SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C#

C# static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C# code

  • All rules 493
  • Vulnerability46
  • Bug88
  • Security Hotspot24
  • Code Smell335

  • Quick Fix 61
Filtered: 11 rules found
asp.net
    Impact
      Clean code attribute
        1. Actions that return a value should be annotated with ProducesResponseTypeAttribute containing the return type

           Code Smell
        2. ModelState.IsValid should be called in controller actions

           Code Smell
        3. REST API actions should be annotated with an HTTP verb attribute

           Code Smell
        4. Value type property used as input in a controller action should be nullable, required or annotated with the JsonRequiredAttribute to avoid under-posting.

           Code Smell
        5. You should pool HTTP connections with HttpClientFactory

           Code Smell
        6. API Controllers should derive from ControllerBase instead of Controller

           Code Smell
        7. Controllers should not have mixed responsibilities

           Code Smell
        8. A Route attribute should be added to the controller when a route template is specified at the action level

           Code Smell
        9. Use model binding instead of reading raw request data

           Code Smell
        10. ASP.NET controller actions should not have a route template starting with "/"

           Code Smell
        11. Backslash should be avoided in route templates

           Bug

        Actions that return a value should be annotated with ProducesResponseTypeAttribute containing the return type

        intentionality - clear
        maintainability
        Code Smell
        Quick FixIDE quick fixes available with SonarLint
        • asp.net

        In an ASP.NET Core Web API, controller actions can optionally return a result value. If a controller action returns a value in the happy path, for example ControllerBase.Ok(Object), annotating the action with one of the [ProducesResponseType] overloads that describe the type is recommended.

        Why is this an issue?

        How can I fix it?

        More Info

        If an ASP.NET Core Web API uses Swagger, the API documentation will be generated based on the input/output types of the controller actions, as well as the attributes annotating the actions. If an action returns IActionResult or IResult, Swagger cannot infer the type of the response. From the consumer’s perspective, this can be confusing and lead to unexpected results and bugs in the long run without the API provider’s awareness.

        This rule raises an issue on a controller action when:

        • The action returns a value in the happy path. This can be either:
          • 200 OK
          • 201 Created
          • 202 Accepted
        • There is no [ProducesResponseType] attribute containing the return type, either at controller or action level.
        • There is no [SwaggerResponse] attribute containing the return type, either at controller or action level.
        • The controller is annotated with the [ApiController] attribute.
        • The controller action returns either IActionResult or IResult.
        • The application has enabled the Swagger middleware.
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          10.6
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          10.6

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use