SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C#

C# static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C# code

  • All rules 493
  • Vulnerability46
  • Bug88
  • Security Hotspot24
  • Code Smell335

  • Quick Fix 61
Filtered: 11 rules found
asp.net
    Impact
      Clean code attribute
        1. Actions that return a value should be annotated with ProducesResponseTypeAttribute containing the return type

           Code Smell
        2. ModelState.IsValid should be called in controller actions

           Code Smell
        3. REST API actions should be annotated with an HTTP verb attribute

           Code Smell
        4. Value type property used as input in a controller action should be nullable, required or annotated with the JsonRequiredAttribute to avoid under-posting.

           Code Smell
        5. You should pool HTTP connections with HttpClientFactory

           Code Smell
        6. API Controllers should derive from ControllerBase instead of Controller

           Code Smell
        7. Controllers should not have mixed responsibilities

           Code Smell
        8. A Route attribute should be added to the controller when a route template is specified at the action level

           Code Smell
        9. Use model binding instead of reading raw request data

           Code Smell
        10. ASP.NET controller actions should not have a route template starting with "/"

           Code Smell
        11. Backslash should be avoided in route templates

           Bug

        ASP.NET controller actions should not have a route template starting with "/"

        intentionality - clear
        maintainability
        Code Smell
        Quick FixIDE quick fixes available with SonarLint
        • asp.net

        Route templates for ASP.NET controller actions, defined via a RouteAttribute or any derivation of HttpMethodAttribute, should not start with "/".

        Why is this an issue?

        How can I fix it?

        More Info

        Routing in ASP.NET Core MVC maps controllers and actions to paths in request URIs. Similar routing happens in ASP.NET Framework MVC.

        In ASP.NET Core MVC, when an action defines a route template starting with a "/", the route is considered absolute and the action is registered at the root of the web application.

        In such a scenario, any route defined at the controller level is disregarded, as shown in the following example:

        [Route("[controller]")]  // This route is ignored for the routing of Index1 and Index2
        public class HomeController : Controller
        {
            [HttpGet("/Index1")] // This action is mapped to the root of the web application
            public ActionResult Index1() => View();
        
            [Route("/Index2")]   // The same applies here
            public ActionResult Index2() => View();
        }
        

        The behavior can be found confusing and surprising because any relative action route is relativized to the controller route.

        Therefore, in the vast majority of scenarios, controllers group all related actions not only in the source code, but also at the routing level.

        In ASP.NET Framework MVC with attribute routing enabled via MapMvcAttributeRoutes, the mere presence of an absolute route at the action level will produce an InvalidOperationException at runtime.

        It is then a good practice to avoid absolute routing at the action level and move the "/" to the root level, changing the template defined in the RouteAttribute of the controller appropriately.

        Exceptions

        The rule only applies when all route templates of all actions of the controller start with "/". Sometimes some actions may have both relative and absolute route templates, for example for backward compatibility reasons (i.e. a former route needs to be preserved). In such scenarios, it may make sense to keep the absolute route template at the action level.

          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          10.5
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          10.5

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use