What the developer wrote
Authored by Nicolas Dorier
Avoid unintended route
What changed, and why it matters
This small change marks an internal base class called VaultController with [NonController] so ASP.NET MVC does not accidentally expose it as a public web route. Without this attribute, MVC's route discovery could have treated derived vault controllers as reachable HTTP endpoints, potentially exposing internal hardware-wallet/vault operations over the web.
Review all derived VaultController implementations to confirm no other route exposure exists, and verify that intended vault endpoints remain reachable only through the correct Blazor/bridge channel. Consider adding tests that enumerate discovered routes to detect future accidental controller registration.
Security signals we found
Unintended route exposure prevented
Controller discovery disabled for internal bridge component
Potential unauthorized access to vault/HW wallet bridge operations
Evidence from the diff
The commit adds [NonController] to the abstract base class BTCPayServer.Blazor.VaultBridge.VaultController. In ASP.NET Core, any class whose name ends in ‘Controller’ and implements IController (or inherits from Controller/ControllerBase) can be discovered and routed by the framework unless explicitly excluded. The IController interface implementation here likely made derived types candidates for conventional routing. The [NonController] attribute prevents MVC from treating these types as controllers, blocking unintended route registration.
Changed components
BTCPayServer/Blazor/VaultBridge/VaultController.csInspect captured patch +2 / −0
### BTCPayServer/Blazor/VaultBridge/VaultController.cs
@@ -1,9 +1,11 @@
using System.Threading;
using System.Threading.Tasks;
using BTCPayServer.Blazor.VaultBridge.Elements;
+using Microsoft.AspNetCore.Mvc;
namespace BTCPayServer.Blazor.VaultBridge;
+[NonController]
public abstract class VaultController : IController
{
protected abstract string VaultUri { get; }Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.