C#: Address review comments.

michaelnebel · michaelnebel · commit 1dcc6ac2b1d8 · 2024-09-25T17:06:19.000+02:00
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Html.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Html.qll
@@ -61,6 +61,7 @@ class HtmlTextWriterSink extends HtmlSink {
 deprecated class AttributeCollectionSink extends DataFlow::ExprNode {
   AttributeCollectionSink() {
     exists(SystemWebUIAttributeCollectionClass ac, Parameter p |
+      p = ac.getAddMethod().getParameter(1) or
       p = ac.getItemProperty().getSetter().getParameter(0)
     |
       this.getExpr() = p.getAnAssignedArgument()
diff --git a/csharp/ql/src/change-notes/2024-09-25-attribute-collection-sink.md b/csharp/ql/src/change-notes/2024-09-25-attribute-collection-sink.md
@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* C#: The indexer and `Add` method on `System.Web.UI.AttributeCollection` is no longer considered a HTML sink.
+* C#: The indexer and `Add` method on `System.Web.UI.AttributeCollection` is no longer considered an HTML sink.

Original file line number	Diff line number	Diff line change
`@@ -61,6 +61,7 @@ class HtmlTextWriterSink extends HtmlSink {`
`61`	`61`	`deprecated class AttributeCollectionSink extends DataFlow::ExprNode {`
`62`	`62`	`AttributeCollectionSink() {`
`63`	`63`	`exists(SystemWebUIAttributeCollectionClass ac, Parameter p \|`
	`64`	`+ p = ac.getAddMethod().getParameter(1) or`
`64`	`65`	`p = ac.getItemProperty().getSetter().getParameter(0)`
`65`	`66`	`\|`
`66`	`67`	`this.getExpr() = p.getAnAssignedArgument()`