CodeQL cannot parse HTTP annotations in decompiled C# code.

[wooyune1]

Hi CodeQL team. I'm trying to use CodeQL for taint analysis on decompiled C# code. Most features work as expected, but it fails to parse HTTP annotations properly. An example is below and we can see that the decompiled code is similiar to original code. Could you help explain why this happen and suggest how to resolve it?

  [HttpPost]
  [Microsoft.AspNetCore.Mvc.Route("cms/material/message/actions/delete")]
  public async Task<ActionResult<BoolResult>> Delete([FromBody] MessageController.DeleteRequest request)
  {
    MessageController messageController = this;
    if (!await messageController._authManager.HasSitePermissionsAsync(request.SiteId, "site_materialMessage"))
      return ActionResult<BoolResult>.op_Implicit((ActionResult) messageController.Unauthorized());
    int num = await messageController._materialMessageRepository.DeleteAsync(request.Id) ? 1 : 0;
    return ActionResult<BoolResult>.op_Implicit(new BoolResult()
    {
      Value = true
    });
  }

[hvitved]

Hi

Could you elaborate on the failure that you get?

[wooyune1]

Hi @hvitved. When I query the annotations of the "delete" function, both results show "(no string representation)".

predicate getAttributes(Attribute attribute) {
  exists(Callable callable|
    callable.getFile().toString().matches("%MessageController.cs%")
    and callable.getName() = "Delete"
    and callable.(Method).getAnAttribute() = attribute
  )
}