dotnet / dotnet/aspnetcore

ASP0018 analyzer does not respect complex model binding

Open
#54,212 4 comments 18 reactions 1 assignee Claimed by @Rick-Anderson View on GitHub
analyzer area-mvc
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

When binding a route parameter to a complex type using the `[FromRoute]` attribute, the ASP0018 analyzer claims a parameter is unused.

### Expected Behavior

The ASP0018 analyzer should only generate messages if a parameter is actually unused. If the analyzer is unable to determine if a parameter is bound to a complex type, it should either a) not generate the message on actions with complex type parameters, or b) [be documented](https://learn.microsoft.com/en-us/aspnet/core/diagnostics/asp0018?view=aspnetcore-8.0#when-to-suppress-warnings) that this is unsupported.

### Steps To Reproduce

Sample repro [available here](https://github.com/whyareyoudoingthis/asp0018-unused-parameter).

In short:
1. Add an action method that accepts a parameter with a model type annotated with `[FromRoute]` attributes
2. Add an appropriately named optional route parameter to the route template (to match the `[FromRoute]` attribute in the type)
3. Build and run the project. ASP.NET will correctly bind the parameter from the route, but `ASP0018` will still be generated on build

### Exceptions (if any)

_No response_

### .NET Version

8.0.200

### Anything else?

ASP.NET Core 8 in Visual Studio 2022.

dotnet --info output

```
.NET SDK:
Version: 8.0.200
Commit: 438cab6a9d
Workload version: 8.0.200-manifests.e575128c

Runtime Environment:
OS Name: Windows
OS Version: 10.0.19045
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\8.0.200\

.NET workloads installed:
There are no installed workloads to display.

Host:
Version: 8.0.2
Architecture: x64
Commit: 1381d5ebd2

.NET SDKs installed:
[...]
8.0.100 [C:\Program Files\dotnet\sdk]
8.0.200 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
[...]
Microsoft.AspNetCore.App 8.0.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
[...]
Microsoft.NETCore.App 8.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
[...]
Microsoft.WindowsDesktop.App 8.0.0 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.2 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
arm64 [C:\Program Files\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\arm64\InstallLocation]
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
Not set

global.json file:
C:\Users\\Source\Samples\analyzer-unused-parameter\global.json
```

I have checked that this same behaviour also applies when using other binding sources (I first observed this when using a `CompositeBindingSource` to bind to both the path and query).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.