ASP.NET Core Razor 9.0

Last reviewed Sep 23, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. C# 13112 lines · 4.2K tokens
  2. ASP.NET Core 9.072 lines · 3.7K tokens
  3. ASP.NET Core Razor 9.063 lines · 3K tokens
Total247 lines · 10.9K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 89
  • 94
  • 117
  • 190
  • 201
  • 203
  • 208
  • 209
  • 214
  • 257
  • 295
  • 306
  • 307
  • 312
  • 319
  • 323
  • 327
  • 328
  • 338
  • 347
  • 352
  • 362
  • 367
  • 384
  • 426
  • 434
  • 488
  • 502
  • 524
  • 525
  • 532
  • 552
  • 601
  • 602
  • 611
  • 613
  • 614
  • 636
  • 639
  • 759
  • 770
  • 772
  • 798
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1004
  • 1173
  • 1275
  • 1333
  • 1385
  • 1395

Prompt Preview

Use this prompt after the ASP.NET Core 9.0 baseline for .cshtml Razor Pages and MVC views targeting net9.0. Keep separately referenced Razor packages, such as Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation, on the same 9.0 servicing release as the runtime; updating the runtime doesn't update them. .NET 9 is in maintenance support through November 10, 2026; migrate before support ends.

Supported code and view discovery

  • Regard every .cshtml page, view, partial, layout, _ViewImports.cshtml, _ViewStart.cshtml, Tag Helper, View Component, and Razor class library as executable application code. Source, review, build, and deploy it through the same trusted path as C# code; Razor isn't a sandbox for hostile templates.
  • Select page, view, layout, partial, and View Component names from server-owned constants or a finite allowlist. Never concatenate route, query, form, tenant, locale, theme, or database values into a view name or filesystem path.
  • Restrict customized RazorViewEngineOptions.ViewLocationFormats and runtime-compilation file providers to known, read-only application roots. Do not add content stores, uploads, temporary directories, or tenant-controlled trees to Razor discovery.
  • When implementing IViewLocationExpander, put every validated tenant, theme, or culture discriminator used by ExpandViewLocations into PopulateValues through context.Values. Those values participate in the view-location cache key; omitting one can reuse another context's selected template. Resolve discriminators to approved locations before expanding paths.