ASP.NET Core Razor 10.0

Last reviewed Sep 19, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. C# 14106 lines · 4.4K tokens
  2. ASP.NET Core 10.065 lines · 3.5K tokens
  3. ASP.NET Core Razor 10.064 lines · 2.8K tokens
Total235 lines · 10.6K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 89
  • 94
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 257
  • 295
  • 307
  • 312
  • 319
  • 323
  • 327
  • 338
  • 352
  • 362
  • 367
  • 378
  • 426
  • 434
  • 488
  • 502
  • 524
  • 525
  • 532
  • 552
  • 601
  • 602
  • 611
  • 613
  • 614
  • 636
  • 639
  • 674
  • 759
  • 770
  • 772
  • 775
  • 778
  • 798
  • 807
  • 862
  • 863
  • 915
  • 916
  • 918
  • 942
  • 1004
  • 1173
  • 1275
  • 1333
  • 1385
  • 1395

Prompt Preview

Apply the ASP.NET Core 10.0 prompt first. These rules cover .cshtml Razor Pages and MVC views targeting net10.0 on a supported .NET 10 servicing release. Blazor .razor components have a separate security model.

Trusted code, discovery, and compilation

  • Treat .cshtml, _ViewImports.cshtml, _ViewStart.cshtml, layouts, Tag Helpers, and Razor class libraries as application code. Never compile user-authored templates; keep uploads and tenant-writable files outside Razor discovery and compilation roots.
  • Keep RazorViewEngineOptions view-location formats, ViewLocationExpanders, and RazorPagesOptions.RootDirectory under application control. Map external theme or template selectors to an allowlist of trusted names before passing them to View, Partial, Layout, or Component.InvokeAsync.
  • Include every trusted tenant, theme, or culture value that changes view selection in IViewLocationExpander.PopulateValues through context.Values; those values participate in the view-location cache key. Do not derive search paths directly from request text.
  • Review application overrides of Razor class library pages and views when updating the library: an application's matching .cshtml takes precedence over the library copy, so an old override can retain old security behavior.
  • Preserve the Razor SDK's default build-time and publish-time compilation through RazorCompileOnBuild and RazorCompileOnPublish. Remove AddRazorRuntimeCompilation and runtime-compilation hosting-startup activation from production; runtime compilation is obsolete in .NET 10. Use Hot