C#: Fix cs/web/xss false positive on Razor tag-helper attribute values

[felickz]

Summary

cs/web/xss currently flags RazorPageBase.WriteLiteral(...) calls that the Razor source generator emits for the value of an HTML attribute on an element that also carries a tag helper (for example, asp-for="Model.Something"). This is a false positive: the Razor codegen brackets these calls between BeginWriteTagHelperAttribute() / EndWriteTagHelperAttribute(), buffers the text internally, and HTML-attribute-encodes it before it is ever written to the response. It is not a real XSS sink.

Example

Given a controller action that binds user-provided input to a view model:

[HttpPost]
public IActionResult UpdateProfile(ProfileViewModel model)
{
    if (!ModelState.IsValid)
        return View(model);
    ...
}

and a Razor Pages/MVC view that renders one of its properties through a tag helper attribute:

<input asp-for="DisplayName" type="text" value="@Model.DisplayName" class="textEntry">

cs/web/xss previously reported:

User-provided value flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.Razor.RazorPageBase.WriteLiteral() method.

This is a false positive. The value assigned to the asp-for attribute is captured into an internal string buffer via matching BeginWriteTagHelperAttribute() / EndWriteTagHelperAttribute() calls generated around the WriteLiteral call, and that buffered value is HTML-attribute-encoded before the tag helper's output is rendered, so it never reaches the response unencoded.

Fix

• AspNetCore.qll: add getBeginWriteTagHelperAttributeMethod() / getEndWriteTagHelperAttributeMethod() to MicrosoftAspNetCoreMvcRazorPageBase.
• Html.qll: add isBracketedForTagHelperAttribute() and use it to exclude bracketed WriteLiteral calls from MicrosoftAspNetRazorPageWriteLiteralSink. The predicate requires beginCall, writeLiteral, endCall to appear (in that order) in the same basic block, with no other Begin/EndWriteTagHelperAttribute call in between on either side, and all three calls to share an implicit this receiver, so an unrelated bracket (on this or another page instance) can't "adopt" an unbracketed call.

Test coverage

Added RazorTagHelperAttribute.cshtml / .cshtml.g.cs to the existing Security Features/CWE-079/XSS test, covering:

• A bracketed WriteLiteral(model) (must not alert, suppressed FP).
• An unbracketed WriteLiteral(model) (must alert, positive control).
• Two independent bracket pairs back-to-back in one basic block (must not leak into each other).
• A bare WriteLiteral(model) sandwiched between two unrelated brackets (must still alert).

Full Security Features/CWE-079 suite (6 tests) passes with no regressions. Also validated end-to-end against a small standalone ASP.NET Core Razor Pages reproduction project mirroring the example above: the false positive is no longer reported, while a genuine Html.Raw-based positive control in the same project remains reported.

Change note

Added csharp/ql/lib/change-notes/2026-09-18-razor-tag-helper-attribute-xss-fp.md (category: majorAnalysis).

[Copilot]

Copilot review overview

🟡 Changes recommended

The documentation incorrectly promises downstream HTML encoding instead of stating that the call only writes to a temporary buffer.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Avoid assuming buffered tag-helper values are HTML-attribute-encoded · New
• Correct release note overstating tag-helper encoding guarantees · New

What changed in this PR

Prevents false-positive C# XSS alerts for buffered Razor tag-helper attribute writes.

Changes:

• Models Razor tag-helper attribute buffering methods.
• Excludes correctly bracketed WriteLiteral calls from direct XSS sinks.
• Adds regression fixtures and a change note.

File	Description
Html.qll	Detects buffered WriteLiteral calls.
AspNetCore.qll	Models tag-helper buffering methods.
RazorTagHelperAttribute.cshtml	Provides source-map fixture.
RazorTagHelperAttribute.cshtml.g.cs	Adds generated-code test scenarios.
XSS.expected	Updates expected query results.
Change note	Documents the analysis change.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.