ASP.NET Core is a cross-platform .NET framework for building modern cloud-based web applications on Windows, Mac, or Linux.
This report summarizes scanner evidence for dotnet/aspnetcore, a C# project with 38,463 GitHub stars. SynthScan examined 2,080,586 lines of code across 13656 source files, recording 11487 pattern matches distributed across 21 syntactic categories. The legacy adjusted pattern signal is 28.2 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 6074 finding(s).
Are imports declared and package/API names verified? 5380 finding(s).
Are wrappers, guards, and repeated structures necessary? 362 finding(s).
Which changes need focused human review? 11487 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 11487 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL⚡ | docs/Helix.md | 72 | D:\a\_work\1\s\.packages\microsoft.dotnet.helix.sdk\7.0.0-beta.21559.3\tools\Microsoft.DotNet.Helix.Sdk.MultiQueue.targe | CODE |
| CRITICAL⚡ | docs/Helix.md | 73 | D:\a\_work\1\s\.packages\microsoft.dotnet.helix.sdk\7.0.0-beta.21559.3\tools\Microsoft.DotNet.Helix.Sdk.MultiQueue.targe | CODE |
| CRITICAL⚡ | docs/Helix.md | 74 | ##[error].packages\microsoft.dotnet.helix.sdk\7.0.0-beta.21559.3\tools\Microsoft.DotNet.Helix.Sdk.MultiQueue.targets(78, | COMMENT |
| CRITICAL | .github/workflows/pr-docs-check/test_prepare_context.py | 47 | "Microsoft.AspNetCore.Components.Web.Foo.Bar() -> void", "public_api"), | CODE |
| CRITICAL | …eware/Rewrite/src/PatternSegments/ServerNameSegment.cs | 12 | return context.HttpContext.Request.Host.Host.ToString(CultureInfo.InvariantCulture); | CODE |
| CRITICAL | src/Middleware/HealthChecks/src/PublicAPI.Shipped.txt | 2 | ~Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckMiddleware.InvokeAsync(Microsoft.AspNetCore.Http.HttpContext h | CODE |
| CRITICAL⚡ | src/Middleware/HealthChecks/src/PublicAPI.Shipped.txt | 14 | Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckMiddleware.HealthCheckMiddleware(Microsoft.AspNetCore.Http.Requ | CODE |
| CRITICAL⚡ | src/Middleware/HealthChecks/src/PublicAPI.Shipped.txt | 15 | Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckMiddleware.InvokeAsync(Microsoft.AspNetCore.Http.HttpContext! h | CODE |
| CRITICAL⚡ | src/Middleware/HealthChecks/src/PublicAPI.Shipped.txt | 19 | Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckOptions.HealthCheckOptions() -> void | CODE |
| CRITICAL | …dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs | 66 | req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.ToString("r")); | CODE |
| CRITICAL | …dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs | 83 | req.Headers.Add("If-Modified-Since", original.Content.Headers.LastModified.Value.AddHours(-1).ToString("r")); | CODE |
| CRITICAL | …dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs | 100 | req.Headers.Add("If-Modified-Since", original.Content.Headers.LastModified.Value.ToString("r")); | CODE |
| CRITICAL | …dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs | 117 | req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.ToString("r")); | CODE |
| CRITICAL | …dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs | 172 | req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.Subtract(TimeSpan.FromDays(1)).ToString( | CODE |
| CRITICAL | …dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs | 191 | req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.Subtract(TimeSpan.FromDays(1)).ToString( | CODE |
| CRITICAL | …dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs | 219 | req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.ToString("r")); | CODE |
| CRITICAL | …dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs | 246 | req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.ToString("r")); | CODE |
| CRITICAL | src/Middleware/StaticFiles/src/PublicAPI.Shipped.txt | 66 | Microsoft.AspNetCore.StaticFiles.Infrastructure.SharedOptions.SharedOptions() -> void | CODE |
| CRITICAL | src/Middleware/StaticFiles/src/PublicAPI.Shipped.txt | 75 | Microsoft.AspNetCore.StaticFiles.Infrastructure.SharedOptionsBase.SharedOptionsBase(Microsoft.AspNetCore.StaticFiles.Inf | CODE |
| CRITICAL⚡ | …e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt | 15 | Microsoft.AspNetCore.SpaServices.AngularCli.AngularCliBuilder.AngularCliBuilder(string! npmScript) -> void | CODE |
| CRITICAL⚡ | …e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt | 16 | Microsoft.AspNetCore.SpaServices.AngularCli.AngularCliBuilder.Build(Microsoft.AspNetCore.SpaServices.ISpaBuilder! spaBui | CODE |
| CRITICAL⚡ | …e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt | 22 | Microsoft.AspNetCore.SpaServices.Prerendering.ISpaPrerendererBuilder.Build(Microsoft.AspNetCore.SpaServices.ISpaBuilder! | CODE |
| CRITICAL⚡ | …e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt | 43 | Microsoft.AspNetCore.SpaServices.StaticFiles.SpaStaticFilesOptions.SpaStaticFilesOptions() -> void | CODE |
| CRITICAL⚡ | …e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt | 49 | static Microsoft.AspNetCore.SpaServices.AngularCli.AngularCliMiddlewareExtensions.UseAngularCliServer(this Microsoft.Asp | CODE |
| CRITICAL⚡ | …e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt | 50 | static Microsoft.AspNetCore.SpaServices.ReactDevelopmentServer.ReactDevelopmentServerMiddlewareExtensions.UseReactDevelo | CODE |
| CRITICAL | …eCompression/test/ResponseCompressionMiddlewareTest.cs | 1325 | request.Headers.AcceptEncoding.Add(System.Net.Http.Headers.StringWithQualityHeaderValue.Parse(requestAcceptE | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 5 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.CorsMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 6 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.CorsMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 7 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.CorsMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 8 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(Microsoft.AspNetCore.Http.HttpContext context, Microsoft | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 9 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.AddDefaultPolicy(Microsoft.AspNetCore.Cors.Infrastructure.CorsPoli | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 10 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.AddDefaultPolicy(System.Action<Microsoft.AspNetCore.Cors.Infrastru | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 11 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.AddPolicy(string name, Microsoft.AspNetCore.Cors.Infrastructure.Co | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 12 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.AddPolicy(string name, System.Action<Microsoft.AspNetCore.Cors.Inf | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 13 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.GetPolicy(string name) -> Microsoft.AspNetCore.Cors.Infrastructure | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 16 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowAnyHeader() -> Microsoft.AspNetCore.Cors.Infrastructure | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 17 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowAnyMethod() -> Microsoft.AspNetCore.Cors.Infrastructure | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 18 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowAnyOrigin() -> Microsoft.AspNetCore.Cors.Infrastructure | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 19 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowCredentials() -> Microsoft.AspNetCore.Cors.Infrastructu | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 20 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.Build() -> Microsoft.AspNetCore.Cors.Infrastructure.CorsPoli | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 21 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.CorsPolicyBuilder(Microsoft.AspNetCore.Cors.Infrastructure.C | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 22 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.CorsPolicyBuilder(params string[] origins) -> void | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 23 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.DisallowCredentials() -> Microsoft.AspNetCore.Cors.Infrastru | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 24 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.SetIsOriginAllowed(System.Func<string, bool> isOriginAllowed | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 25 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.SetIsOriginAllowedToAllowWildcardSubdomains() -> Microsoft.A | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 26 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.SetPreflightMaxAge(System.TimeSpan preflightMaxAge) -> Micro | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 27 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.WithExposedHeaders(params string[] exposedHeaders) -> Micros | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 28 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.WithHeaders(params string[] headers) -> Microsoft.AspNetCore | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 29 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.WithMethods(params string[] methods) -> Microsoft.AspNetCore | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 30 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.WithOrigins(params string[] origins) -> Microsoft.AspNetCore | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 34 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsService.EvaluatePolicy(Microsoft.AspNetCore.Http.HttpContext context, Micr | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 35 | ~Microsoft.AspNetCore.Cors.Infrastructure.CorsService.EvaluatePolicy(Microsoft.AspNetCore.Http.HttpContext context, stri | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 36 | ~Microsoft.AspNetCore.Cors.Infrastructure.DefaultCorsPolicyProvider.GetPolicyAsync(Microsoft.AspNetCore.Http.HttpContext | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 38 | ~Microsoft.AspNetCore.Cors.Infrastructure.ICorsPolicyProvider.GetPolicyAsync(Microsoft.AspNetCore.Http.HttpContext conte | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 39 | ~Microsoft.AspNetCore.Cors.Infrastructure.ICorsService.ApplyResult(Microsoft.AspNetCore.Cors.Infrastructure.CorsResult r | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 40 | ~Microsoft.AspNetCore.Cors.Infrastructure.ICorsService.EvaluatePolicy(Microsoft.AspNetCore.Http.HttpContext context, Mic | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 41 | ~override Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicy.ToString() -> string | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 42 | ~override Microsoft.AspNetCore.Cors.Infrastructure.CorsResult.ToString() -> string | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 61 | ~virtual Microsoft.AspNetCore.Cors.Infrastructure.CorsService.ApplyResult(Microsoft.AspNetCore.Cors.Infrastructure.CorsR | CODE |
| CRITICAL⚡ | src/Middleware/CORS/src/PublicAPI.Shipped.txt | 62 | ~virtual Microsoft.AspNetCore.Cors.Infrastructure.CorsService.EvaluatePreflightRequest(Microsoft.AspNetCore.Http.HttpCon | CODE |
| 5224 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .CodeQL.yml | 1 | # This file configures CodeQL runs and TSA bug autofiling. For more information, see: | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | eng/common/vmr-sync.sh | 1 | #!/bin/bash | COMMENT |
| LOW | eng/common/vmr-sync.sh | 21 | ### | COMMENT |
| LOW | eng/common/native/init-distro-rid.sh | 1 | #!/bin/sh | COMMENT |
| LOW | eng/common/native/init-distro-rid.sh | 61 | COMMENT | |
| LOW | …common/templates-official/variables/pool-providers.yml | 1 | # Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc pool | COMMENT |
| LOW | eng/common/templates/vmr-build-pr.yml | 1 | # This pipeline is used for running the VMR verification of the PR changes in repo-level PRs. | COMMENT |
| LOW | eng/common/templates/variables/pool-providers.yml | 1 | # Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc pool | COMMENT |
| LOW | eng/common/core-templates/stages/renovate.yml | 1 | # -------------------------------------------------------------------------------------- | COMMENT |
| LOW | …g/common/core-templates/steps/get-github-app-token.yml | 1 | # Mints a short-lived GitHub App installation access token by signing a JWT | COMMENT |
| LOW | eng/common/core-templates/steps/install-microbuild.yml | 1 | parameters: | COMMENT |
| LOW | eng/common/core-templates/job/renovate.yml | 1 | # -------------------------------------------------------------------------------------- | COMMENT |
| LOW | eng/common/core-templates/job/source-build.yml | 1 | parameters: | COMMENT |
| LOW | eng/common/core-templates/job/source-build.yml | 21 | # published by source-build. | COMMENT |
| LOW | eng/skill-evals/skills-vs-baseline.experiment.yaml | 1 | name: skills-vs-baseline | COMMENT |
| LOW | eng/skill-evals/pr-attention-queue/eval.vally.yaml | 21 | # | COMMENT |
| LOW | eng/scripts/CaptureHangDumps.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .devcontainer/scripts/container-creation.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/workflows/community-pr-issue-check.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"c38e90a99692cef031797374b3b27b835b852f211360f3c7d0e57950472 | COMMENT |
| LOW | .github/workflows/community-pr-issue-check.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/community-pr-issue-check.lock.yml | 41 | # - COPILOT_PAT_8 | COMMENT |
| LOW | …kflows/agentics-maintenance-dotnet-AspNetCore.Docs.yml | 1 | # This file was automatically generated by pkg/workflow/side_repo_maintenance.go (v0.89.21). DO NOT EDIT. To debug this | COMMENT |
| LOW | …kflows/agentics-maintenance-dotnet-AspNetCore.Docs.yml | 21 | # | COMMENT |
| LOW | .github/workflows/pull-request-review.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"e5226a757937744fd6512df2f984cdca5632361855ae33242e62bf93ed7 | COMMENT |
| LOW | .github/workflows/pull-request-review.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/pull-request-review.lock.yml | 41 | # - COPILOT_PAT_2 | COMMENT |
| LOW | .github/workflows/pull-request-review.lock.yml | 61 | # - github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 | COMMENT |
| LOW | .github/workflows/browsertesting-deps-update.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"7b346b548935fbace10395a7417a05bbb92620af114a2f267b63ecbe5e0 | COMMENT |
| LOW | .github/workflows/browsertesting-deps-update.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/browsertesting-deps-update.lock.yml | 41 | # - COPILOT_PAT_8 | COMMENT |
| LOW | .github/workflows/browsertesting-deps-update.lock.yml | 941 | - name: Clean credentials | COMMENT |
| LOW | .github/workflows/browsertesting-deps-update.lock.yml | 961 | # --allow-tool shell(git commit:*) | COMMENT |
| LOW | .github/workflows/cswin32-update.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"7ad152a525bb7f0c3238cf2ad0a6d7931bc82b5d24520cb1d746a36b951 | COMMENT |
| LOW | .github/workflows/cswin32-update.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/cswin32-update.lock.yml | 41 | # - COPILOT_PAT_8 | COMMENT |
| LOW | .github/workflows/cswin32-update.lock.yml | 941 | - name: Clean credentials | COMMENT |
| LOW | .github/workflows/cswin32-update.lock.yml | 961 | # --allow-tool shell(find) | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"dad2dffc884ab55aa1aa33826ed2e5a7ba2af572f857dcaee2377772487 | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 41 | # - COPILOT_PAT_8 | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 61 | # - ghcr.io/github/gh-aw-firewall/api-proxy:0.28.23@sha256:c15c3d1208df10c5b588a3657be53742aa982ae0909d1eb181252526879 | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 81 | # python3 << 'SCRIPT' | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 101 | # return results | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 121 | # # Deduplicate by PR number | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 141 | # quarantine_entries.append({ | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 161 | # # Write JSON to GITHUB_OUTPUT so it flows through jobs.pre_activation.outputs | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 181 | # id: requarantine_issues | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 201 | # with urllib.request.urlopen(req, timeout=30) as resp: | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 221 | # if not github_output: | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 241 | # # | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 261 | # # with triage/write access to add labels, so a label's mere presence is itself | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 281 | # with urllib.request.urlopen(req, timeout=30) as resp: | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 301 | # with urllib.request.urlopen(req, timeout=30) as resp: | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 321 | # latest = ts | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 341 | # ) | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 361 | # issue_meta = (get_issue(number) if pr.get("closed_at") and not was_merged | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 381 | # unquarantine_label_added_at = ( | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 401 | # "trusted_closed": bool(closed_by and closer_is_privileged_human), | COMMENT |
| LOW | .github/workflows/test-quarantine.lock.yml | 421 | # MAX_OUTPUT_BYTES = 120000 | COMMENT |
| 5320 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …vc/Mvc.Analyzers/src/TagHelpersInCodeBlocksAnalyzer.cs | 25 | // Generated Razor code is considered auto generated. By default analyzers skip over auto-generated code unless | COMMENT |
| HIGH | …erences#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …ingName#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …estBody#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …rollers#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …malApis#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …rollers#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …alTexts#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …rollers#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …rollers#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …OpenApi#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …Schemas#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …rollers#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …Formats#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …tionIds#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …Schemas#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …estBody#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | …estBody#OpenApiXmlCommentSupport.generated.verified.cs | 4 | // This code was generated by a tool. | COMMENT |
| HIGH | src/OpenApi/gen/XmlCommentGenerator.Emitter.cs | 22 | // This code was generated by a tool. | COMMENT |
| HIGH | …E2ETest/ServerRenderingTests/EnhancedNavigationTest.cs | 777 | // Staleness check is used to assert enhanced navigation is enabled/disabled, as requested | COMMENT |
| HIGH | …E2ETest/ServerRenderingTests/EnhancedNavigationTest.cs | 857 | // staleness check is used to assert enhanced navigation is enabled/disabled, as requested | COMMENT |
| HIGH | src/Http/Routing/tools/Swaggatherer/Template.cs | 77 | // This code was generated by the Swaggatherer | COMMENT |
| HIGH | …marks/Matching/MatcherGithubBenchmarkBase.generated.cs | 9 | // This code was generated by the Swaggatherer | COMMENT |
| HIGH | …kGeneration/LinkGenerationGithubBenchmark.generated.cs | 10 | // This code was generated by the Swaggatherer | COMMENT |
| HIGH | …_TakesCustomMetadataEmitter_Has_Metadata.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …ptyQueryStringValueProvided_StringReturn.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …urnsValidationProblemResult_Has_Metadata.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …icitQuery_NullableIntArrayParam_Optional.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …tion_ExplicitQuery_ComplexTypeArrayParam.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …thArrayQueryString_AndBody_ShouldUseBody.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …r/Baselines/MapAction_BindAsync_Snapshot.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …apAction_NoParam_StringReturn_WithFilter.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …ullableStringArrayParam_EmptyQueryValues.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …pAction_MultipleStringParam_StringReturn.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …ltiple_MapAction_WithParams_StringReturn.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …icitQuery_NullableIntArrayParam_Optional.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …es/MapAction_ReturnsVoid_Has_No_Metadata.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …n_ExplicitQuery_NullableStringArrayParam.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …pportsSameInterceptorsFromDifferentFiles.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …ion_ExplicitSource_SimpleReturn_Snapshot.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …QueryString_AndBody_ShouldUseQueryString.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …nBodyOrService_HandlesBothJsonAndService.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …MapAction_ImplicitQuery_StringArrayParam.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …/Multiple_MapAction_NoParam_StringReturn.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …tringArrayParam_Optional_QueryNotPresent.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …ion_ExplicitHeader_ComplexTypeArrayParam.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …_ExplicitHeader_NullableStringArrayParam.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …tor/Baselines/VerifyAsParametersBaseline.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …_ImplicitQuery_StringArrayParam_Optional.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …rtsDifferentInterceptorsFromSameLocation.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …y_IntArrayParam_Optional_QueryNotPresent.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …s/MapAction_SingleEnumParam_StringReturn.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …leIntArrayParam_Optional_QueryNotPresent.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …lines/MapAction_ReturnsTodo_Has_Metadata.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …/MapPost_WithArrayQueryString_ShouldFail.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …y_IntArrayParam_Optional_QueryNotPresent.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …thArrayQueryString_AndBody_ShouldUseBody.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …on_MultipleSpecialTypeParam_StringReturn.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …ion_ImplicitQuery_IntArrayParam_Optional.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …ion_ExplicitQuery_IntArrayParam_Optional.generated.txt | 3 | // This code was generated by a tool. | COMMENT |
| 66 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/cross/install-debs.py | 49 | async def download_deb_files_parallel(mirror, packages, tmp_dir): | CODE |
| LOW | eng/common/cross/install-debs.py | 65 | async def download_package_index_parallel(mirror, arch, suites, check_sig, keyring): | CODE |
| LOW | eng/common/cross/install-debs.py | 337 | def _rootfs_extraction_filter(member, dest_path): | CODE |
| LOW | .github/workflows/test-quarantine.lock.yml | 4978 | return async function handleCreateQuarantineIssue(item, resolvedTemporaryIds, temporaryIdMap) { | CODE |
| LOW | …/test-quarantine/test_validate_pull_request_outputs.py | 74 | def source_two_quarantined_methods(): | STRING |
| LOW | …/test-quarantine/test_validate_pull_request_outputs.py | 92 | def source_two_unquarantined_methods(): | STRING |
| LOW | …/test-quarantine/test_validate_pull_request_outputs.py | 325 | def test_theory_target_binding(data="HttpProtocols.Http3", displayed="Http3", supported=True, provider=""): | STRING |
| LOW | …/test-quarantine/test_validate_pull_request_outputs.py | 433 | def test_row_comment_ownership(): | STRING |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 180 | def operating_system_from_queue(value): | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 873 | def historical_assembly_state(root, project_root, commit, state_cache): | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 964 | def assembly_quarantine_history(root, project_root, history_ref): | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1018 | def historical_project_source_index( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1248 | def assembly_quarantine_transition( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1304 | def type_quarantine_transition( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1565 | def target_identity_rename_detected( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1717 | def namespace_rename_detected(root, relative_path, type_name, history_ref): | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1806 | def method_quarantine_transitions( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1906 | def data_quarantine_transitions( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2008 | def target_quarantine_transitions( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2263 | def type_quarantine_transitions( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2336 | def classify_current_quarantine_history(events): | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2364 | def current_quarantine_targets(source_index): | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2452 | def collect_requarantine_history( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2772 | def project_history_is_complete( | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 3009 | def quarantine_operating_systems(record_a, record_b, record_c, builds): | CODE |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 779 | def test_inline_literal_resolution(raw="true", rendered="True"): | CODE |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 793 | def test_unmatched_inline_row_fails_closed(cases=None): | CODE |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 830 | def test_non_data_condition_rows(condition="[MsQuicSupported]"): | CODE |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 858 | def test_kestrel_condition_rows(): | CODE |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 877 | def test_commented_row_attributes(): | CODE |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 930 | def test_build_source_ancestry(): | CODE |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 1089 | def test_history_cutoff_uses_first_parent_order(): | CODE |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 1136 | def test_requarantine_history(): | CODE |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 258 | def assert_already_quarantined(result): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 264 | def test_row_targets_require_conditional_theory(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 335 | def test_workflow_platform_evidence(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 446 | def test_source_c_platform_evidence(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 504 | def test_production_queue_evidence( | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 583 | def test_theory_data_quarantine_support(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 1823 | def test_assembly_history_ignores_child_removal_after_own_quarantine(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 1852 | def test_assembly_history_ignores_child_churn_during_own_quarantine(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 1878 | def test_method_history_ignores_assembly_churn_during_own_quarantine(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 1904 | def test_method_history_ignores_type_churn_during_own_quarantine(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 1933 | def test_type_history_ignores_method_churn_during_own_quarantine(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 1962 | def test_same_commit_method_to_assembly_replacement_is_not_first_quarantine(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 1987 | def test_same_commit_type_to_method_replacement_is_not_first_quarantine(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2006 | def test_exact_target_transition_in_shared_hunk(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2130 | def test_github_commit_contains(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2205 | def test_workflow_runner_temp(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2240 | def initialize_git_repository(root): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2316 | def initialize_partial_base_runner_repository(root, *, runner_inherits_base): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2339 | def initialize_multihop_runner_repository(root, *, mid_inherits_base): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2363 | def initialize_mid_quarantine_runner_repository(root, *, runner_base): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2377 | def test_assembly_quarantine_history(): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2559 | def test_partial_sibling_type_quarantine_is_already_quarantined(module=None): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2589 | def test_partial_sibling_type_quarantine_removal_is_case_b(module=None): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2641 | def test_partial_sibling_type_quarantine_removal_after_rename_is_case_b(module=None): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2697 | def test_partial_sibling_type_quarantine_removal_by_deletion_is_case_b(module=None): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2742 | def test_partial_other_method_unquarantine_does_not_make_test_case_b(module=None): | STRING |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2789 | def test_partial_inherited_runner_sibling_type_removal_is_case_b(module=None): | STRING |
| 269 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/cswin32-update.md | 114 | ### Step 1: Check for a newer CsWin32 version | COMMENT |
| LOW | .github/workflows/cswin32-update.md | 131 | ### Step 2: Restore and build | COMMENT |
| LOW | .github/workflows/cswin32-update.md | 171 | ### Step 3: Research what changed in CsWin32 | COMMENT |
| LOW | .github/workflows/cswin32-update.md | 197 | ### Step 4: Find and fix CsWin32 workarounds | COMMENT |
| LOW | .github/workflows/issue-triage-agent.md | 305 | ## Step 1: Area Classification | COMMENT |
| LOW | .github/workflows/issue-triage-agent.md | 495 | ## Step 2: Type Classification | COMMENT |
| LOW | .github/workflows/issue-triage-agent.md | 529 | ## Step 3: Additional Labels | COMMENT |
| LOW | .github/workflows/issue-triage-agent.md | 545 | ## Step 4: Regression Detection | COMMENT |
| LOW | .github/workflows/issue-triage-agent.md | 576 | ## Step 5: Duplicate Detection | COMMENT |
| LOW | .github/workflows/issue-triage-agent.md | 597 | ## Step 6: Draft the Triage Comment | COMMENT |
| LOW | .github/workflows/issue-triage-agent.md | 740 | ## Step 7: Apply Labels, Type, and Post the Comment | COMMENT |
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 71 | // Step 1: Safe methods are always allowed regardless of headers. | COMMENT |
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 88 | // Step 2: Trusted origins (from the applicable CORS policy) allow cross-origin requests | COMMENT |
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 266 | // Step 3: Sec-Fetch-Site header validation. | COMMENT |
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 287 | // Step 4: No Sec-Fetch-Site header → fall back to Origin vs Host comparison. | COMMENT |
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 352 | // Step 5: No Sec-Fetch-Site AND no Origin → non-browser → allowed. | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 19 | // Step 1: Safe methods are always allowed. | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 25 | // Step 2: Sec-Fetch-Site accept path. The vast majority of legitimate browser | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 34 | // Step 3: Check trusted origins from the CORS policy that applies to this request | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 59 | // Step 4: Sec-Fetch-Site deny path. Any value other than "same-origin"/"none" | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 66 | // Step 5: No Sec-Fetch-Site header. Fall back to Origin vs Host comparison. | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 74 | // Step 6: No Sec-Fetch-Site AND no Origin header. | COMMENT |
| LOW | …ncyInjection/MvcNewtonsoftJsonOptionsExtensionsTest.cs | 240 | // NOTE: This method was created to make sure to create a different instance of contract resolver as by default | COMMENT |
| LOW | …src/Infrastructure/DefaultPageHandlerMethodSelector.cs | 87 | // Step 1: match on HTTP method. | COMMENT |
| LOW | …src/Infrastructure/DefaultPageHandlerMethodSelector.cs | 117 | // Step 2: remove candidates with non-matching handlers. | COMMENT |
| LOW⚡ | …c/Mvc.Core/src/Routing/ActionEndpointDataSourceBase.cs | 127 | // Step 1 - capture old token | COMMENT |
| LOW⚡ | …c/Mvc.Core/src/Routing/ActionEndpointDataSourceBase.cs | 130 | // Step 2 - update endpoints | COMMENT |
| LOW⚡ | …c/Mvc.Core/src/Routing/ActionEndpointDataSourceBase.cs | 133 | // Step 3 - create new change token | COMMENT |
| LOW⚡ | …c/Mvc.Core/src/Routing/ActionEndpointDataSourceBase.cs | 137 | // Step 4 - trigger old token | COMMENT |
| LOW | …structure/DefaultActionDescriptorCollectionProvider.cs | 167 | // Step 4 - might be null if it's the first time. | COMMENT |
| LOW⚡ | src/Components/AI/gen/ToolBlockGenerator.cs | 14 | // Step 1: Parse classes with [ToolBlock] into an equatable parse result | COMMENT |
| LOW⚡ | src/Components/AI/gen/ToolBlockGenerator.cs | 22 | // Step 2: Report per-declaration diagnostics and emit a handler for each valid candidate. | COMMENT |
| LOW | src/Components/AI/gen/ToolBlockGenerator.cs | 39 | // Step 3: Collect all valid candidates and emit the aggregate registration. | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 29 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 33 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 37 | // Step 3: validate that there's now a single key in the directory and that it's not protected | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 95 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 99 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 106 | // Step 3: validate that there's now a single key in the directory and that it's protected with DPAPI | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 139 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 143 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 152 | // Step 3: validate that there's now a single key in the directory and that it's is protected using | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 224 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 228 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 233 | // Step 3: validate that there's now a single key in the directory and that it's is protected using the cert | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 253 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 257 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 262 | // Step 3: validate that there's no key in the directory | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 293 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 297 | // Step 2: instantiate the system and create some data | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 304 | // Step 3: validate that there's now a single key in the directory and that it's is protected using the cert | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 312 | // Step 4: setup a second system and validate it can decrypt keys and unprotect data | COMMENT |
| LOW | …tection/Extensions/test/DataProtectionProviderTests.cs | 54 | // Step 1: Instantiate the system and round-trip a payload | COMMENT |
| LOW | …tection/Extensions/test/DataProtectionProviderTests.cs | 72 | // Step 2: Validate that there's now a single key in the directory | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 336 | // Step 1: Generate a random key modifier and IV for this operation. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 342 | // Step 2: Decrypt the KDK, and use it to generate new encryption and HMAC keys. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 354 | // Step 2: Copy the key modifier and the IV to the output stream since they'll act as a header. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 357 | // Step 3: Generate IV for this operation right into the result array | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 361 | // Step 4: Perform the encryption operation. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 371 | // Step 5: Calculate the digest over the IV and ciphertext. | COMMENT |
| 14 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 71 | // Step 1: Safe methods are always allowed regardless of headers. | COMMENT |
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 88 | // Step 2: Trusted origins (from the applicable CORS policy) allow cross-origin requests | COMMENT |
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 266 | // Step 3: Sec-Fetch-Site header validation. | COMMENT |
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 287 | // Step 4: No Sec-Fetch-Site header → fall back to Origin vs Host comparison. | COMMENT |
| LOW | …crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs | 352 | // Step 5: No Sec-Fetch-Site AND no Origin → non-browser → allowed. | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 19 | // Step 1: Safe methods are always allowed. | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 25 | // Step 2: Sec-Fetch-Site accept path. The vast majority of legitimate browser | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 34 | // Step 3: Check trusted origins from the CORS policy that applies to this request | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 59 | // Step 4: Sec-Fetch-Site deny path. Any value other than "same-origin"/"none" | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 66 | // Step 5: No Sec-Fetch-Site header. Fall back to Origin vs Host comparison. | COMMENT |
| LOW⚡ | …c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs | 74 | // Step 6: No Sec-Fetch-Site AND no Origin header. | COMMENT |
| LOW | …src/Infrastructure/DefaultPageHandlerMethodSelector.cs | 87 | // Step 1: match on HTTP method. | COMMENT |
| LOW | …src/Infrastructure/DefaultPageHandlerMethodSelector.cs | 117 | // Step 2: remove candidates with non-matching handlers. | COMMENT |
| LOW | src/Mvc/Mvc.Core/src/Formatters/FormatFilter.cs | 97 | // We need to check if the action can generate the content type the user asked for. That is, treat the | COMMENT |
| LOW | …clients/ts/FunctionalTests/scripts/karma.local.conf.js | 21 | // On linux, the browsers just return the command, not a path, so we need to check if it exists. | COMMENT |
| LOW | …c/SignalR/clients/ts/signalr/src/WebSocketTransport.ts | 97 | // ErrorEvent is a browser only type we need to check if the type exists before using it | COMMENT |
| LOW | …c/SignalR/clients/ts/signalr/src/WebSocketTransport.ts | 126 | // ErrorEvent is a browser only type we need to check if the type exists before using it | COMMENT |
| LOW | src/SignalR/server/Core/src/HubConnectionContext.cs | 690 | // If there's a transfer format feature, we need to check if we're compatible and set th | COMMENT |
| LOW | …mponents/Web.JS/src/Rendering/Events/EventDelegator.ts | 171 | // when connection closed, it will detachWebRendererInterop, so we need to check if the renderer is still attached | COMMENT |
| LOW⚡ | src/Components/AI/gen/ToolBlockGenerator.cs | 14 | // Step 1: Parse classes with [ToolBlock] into an equatable parse result | COMMENT |
| LOW⚡ | src/Components/AI/gen/ToolBlockGenerator.cs | 22 | // Step 2: Report per-declaration diagnostics and emit a handler for each valid candidate. | COMMENT |
| LOW | src/Components/AI/gen/ToolBlockGenerator.cs | 39 | // Step 3: Collect all valid candidates and emit the aggregate registration. | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 29 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 33 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 37 | // Step 3: validate that there's now a single key in the directory and that it's not protected | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 95 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 99 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 106 | // Step 3: validate that there's now a single key in the directory and that it's protected with DPAPI | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 139 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 143 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 152 | // Step 3: validate that there's now a single key in the directory and that it's is protected using | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 224 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 228 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 233 | // Step 3: validate that there's now a single key in the directory and that it's is protected using the cert | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 253 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 257 | // Step 2: instantiate the system and round-trip a payload | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 262 | // Step 3: validate that there's no key in the directory | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 293 | // Step 1: directory should be completely empty | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 297 | // Step 2: instantiate the system and create some data | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 304 | // Step 3: validate that there's now a single key in the directory and that it's is protected using the cert | COMMENT |
| LOW⚡ | …tection/Extensions/test/DataProtectionProviderTests.cs | 312 | // Step 4: setup a second system and validate it can decrypt keys and unprotect data | COMMENT |
| LOW | …tection/Extensions/test/DataProtectionProviderTests.cs | 54 | // Step 1: Instantiate the system and round-trip a payload | COMMENT |
| LOW | …tection/Extensions/test/DataProtectionProviderTests.cs | 72 | // Step 2: Validate that there's now a single key in the directory | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 336 | // Step 1: Generate a random key modifier and IV for this operation. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 342 | // Step 2: Decrypt the KDK, and use it to generate new encryption and HMAC keys. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 354 | // Step 2: Copy the key modifier and the IV to the output stream since they'll act as a header. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 357 | // Step 3: Generate IV for this operation right into the result array | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 361 | // Step 4: Perform the encryption operation. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 371 | // Step 5: Calculate the digest over the IV and ciphertext. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 554 | // Step 3: Calculate the correct MAC for this payload. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 562 | // Step 4: Validate the MAC provided as part of the payload. | COMMENT |
| LOW⚡ | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 565 | // Step 5: Decipher the ciphertext and return it to the caller. | COMMENT |
| LOW | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 457 | // Step 4: Validate the MAC provided as part of the payload. | COMMENT |
| LOW | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 512 | // Step 1: Extract the key modifier and IV from the payload. | COMMENT |
| LOW | …rotection/src/Managed/ManagedAuthenticatedEncryptor.cs | 528 | // Step 2: Decrypt the KDK and use it to restore the original encryption and MAC keys. | COMMENT |
| LOW | …ion/src/KeyManagement/KeyRingBasedSpanDataProtector.cs | 48 | // Step 1: Write the magic header and key id | COMMENT |
| LOW | …ion/src/KeyManagement/KeyRingBasedSpanDataProtector.cs | 63 | // Step 2: Perform encryption into the destination writer | COMMENT |
| LOW⚡ | …/src/SP800_108/Win7SP800_108_CTR_HMACSHA512Provider.cs | 37 | // Step 1: Calculate all necessary offsets into the temp input & output buffer. | COMMENT |
| LOW⚡ | …/src/SP800_108/Win7SP800_108_CTR_HMACSHA512Provider.cs | 43 | // Step 2: Copy Label and Context into the temp input buffer. | COMMENT |
| LOW⚡ | …/src/SP800_108/Win7SP800_108_CTR_HMACSHA512Provider.cs | 47 | // Step 3: copy [L] into last part of data to be hashed, big-endian | COMMENT |
| 6 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .config/CredScanSuppressions.json | 5 | "placeholder": "aspnetcore", | CODE |
| LOW⚡ | .config/CredScanSuppressions.json | 9 | "placeholder": "password", | CODE |
| LOW⚡ | .config/CredScanSuppressions.json | 13 | "placeholder": "my password", | CODE |
| LOW⚡ | .config/CredScanSuppressions.json | 17 | "placeholder": "newpassword", | CODE |
| LOW⚡ | .config/CredScanSuppressions.json | 21 | "placeholder": "testpassword", | CODE |
| LOW⚡ | .config/CredScanSuppressions.json | 25 | "placeholder": "AAABAgMEBQYHCAkKCwwNDg+ukCEMDf0yyQ29NYubggE=", | CODE |
| LOW⚡ | .config/CredScanSuppressions.json | 29 | "placeholder": "1qaz!QAZ", | CODE |
| LOW⚡ | .config/CredScanSuppressions.json | 33 | "placeholder": "1qaz@WSX", | CODE |
| LOW | …iddleware/ResponseCaching/test/ResponseCachingTests.cs | 280 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | …iddleware/ResponseCaching/test/ResponseCachingTests.cs | 303 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | …iddleware/ResponseCaching/test/ResponseCachingTests.cs | 875 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | …iddleware/ResponseCaching/test/ResponseCachingTests.cs | 879 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | …iddleware/ResponseCaching/test/ResponseCachingTests.cs | 901 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | …iddleware/ResponseCaching/test/ResponseCachingTests.cs | 911 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | …iddleware/ResponseCaching/test/ResponseCachingTests.cs | 936 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | …iddleware/ResponseCaching/test/ResponseCachingTests.cs | 946 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | src/Middleware/OutputCaching/test/OutputCacheTests.cs | 321 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | src/Middleware/OutputCaching/test/OutputCacheTests.cs | 345 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | src/Middleware/OutputCaching/test/OutputCacheTests.cs | 879 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | src/Middleware/OutputCaching/test/OutputCacheTests.cs | 883 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | src/Middleware/OutputCaching/test/OutputCacheTests.cs | 903 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW | src/Middleware/OutputCaching/test/OutputCacheTests.cs | 913 | client.DefaultRequestHeaders.From = "user@example.com"; | CODE |
| LOW⚡ | src/Middleware/ResponseCompression/sample/LoremIpsum.cs | 8 | internal const string Text = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed non risus. Suspendisse le | CODE |
| LOW⚡ | src/Middleware/ResponseCompression/sample/LoremIpsum.cs | 8 | internal const string Text = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed non risus. Suspendisse le | CODE |
| LOW⚡ | src/Middleware/ResponseCompression/sample/LoremIpsum.cs | 9 | "Ut velit mauris, egestas sed, gravida nec, ornare ut, mi. Aenean ut orci vel massa suscipit pulvinar.Nulla soll | CODE |
| LOW⚡ | src/Middleware/ResponseCompression/sample/LoremIpsum.cs | 9 | "Ut velit mauris, egestas sed, gravida nec, ornare ut, mi. Aenean ut orci vel massa suscipit pulvinar.Nulla soll | CODE |
| LOW | …y/test/Identity.Test/UserClaimsPrincipalFactoryTest.cs | 45 | var user = new PocoUser { UserName = "Foo", Email = "foo@bar.com" }; | CODE |
| LOW | …dentity.Test/Passkeys/PasskeyHandlerAttestationTest.cs | 1104 | public string? UserDisplayName { get; set; } = "John Doe"; | STRING |
| LOW | …kCore/test/EF.Test/UserStoreEncryptPersonalDataTest.cs | 207 | user.Email = "test@test.com"; | CODE |
| LOW | …ecification.Tests/src/UserManagerSpecificationTests.cs | 1821 | IdentityResultAssert.IsSuccess(await manager.SetEmailAsync(user, "test@test.com")); | CODE |
| LOW | …rsWebSite/TagHelpers/TagCloudViewComponentTagHelper.cs | 19 | ("Lorem ipsum dolor sit amet consectetur adipisicing elit sed do eiusmod tempor incididunt ut labore et dolore m | CODE |
| LOW | …rsWebSite/TagHelpers/TagCloudViewComponentTagHelper.cs | 19 | ("Lorem ipsum dolor sit amet consectetur adipisicing elit sed do eiusmod tempor incididunt ut labore et dolore m | CODE |
| LOW | …es/RazorWebSite/Controllers/UrlResolutionController.cs | 14 | Name = "John Doe" | CODE |
| LOW | ….ViewFeatures/test/Rendering/HtmlHelperTextAreaTest.cs | 162 | [Display(Prompt = "placeholder")] | CODE |
| LOW | ….ViewFeatures/test/Rendering/HtmlHelperPasswordTest.cs | 537 | [Display(Prompt = "placeholder")] | CODE |
| LOW | …c.ViewFeatures/test/Rendering/HtmlHelperTextBoxTest.cs | 180 | [Display(Prompt = "placeholder")] | CODE |
| LOW | src/Mvc/Mvc.ViewFeatures/src/DefaultHtmlGenerator.cs | 1316 | tagBuilder.MergeAttribute("placeholder", placeholder); | CODE |
| LOW | …c.JsonTranscoding.Tests/X509CertificateHelpersTests.cs | 30 | (1, "user@example.com"), | CODE |
| LOW | src/Security/Authentication/test/CertificateTests.cs | 571 | const string Expected = "John Doe"; | CODE |
| LOW | src/Security/Authentication/test/CertificateTests.cs | 646 | const string Expected = "John Doe"; | CODE |
| LOW | src/Security/Authentication/test/CertificateTests.cs | 696 | const string Expected = "John Doe"; | CODE |
| LOW | …ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs | 18 | var model = new ObjectWithJObject { CustomData = (JsonObject)JsonSerializer.SerializeToNode(new { Emails = new[] | CODE |
| LOW | …ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs | 34 | var model = new ObjectWithJObject { CustomData = (JsonObject)JsonSerializer.SerializeToNode(new { Email = "foo@b | CODE |
| LOW | …ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs | 48 | var model = new ObjectWithJObject { CustomData = new JsonObject([new("Email", "foo@bar.com"), new("Name", "Bar") | CODE |
| LOW | …ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs | 51 | patch.Operations.Add(new Operation<ObjectWithJObject>("test", "/CustomData/Email", null, "foo@bar.com")); | CODE |
| LOW | …ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs | 65 | var model = new ObjectWithJObject { CustomData = new JsonObject([new("Email", "foo@bar.com")]) }; | CODE |
| LOW | …ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs | 74 | Assert.Equal("foo@bar.com", model.CustomData["UserName"].GetValue<string>()); | CODE |
| LOW | …ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs | 147 | var model = new ObjectWithJObject { CustomData = new JsonObject([new("Email", "foo@bar.com"), new("Name", "Bar") | CODE |
| LOW | …ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs | 163 | var model = new ObjectWithJObject { CustomData = new JsonObject([new("Email", "foo@bar.com"), new("Name", "Bar") | CODE |
| LOW | …eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs | 20 | var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Emails = new[] { "foo@bar.com" } }) }; | CODE |
| LOW | …eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs | 36 | var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com", Name = "Bar" }) | CODE |
| LOW | …eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs | 50 | var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com", Name = "Bar" }) | CODE |
| LOW | …eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs | 53 | patch.Operations.Add(new Operation<ObjectWithJObject>("test", "/CustomData/Email", null, "foo@bar.com")); | CODE |
| LOW | …eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs | 67 | var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com" }) }; | CODE |
| LOW | …eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs | 76 | Assert.Equal("foo@bar.com", model.CustomData["UserName"].Value<string>()); | CODE |
| LOW | …eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs | 148 | var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com", Name = "Bar" }) | CODE |
| LOW | …eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs | 164 | var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com", Name = "Bar" }) | CODE |
| LOW | …i.SourceGenerators.Tests/OperationTests.MinimalApis.cs | 327 | /// <example>"user@example.com"</example> | COMMENT |
| LOW | …i.SourceGenerators.Tests/OperationTests.MinimalApis.cs | 496 | Assert.Equal("user@example.com", path19.Parameters[1].Example.GetValue<string>()); | STRING |
| LOW | …malApis#OpenApiXmlCommentSupport.generated.verified.cs | 65 | cache.Add(@"P:MixedParametersClass.Email", new XmlComment(@"The user's email address.", null, null, null, nu | CODE |
| 33 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | eng/common/core-templates/stages/renovate.yml | 1 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/stages/renovate.yml | 3 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/stages/renovate.yml | 9 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/job/renovate.yml | 1 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/job/renovate.yml | 3 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/job/renovate.yml | 17 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/validate-pat-pool.yml | 33 | # ----------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/validate-pat-pool.yml | 37 | # ----------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/validate-pat-pool.yml | 139 | # ----------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/validate-pat-pool.yml | 141 | # ----------------------------------------------------------- | COMMENT |
| MEDIUM | …omponents/Testing/test/GenerateE2EManifestTaskTests.cs | 31 | // ── build mode + Build scenario (local dev) ────────────────────── | COMMENT |
| MEDIUM | …omponents/Testing/test/GenerateE2EManifestTaskTests.cs | 56 | // ── build mode + Publish scenario ──────────────────────────────── | COMMENT |
| MEDIUM | …omponents/Testing/test/GenerateE2EManifestTaskTests.cs | 94 | // ── publish mode + Publish scenario (exe found) ────────────────── | COMMENT |
| MEDIUM | …omponents/Testing/test/GenerateE2EManifestTaskTests.cs | 122 | // ── publish mode + Publish scenario (dll only) ─────────────────── | COMMENT |
| MEDIUM | …omponents/Testing/test/GenerateE2EManifestTaskTests.cs | 163 | // ── all mode + Publish scenario ────────────────────────────────── | COMMENT |
| MEDIUM | …omponents/Testing/test/GenerateE2EManifestTaskTests.cs | 201 | // ── Custom E2EAppsRelativeDir ──────────────────────────────────── | COMMENT |
| MEDIUM | …omponents/Testing/test/GenerateE2EManifestTaskTests.cs | 223 | // ── Multiple apps ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …omponents/Testing/test/GenerateE2EManifestTaskTests.cs | 245 | // ── PublicUrl metadata flows through ───────────────────────────── | COMMENT |
| MEDIUM | …omponents/Testing/test/GenerateE2EManifestTaskTests.cs | 386 | // ── Helpers ────────────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/CrossCuttingGuidance.md | 71 | ### Options, configuration, and dependency injection | COMMENT |
| MEDIUM | .github/dependabot.yml | 414 | # Actions pinned in the generated agentic .lock.yml files, managed by gh aw | COMMENT |
| MEDIUM | .github/workflows/pr-docs-check.md | 57 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | …kflows/agentics-maintenance-dotnet-AspNetCore.Docs.yml | 24 | # This file is the agentic maintenance workflow for the SideRepoOps target | COMMENT |
| MEDIUM | .github/workflows/cswin32-update.md | 53 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/community-pr-issue-check.md | 33 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/issue-triage-agent.md | 129 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/test-quarantine.md | 2117 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/browsertesting-deps-update.md | 49 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/shared/pat_pool.README.md | 82 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/shared/pat_pool.README.md | 214 | [configure-repo]: https://github.github.com/gh-aw/guides/agentic-authoring/#configuring-your-repository | CODE |
| MEDIUM | .github/agents/agentic-workflows.md | 45 | - Configuration: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agentic-workflows.md` | CODE |
| MEDIUM⚡ | .github/agents/agentic-workflows.md | 69 | **Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-agentic-workflow.md` | CODE |
| MEDIUM⚡ | .github/agents/agentic-workflows.md | 79 | **Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/update-agentic-workflow.md` | CODE |
| MEDIUM⚡ | .github/agents/agentic-workflows.md | 89 | **Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/debug-agentic-workflow.md` | CODE |
| MEDIUM⚡ | .github/agents/agentic-workflows.md | 99 | **Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/upgrade-agentic-workflows.md` | CODE |
| MEDIUM | .github/agents/agentic-workflows.md | 119 | **Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-shared-agentic-workflow.md` | CODE |
| MEDIUM | .github/agents/agentic-workflows.md | 193 | # Initialize repository for agentic workflows | COMMENT |
| MEDIUM | .github/agents/agentic-workflows.md | 225 | - Always reference the instructions file at `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agent | CODE |
| MEDIUM | src/Analyzers/Analyzers/src/UseAuthorizationAnalyzer.cs | 87 | // We'll avoid doing any analysis in this event and rely on the runtime guardrails. | COMMENT |
| MEDIUM | src/Components/AGENTS.md | 78 | If WebDriver cannot perform or observe one operation, keep the permanent C# Selenium scenario, name the exact WebDriver | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | eng/common/cross/install-debs.py | 126 | # keyboxd, which makes it robust on hosts running GnuPG 2.4+ (e.g. Azure | COMMENT |
| LOW | …ommon/core-templates/steps/enable-internal-sources.yml | 34 | # If running on dnceng (internal project), just use the default behavior for NuGetAuthenticate. | COMMENT |
| MEDIUM | eng/skill-evals/pr-attention-queue/eval.vally.yaml | 32 | # An active mutation-refusal test needs a runtime harness first: a token scoped | COMMENT |
| MEDIUM | .devcontainer/scripts/container-creation.sh | 14 | # Add .NET Dev Certs to environment to facilitate debugging. | COMMENT |
| MEDIUM | src/Mvc/Mvc.TagHelpers/src/FormTagHelper.cs | 260 | // A <form> tag that doesn't utilize asp-* attributes. Let it flow to the output. | COMMENT |
| MEDIUM | src/SignalR/server/Core/src/Internal/Utf8HashLookup.cs | 14 | /// This type is not robust against hash collision attacks. DO NOT add arbitrary adversary-influenced keys to the collec | COMMENT |
| MEDIUM | …ts/Web.JS/src/Services/ComponentDescriptorDiscovery.ts | 278 | // comment invalid. We could unencode them in .NET Code, but that would be slower to do and we can leverage the fact t | COMMENT |
| MEDIUM | src/Components/Web.JS/src/Validation/DomUtils.ts | 62 | // Use getComputedStyle for robust visibility detection covering CSS classes, stylesheets, | COMMENT |
| MEDIUM | src/Components/Web/src/WebRenderer.cs | 119 | // parameters, we utilize the source-generated WebRendererSerializerContext | COMMENT |
| MEDIUM | src/Components/Components/src/ChangeDetection.cs | 33 | if (oldValueType != newValueType // Definitely different | CODE |
| MEDIUM | …nents/Components/src/Reflection/ComponentProperties.cs | 320 | // SupplyParameterFromQuery feature that did not utilize cascading values, and thus did not have this li | COMMENT |
| MEDIUM | src/Http/Headers/src/SetCookieHeaderValue.cs | 161 | /// "SameSite" cookies offer a robust defense against CSRF attack when | COMMENT |
| MEDIUM | src/Http/Http.Extensions/src/RequestDelegateFactory.cs | 792 | // For complex types, leverage the shared form binding infrastructure. For example, | COMMENT |
| MEDIUM | src/Http/Http.Extensions/src/RequestDelegateFactory.cs | 2689 | // leverage the STJ polymorphism support. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/cross/install-debs.py | 20 | CODE | |
| LOW | eng/common/cross/install-debs.py | 196 | CODE | |
| LOW | eng/common/cross/install-debs.py | 221 | CODE | |
| LOW | eng/common/cross/install-debs.py | 259 | CODE | |
| LOW | eng/common/cross/install-debs.py | 293 | CODE | |
| LOW | eng/common/cross/install-debs.py | 348 | CODE | |
| LOW | …/test-quarantine/test_validate_pull_request_outputs.py | 325 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 98 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 209 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 231 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 330 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 384 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 475 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1018 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1304 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1441 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 1565 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2008 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2364 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2452 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2772 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 3033 | CODE | |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 2047 | CODE | |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 335 | CODE | |
| LOW | …pts/test-quarantine/test_collect_case_a_eligibility.py | 2205 | CODE | |
| LOW | …ripts/test-quarantine/validate_pull_request_outputs.py | 121 | CODE | |
| LOW | …ripts/test-quarantine/validate_pull_request_outputs.py | 565 | CODE | |
| LOW | .github/workflows/pr-docs-check/find_existing_draft.py | 14 | CODE | |
| LOW | .github/workflows/pr-docs-check/test_runtime_wiring.py | 114 | CODE | |
| LOW | .github/workflows/pr-docs-check/test_runtime_wiring.py | 183 | CODE | |
| LOW | .github/workflows/pr-docs-check/test_runtime_wiring.py | 126 | CODE | |
| LOW | …ithub/workflows/pr-docs-check/test_validate_outcome.py | 148 | CODE | |
| LOW | .github/workflows/pr-docs-check/test_rerun.py | 89 | CODE | |
| LOW | .github/workflows/pr-docs-check/test_rerun.py | 176 | CODE | |
| LOW | .github/workflows/pr-docs-check/test_rerun.py | 191 | CODE | |
| LOW | .github/workflows/pr-docs-check/test_rerun.py | 231 | CODE | |
| LOW | .github/workflows/pr-docs-check/prepare_run.py | 41 | CODE | |
| LOW | .github/workflows/pr-docs-check/prepare_context.py | 64 | CODE | |
| LOW | .github/workflows/pr-docs-check/prepare_context.py | 85 | CODE | |
| LOW | .github/workflows/pr-docs-check/prepare_context.py | 114 | CODE | |
| LOW | .github/workflows/pr-docs-check/test_branch_identity.py | 56 | CODE | |
| LOW | .github/workflows/pr-docs-check/validate_outcome.py | 208 | CODE | |
| LOW | .github/workflows/pr-docs-check/validate_outcome.py | 424 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | eng/common/cross/install-debs.py | 42 | print(f"Error downloading {url}: {type(e).__name__} - {e}. Retrying...") | CODE |
| MEDIUM | eng/common/cross/install-debs.py | 206 | print(f"Error: Package '{current}' was not found in the available packages.") | CODE |
| LOW | .github/workflows/test-quarantine.lock.yml | 3901 | except Exception as e: | CODE |
| LOW | .github/workflows/test-quarantine.lock.yml | 3972 | except Exception: | CODE |
| LOW | .github/workflows/test-quarantine.lock.yml | 4130 | except Exception as e: | CODE |
| LOW | .github/workflows/test-quarantine.lock.yml | 4314 | except Exception as ex: | CODE |
| LOW | .github/workflows/test-quarantine.lock.yml | 4571 | except Exception as ex: | CODE |
| LOW | .github/workflows/test-quarantine.md | 415 | except Exception as e: | CODE |
| LOW | .github/workflows/test-quarantine.md | 486 | except Exception: | CODE |
| LOW | .github/workflows/test-quarantine.md | 645 | except Exception as e: | CODE |
| LOW | .github/workflows/test-quarantine.md | 829 | except Exception as ex: | CODE |
| LOW | .github/workflows/test-quarantine.md | 1086 | except Exception as ex: | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 3315 | except Exception: | CODE |
| LOW | …/scripts/test-quarantine/collect_case_a_eligibility.py | 3346 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …S/src/Rendering/RenderBatch/SharedMemoryRenderBatch.ts | 11 | // In this implementation, all the DTO types are really heap pointers at runtime, hence all | COMMENT |
| HIGH | …ebAssembly/src/Hosting/WebAssemblyHostConfiguration.cs | 38 | // In this implementation, this largely exists as a way to satisfy the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/tools.sh | 337 | # Check if the script is older than 30 days using timestamp file | COMMENT |
| LOW | eng/common/tools.sh | 446 | # Check if the toolset has already been extracted | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 66 | # Check if disabledPackageSources section exists | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 72 | # Check if this source name is disabled | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 92 | # Check if source already exists | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 122 | # Check if disabledPackageSources section exists | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 192 | # Check if there is no existing credential for this FeedName | COMMENT |
| LOW | eng/common/core-templates/steps/source-build.yml | 31 | # Check if AzDO substitutes in a build config from a variable, and use it if so. | COMMENT |
| LOW | eng/common/core-templates/steps/install-microbuild.yml | 64 | # Check if ESRP is disabled while SignType is real | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | eng/build.sh | 376 | # Initialize global variables need to be set before the import of Arcade is imported | COMMENT |
| MEDIUM | eng/common/cross/build-rootfs.sh | 693 | # Create the symlink in the same directory | COMMENT |
| MEDIUM | eng/common/core-templates/job/helix-job-monitor.yml | 217 | # Create a minimal NuGet.config that only references the local nupkg directory. | COMMENT |
| MEDIUM | …kflows/agentics-maintenance-dotnet-AspNetCore.Docs.yml | 24 | # This file is the agentic maintenance workflow for the SideRepoOps target | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/native/install-dependencies.sh | 7 | # Usage: | COMMENT |
| LOW | …common/templates-official/variables/pool-providers.yml | 12 | # How to use: | COMMENT |
| LOW | eng/common/templates/variables/pool-providers.yml | 12 | # How to use: | COMMENT |
| LOW⚡ | eng/common/core-templates/job/renovate.yml | 11 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …jectTemplates/content/McpServer-CSharp/local/README.md | 69 | 2. Publish to NuGet.org with `dotnet nuget push bin/Release/*.nupkg --api-key <your-api-key> --source https://api.nuget. | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ent/McpServer-CSharp/common/Tools/RandomNumberTools.cs | 5 | /// Sample MCP tools for demonstration purposes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .github/workflows/pr-docs-check/test_runtime_wiring.py | 266 | self.assertIn("github.event.pull_request.number || inputs.pr_number", workflow) | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …y/EntityFrameworkCore/test/EF.Test/SqlStoreTestBase.cs | 17 | // TODO: Add test variation with non IdentityDbContext | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/cross/install-debs.py | 18 | CODE |