Merge pull request #2743 from dotnet/merges/master-to-3.x

Merge master to 3.x
dotnet · Aug 3, 2019 · ddb105b · ddb105b
2 parents b4364fd + 9d67fbc
commit ddb105b
Show file tree

Hide file tree

Showing 2 changed files with 70 additions and 4 deletions.
diff --git a/...osoft.NetFramework.Analyzers/Core/MarkVerbHandlersWithValidateAntiforgeryTokenAnalyzer.cs b/...osoft.NetFramework.Analyzers/Core/MarkVerbHandlersWithValidateAntiforgeryTokenAnalyzer.cs
@@ -122,10 +122,9 @@ public override void Initialize(AnalysisContext analysisContext)
                                 || methodSymbol.IsStatic
                                 || !methodSymbol.IsPublic()
                                 || !(methodSymbol.ReturnType.Inherits(actionResultSymbol)  // FxCop implementation only looked at ActionResult-derived return types.
-                                     || (methodSymbol.IsAsync
-                                         && wellKnownTypeProvider.IsTaskOfType(
-                                             methodSymbol.ReturnType,
-                                             (ITypeSymbol typeArgument) => typeArgument.Inherits(actionResultSymbol))))
+                                     || wellKnownTypeProvider.IsTaskOfType(
+                                            methodSymbol.ReturnType,
+                                            (ITypeSymbol typeArgument) => typeArgument.Inherits(actionResultSymbol)))
                                 || (!methodSymbol.ContainingType.Inherits(mvcControllerSymbol)
                                     && !methodSymbol.ContainingType.Inherits(mvcControllerBaseSymbol)))
                             {

diff --git a/...amework.Analyzers/UnitTests/Security/MarkVerbHandlersWithValidateAntiforgeryTokenTests.cs b/...amework.Analyzers/UnitTests/Security/MarkVerbHandlersWithValidateAntiforgeryTokenTests.cs
@@ -849,6 +849,73 @@ public async Task<ActionResult> DoSomethingAsync(string input)
             return null;
         }
     }
+}"
+            );
+        }
+
+        [Fact]
+        public async Task MissingVerbsAndTokenTaskButNotAsync_CSharp_Diagnostic()
+        {
+            await VerifyCS.VerifyAnalyzerAsync(SystemWebMvcNamespaceCSharp + @"
+namespace Blah
+{
+    using System.Threading.Tasks;
+    using System.Web.Mvc;
+
+    public class ApiController : Controller
+    {
+        public Task<ActionResult> DoSomethingAsync(string input)
+        {
+            return null;
+        }
+    }
+}
+",
+                GetCA3147CSharpNoVerbsNoToken(SystemWebMvcNamespaceCSharpLineCount + 9, 35, "DoSomethingAsync"));
+        }
+
+        [Fact]
+        public async Task AcceptVerbsNoTokenTaskButNotAsync_CSharp_Diagnostic()
+        {
+            await VerifyCS.VerifyAnalyzerAsync(SystemWebMvcNamespaceCSharp + @"
+namespace Blah
+{
+    using System.Threading.Tasks;
+    using System.Web.Mvc;
+
+    public class AcceptVerbsNoTokenController : Controller
+    {
+        private const HttpVerbs AllowedVerbs = HttpVerbs.Post | HttpVerbs.Put;
+
+        [AcceptVerbs(AllowedVerbs)]
+        public Task<ActionResult> DoSomethingAsync()
+        {
+            return null;
+        }
+    }
+}
+",
+            GetCA3147CSharpVerbsAndNoToken(SystemWebMvcNamespaceCSharpLineCount + 12, 35, "DoSomethingAsync"));
+        }
+
+        [Fact]
+        public async Task HaveAcceptStringPutAndTokenTaskButNotAsync_CSharp_NoDiagnostic()
+        {
+            await VerifyCS.VerifyAnalyzerAsync(SystemWebMvcNamespaceCSharp + @"
+namespace Blah
+{
+    using System.Threading.Tasks;
+    using System.Web.Mvc;
+
+    public class ApiController : Controller
+    {
+        [AcceptVerbs(""Put"")]
+        [ValidateAntiForgeryToken]
+        public Task<ActionResult> DoSomethingAsync(string input)
+        {
+            return null;
+        }
+    }
 }"
             );
         }