SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C#

C# static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C# code

  • All rules 493
  • Vulnerability46
  • Bug88
  • Security Hotspot24
  • Code Smell335

  • Quick Fix 61
Filtered: 11 rules found
asp.net
    Impact
      Clean code attribute
        1. Actions that return a value should be annotated with ProducesResponseTypeAttribute containing the return type

           Code Smell
        2. ModelState.IsValid should be called in controller actions

           Code Smell
        3. REST API actions should be annotated with an HTTP verb attribute

           Code Smell
        4. Value type property used as input in a controller action should be nullable, required or annotated with the JsonRequiredAttribute to avoid under-posting.

           Code Smell
        5. You should pool HTTP connections with HttpClientFactory

           Code Smell
        6. API Controllers should derive from ControllerBase instead of Controller

           Code Smell
        7. Controllers should not have mixed responsibilities

           Code Smell
        8. A Route attribute should be added to the controller when a route template is specified at the action level

           Code Smell
        9. Use model binding instead of reading raw request data

           Code Smell
        10. ASP.NET controller actions should not have a route template starting with "/"

           Code Smell
        11. Backslash should be avoided in route templates

           Bug

        A Route attribute should be added to the controller when a route template is specified at the action level

        intentionality - clear
        maintainability
        Code Smell
        Quick FixIDE quick fixes available with SonarLint
        • asp.net

        When a route template is defined through an attribute on an action method, conventional routing for that action is disabled. To maintain good practice, it’s recommended not to combine conventional and attribute-based routing within a single controller to avoid unpredicted behavior. As such, the controller should exclude itself from conventional routing by applying a [Route] attribute.

        Why is this an issue?

        How can I fix it?

        More Info

        In ASP.NET Core MVC, the routing middleware utilizes a series of rules and conventions to identify the appropriate controller and action method to handle a specific HTTP request. This process, known as conventional routing, is generally established using the MapControllerRoute method. This method is typically configured in one central location for all controllers during the application setup.

        Conversely, attribute routing allows routes to be defined at the controller or action method level. It is possible to mix both mechanisms. Although it’s permissible to employ diverse routing strategies across multiple controllers, combining both mechanisms within one controller can result in confusion and increased complexity, as illustrated below.

        // Conventional mapping definition
        app.MapControllerRoute(
            name: "default",
            pattern: "{controller=Home}/{action=Index}/{id?}");
        
        public class PersonController
        {
            // Conventional routing:
            // Matches e.g. /Person/Index/123
            public IActionResult Index(int? id) => View();
        
            // Attribute routing:
            // Matches e.g. /Age/Ascending (and model binds "Age" to sortBy and "Ascending" to direction)
            // but does not match /Person/List/Age/Ascending
            [HttpGet(template: "{sortBy}/{direction}")]
            public IActionResult List(string sortBy, SortOrder direction) => View();
        }
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          10.5
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          10.5

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use