C#: Model MVC fallback controller mappings

Author: JarLob

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/Controllers.expected

@@ -1,5 +1,7 @@
-| AttributePocoController.cs | AttributePocoController |
-| GeneratedController.cs     | GeneratedController     |
-| IncludedController.cs      | IncludedController      |
-| StructuralController.cs    | StructuralController    |
-| WebPocoController.cs       | WebPocoController       |
+| AdminAreaFallbackController.cs | AreaFallbackController  |
+| AttributePocoController.cs     | AttributePocoController |
+| FallbackOnlyController.cs      | FallbackOnlyController  |
+| GeneratedController.cs         | GeneratedController     |
+| IncludedController.cs          | IncludedController      |
+| StructuralController.cs        | StructuralController    |
+| WebPocoController.cs           | WebPocoController       |

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/AdminAreaFallbackController.cs

@@ -0,0 +1,9 @@
+using Microsoft.AspNetCore.Mvc;
+
+namespace AdminArea;
+
+[Area("Admin")]
+public class AreaFallbackController
+{
+    public void Index(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/FallbackOnlyController.cs

@@ -0,0 +1,4 @@
+public class FallbackOnlyController
+{
+    public void Index(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/OtherAreaFallbackController.cs

@@ -0,0 +1,9 @@
+using Microsoft.AspNetCore.Mvc;
+
+namespace OtherArea;
+
+[Area("Other")]
+public class AreaFallbackController
+{
+    public void Index(string input) => _ = GetType().Name + input;
+}

csharp/ql/integration-tests/all-platforms/aspnetcore_controller_discovery/UnmappedWebApp/Program.cs

@@ -5,4 +5,6 @@
 builder.Services.AddControllers();
 
 var app = builder.Build();
-app.Run();
+app.MapFallbackToController("Index", "FallbackOnly");
+app.MapFallbackToAreaController("admin/{*path:nonfile}", "Index", "AreaFallback", "Admin");
+app.Run();

csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll

@@ -327,6 +327,26 @@ private predicate isMicrosoftAspNetCoreMvcAttributeEndpointMapping(MethodCall ca
   not exists(call.getArgumentForName("configureRoutes"))
 }
 
+private predicate isMicrosoftAspNetCoreMvcFallbackEndpointMapping(MethodCall call, Class controller) {
+  call.getTarget()
+      .hasFullyQualifiedName("Microsoft.AspNetCore.Builder",
+        "ControllerEndpointRouteBuilderExtensions",
+        ["MapFallbackToAreaController", "MapFallbackToController"]) and
+  call.getArgumentForName("controller").getValue().toLowerCase() + "controller" =
+    controller.getName().toLowerCase() and
+  (
+    call.getTarget().hasName("MapFallbackToController")
+    or
+    call.getTarget().hasName("MapFallbackToAreaController") and
+    exists(Attribute area |
+      area = controller.getABaseType*().getAnAttribute() and
+      area.getType().hasFullyQualifiedName("Microsoft.AspNetCore.Mvc", "AreaAttribute") and
+      area.getArgument(0).getValue().toLowerCase() =
+        call.getArgumentForName("area").getValue().toLowerCase()
+    )
+  )
+}
+
 private predicate hasMicrosoftAspNetCoreMvcEndpointMapping(Compilation application, Class controller) {
   isInMicrosoftAspNetCoreMvcApplication(controller, application) and
   exists(MethodCall mapping |
@@ -336,6 +356,8 @@ private predicate hasMicrosoftAspNetCoreMvcEndpointMapping(Compilation applicati
       or
       isMicrosoftAspNetCoreMvcAttributeEndpointMapping(mapping) and
       hasMicrosoftAspNetCoreMvcAttributeRoute(controller)
+      or
+      isMicrosoftAspNetCoreMvcFallbackEndpointMapping(mapping, controller)
     )
   )
 }