoController
+{
+    public void Action(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/global.json

@@ -0,0 +1,5 @@
+{
+  "sdk": {
+    "version": "10.0.201"
+  }
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/test.py

@@ -0,0 +1,9 @@
+def test(codeql, csharp):
+    codeql.database.create(
+        command=[
+            "dotnet build -t:Rebuild WebApp/WebApp.csproj",
+            "dotnet build -t:Rebuild AttributeWebApp/AttributeWebApp.csproj",
+            "dotnet build -t:Rebuild UnmappedWebApp/UnmappedWebApp.csproj",
+            "dotnet build -t:Rebuild Unrelated/Unrelated.csproj",
+        ]
+    )

csharp/ql/lib/change-notes/2026-07-31-aspnet-core-controller-discovery.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Improved ASP.NET Core MVC controller and action discovery to more closely match runtime behavior, including application parts, endpoint mappings, inherited actions, and controller and action exclusions. Service-injected action parameters are no longer modeled as remote input.