diff --git a/analyzers/its/expected/ManuallyAddedNoncompliantIssues.CS/S6964-IntentionalFindings-net8.0.json b/analyzers/its/expected/ManuallyAddedNoncompliantIssues.CS/S6964-IntentionalFindings-net8.0.json index 05a624fc5d2..feb91c9503b 100644 --- a/analyzers/its/expected/ManuallyAddedNoncompliantIssues.CS/S6964-IntentionalFindings-net8.0.json +++ b/analyzers/its/expected/ManuallyAddedNoncompliantIssues.CS/S6964-IntentionalFindings-net8.0.json @@ -2,9 +2,15 @@ "Issues": [ { "Id": "S6964", - "Message": "Property used as input in a controller action should be nullable or annotated with the Required attribute to avoid under-posting.", + "Message": "Value type property used as input in a controller action should be nullable, required or annotated with the JsonRequiredAttribute to avoid under-posting.", "Uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/Projects/ManuallyAddedNoncompliantIssues.CS/IntentionalFindings/S6964.cs#L9", "Location": "Line 9 Position 24-37" + }, + { + "Id": "S6964", + "Message": "Value type property used as input in a controller action should be nullable, required or annotated with the JsonRequiredAttribute to avoid under-posting.", + "Uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/Projects/ManuallyAddedNoncompliantIssues.CS/IntentionalFindings/S6967.cs#L12", + "Location": "Line 12 Position 35-37" } ] } \ No newline at end of file diff --git a/analyzers/rspec/cs/S6964.html b/analyzers/rspec/cs/S6964.html index e98a4cc4844..026d6cbcdc2 100644 --- a/analyzers/rspec/cs/S6964.html +++ b/analyzers/rspec/cs/S6964.html @@ -20,41 +20,45 @@

Why is this an issue?

}

Exceptions

+

This rule does not raise an issue when:

How to fix it

You should mark any model value-type property as nullable or annotate it with the Required attribute. Thus, when a -client underposts, you ensure that the missing properties can be detected on the server side rather than being auto-filled, and therefore, incoming -data meets the application’s expectations.

+href="https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/nullable-value-types">nullable, required or JsonRequired. Thus when a client +underposts, you ensure that the missing properties can be detected on the server side rather than being auto-filled, and therefore, incoming data +meets the application’s expectations.

Code examples

Noncompliant code example

 public class Product
 {
-    public int Id { get; set; }
+    public int Id { get; set; }             // Noncompliant
     public string Name { get; set; }
     public int NumberOfItems { get; set; }  // Noncompliant
     public decimal Price { get; set; }      // Noncompliant
 }

If the client sends a request without setting the NumberOfItems or Price properties, they will default to 0. -In the request handler method there’s no way to determine whether they were intentionally set to 0 or omitted by mistake.

+In the request handler method, there’s no way to determine whether they were intentionally set to 0 or omitted by mistake.

Compliant solution

 public class Product
 {
-    public int Id { get; set; }
+    public required int Id { get; set; }
     public string Name { get; set; }
-    public int? NumberOfItems { get; set; }         // Compliant - property is optional
-    [Required] public decimal Price { get; set; }  // Compliant - property must have a value
+    public int? NumberOfItems { get; set; }            // Compliant - property is optional
+    [JsonRequired] public decimal Price { get; set; }  // Compliant - property must have a value
 }
-

In this example the request handler method can

+

In this example, the request handler method can