github / github/codeql

False positive: "Missing function level access control" where public endpoint name contains "Edit"

Open
#21,042 1 comment 0 reactions 0 assignees View on GitHub
C# false-positive
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

**Description of the false positive**

We have a .NET 8 Api.

We have a controller method that has the characters 'Edit' in it, but the whole word is not Edit. This causes the method to be marked with the rule cs/web/missing-function-level-access-control. The method even has the 'AllowAnonymous' attribute on it.

**Code samples or links to source code**

```
[AllowAnonymous]
public async Task TestEditionAsync(){

}
```

Is there a way to get this alert resolved?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.