github / github/codeql

FP in C# XSS Sink

Open
#13,707 0 comments 0 reactions 0 assignees View on GitHub
acknowledged C# false-positive
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

**Description of the false positive**

Use of asp-route-{parameter} in cshtml documents are url encoded, preventing breakout from string and thus preventing XSS despite the use of WriteLiteral in the compiled code.

**Code samples or links to source code**
```csharp


```

[MRVA Result](https://gist.githubusercontent.com/Kwstubbs/6e2307d324ceb6c3b4a8c50f9cb798ff/raw/1275c04dea523d6176ad8707820790e35d3aa4b4/result-2-AiursoftWeb-Infrastructures.md)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.