C#: Relax condition for authorize attributes on cs/web/missing-function-level-access-control.

[michaelnebel]

The change note was made mostly using CoPilot chat.
With the right context (the query, query module and another change note) it produced reasonable output.

DCA is uneventful.

[Copilot]

Pull Request Overview

This PR relaxes the authorization conditions in the missing-function-level-access-control query and enhances test coverage around authorization attributes.

• Introduces a new RequirePermissionAttribute (extending AuthorizeAttribute) for testing inheritance-based authorization
• Reformats several controller action methods to improve clarity in the test cases
• Updates the change note to document improved detection of authorization checks

Reviewed Changes

Copilot reviewed 2 out of 5 changed files in this pull request and generated no comments.

File	Description
csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/ProfileController.cs	Updated test controllers with various authorization scenarios, including the new RequirePermissionAttribute
csharp/ql/src/change-notes/2025-04-15-missing-function-level-access-control.md	Added change note documenting enhanced query detection for authorization checks

Files not reviewed (3)

• csharp/ql/lib/semmle/code/csharp/security/auth/MissingFunctionLevelAccessControlQuery.qll: Language not supported
• csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/MissingAccessControl.expected: Language not supported
• csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/MissingAccessControl.qlref: Language not supported

Comments suppressed due to low confidence (2)

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/ProfileController.cs:12

• [nitpick] The '// $ Alert' marker is used to indicate a test case for missing authorization; consider adding a brief comment explaining its purpose to avoid confusion for new readers.

public ActionResult Delete1(int id) // $ Alert

csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/MVCTests/ProfileController.cs:23

• Using 'return null;' in an action method may cause unexpected behavior; consider returning a proper ActionResult (e.g., a ForbiddenResult) if this branch is meant to simulate unauthorized access.

return null;