apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/dotnet/legacy_aspnet_plugin.py

@@ -0,0 +1,732 @@
+"""
+Legacy ASP.NET framework plugin (System.Web.Mvc / System.Web.Http).
+
+Supports:
+- ASP.NET MVC 5 (System.Web.Mvc.Controller)
+- ASP.NET Web API 2 (System.Web.Http.ApiController)
+- Attribute routing: [RoutePrefix] on class, [Route] on method
+- Conventional routing: /{Controller}/{action} (MVC), /api/{Controller} (Web API)
+- HTTP verb attributes: [HttpGet], [HttpPost], [HttpPut], [HttpDelete], [HttpPatch]
+- Auth: [Authorize], [AllowAnonymous] (class- and method-level)
+- Parameter binding: [FromUri] (query/path), [FromBody], [FromRoute], [FromHeader]
+- Global filter auth: GlobalFilters.Filters.Add(new AuthorizeAttribute())
+- Forms/Windows authentication registration detection
+"""
+
+from __future__ import annotations
+
+import contextlib
+import re
+from pathlib import Path
+from typing import TYPE_CHECKING, ClassVar
+
+from ...core.types import (
+    AuthSchemeType,
+    CodeLocation,
+    Confidence,
+    Framework,
+    HttpMethod,
+    Language,
+    ParameterLocation,
+    QualifiedName,
+)
+from ...parsing.base import ParsedClass, ParsedFile, ParsedFunction
+from ...parsing.csharp.literals import parse_csharp_string_literal
+from ...parsing.services import AnalysisContext
+from ..base import (
+    ExtractedAuthScheme,
+    ExtractedBody,
+    ExtractedParameter,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+from .aspnet_plugin import AspNetCorePlugin
+
+if TYPE_CHECKING:
+    pass
+
+# =============================================================================
+# Constants
+# =============================================================================
+
+_LEGACY_IMPORTS: frozenset[str] = frozenset(
+    {
+        "System.Web.Mvc",
+        "System.Web.Http",
+        "System.Web.Http.ApiExplorer",
+        "System.Web.Http.Cors",
+        "System.Web.Http.Filters",
+        "System.Web.Http.Results",
+        "System.Web.Routing",
+    }
+)
+
+# ApiController base implies Web API 2; Controller base implies MVC 5
+_WEB_API_BASES: frozenset[str] = frozenset({"ApiController"})
+
+# Auth-related global filter / config class name substrings
+_AUTH_CLASS_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "filterconfig",
+        "globalfilter",
+        "startup",
+        "authconfig",
+        "webapiconfiguration",
+        "webapiconfig",
+    }
+)
+
+
+# =============================================================================
+# LegacyAspNetPlugin
+# =============================================================================
+
+
+class LegacyAspNetPlugin(AspNetCorePlugin):
+    """
+    Framework plugin for legacy ASP.NET (System.Web.Mvc / System.Web.Http).
+
+    Inherits route-extraction, auth-dep, and parameter-parsing logic from
+    AspNetCorePlugin and overrides only the pieces that differ:
+
+    - Detection: requires System.Web.Mvc or System.Web.Http import
+    - Class prefix: [RoutePrefix] takes priority over [Route] on class
+    - Conventional fallback: /api/{Controller} for ApiController subclasses
+    - Parameter binding: [FromUri] mapped to query/path (Web API convention)
+    - Auth registration: FormsAuthentication, Windows, GlobalFilters patterns
+    """
+
+    FRAMEWORK: ClassVar[Framework] = Framework.ASPNET_LEGACY
+    LANGUAGE: ClassVar[Language] = Language.CSHARP
+    DETECTION_IMPORTS: ClassVar[frozenset[str]] = _LEGACY_IMPORTS
+
+    # -------------------------------------------------------------------------
+    # Detection
+    # -------------------------------------------------------------------------
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        for imp in parsed_file.imports:
+            module = imp.module or ""
+            if module.startswith("System.Web.Mvc") or module.startswith("System.Web.Http"):
+                return True
+        return False
+
+    # -------------------------------------------------------------------------
+    # Route extraction overrides
+    # -------------------------------------------------------------------------
+
+    def extract_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        # Orchard CMS modules ship a `Module.txt` manifest beside their
+        # `Controllers/` directory and are routed by Orchard's runtime
+        # `StandardExtensionRouteProvider` rather than the global MVC
+        # route table.  When this file is inside an Orchard module, the
+        # default Legacy MVC 5 routing convention doesn't apply — divert
+        # to the module-aware composition.
+        orchard_module = _detect_orchard_module(parsed_file.path)
+        if orchard_module is not None:
+            return self._extract_orchard_module_routes(
+                parsed_file,
+                orchard_module,
+                context,
+            )
+
+        routes: list[ExtractedRoute] = []
+        maproute_overrides = self._project_maproute_overrides(context, parsed_file)
+
+        for cls in parsed_file.classes:
+            if not self._is_controller(cls):
+                continue
+
+            class_prefix = self._get_class_prefix(cls, parsed_file)
+
+            # Conventional routing applies when the controller has no
+            # class-level `[Route]` attribute.  Note: `[RoutePrefix]` is NOT
+            # excluded here — a prefix is just a prefix, not a full URL, so
+            # the downstream Web API 2 path template (`api/{controller}/{id?}`)
+            # still applies for methods without their own `[Route]`.  E.g.
+            # `[RoutePrefix("api/v1/orders")]` + `Get(int id)` (no method
+            # `[Route]`) → `/api/v1/orders/{id}`, not `/api/v1/orders`.
+            #
+            # We also consult `_is_controller` rather than re-checking the
+            # narrow base-class set, so the name-suffix heuristic (e.g.
+            # `BasePublicController : Controller`) participates too.
+            is_conventional = not any(
+                d.name == "Route" for d in cls.decorators
+            ) and self._is_controller(cls)
+
+            for method in cls.methods:
+                routes.extend(
+                    self._extract_routes_from_method(
+                        method,
+                        class_prefix,
+                        cls,
+                        parsed_file,
+                        context,
+                        is_conventional_mvc=is_conventional,
+                        maproute_overrides=maproute_overrides,
+                    )
+                )
+
+        # Legacy ASP.NET has no Minimal API or IEndpointGroup equivalents
+        return routes
+
+    def _extract_orchard_module_routes(
+        self,
+        parsed_file: ParsedFile,
+        module_name: str,
+        context: AnalysisContext | None,
+    ) -> list[ExtractedRoute]:
+        """
+        Emit routes for a controller in an Orchard module.
+
+        Orchard's `StandardExtensionRouteProvider` registers two URL
+        templates per loaded module:
+
+            admin:  /Admin/<displayPath>/{action}/{id}
+            front:  /<displayPath>/{controller}/{action}/{id}
+
+        where `displayPath` is the module folder name.  Per-module
+        `Routes.cs` files (IRouteProvider impls) can register additional
+        hand-defined patterns alongside the default convention; those
+        are out of scope for this pass and would need their own parser
+        — same shape as the WCF programmatic-endpoint discovery.
+
+        Reference: src/Orchard/Mvc/Routes/StandardExtensionRouteProvider.cs:49
+        """
+        routes: list[ExtractedRoute] = []
+        # One source read for the whole file — used for per-method access
+        # modifier inspection.  `ParsedFunction` doesn't track access
+        # modifiers (only `ParsedField` does); we read the source line
+        # for the method declaration and look for `public`.
+        source_lines = _read_source_lines(parsed_file.path)
+        for cls in parsed_file.classes:
+            if not self._is_controller(cls):
+                continue
+            # Abstract controllers exist only to be subclassed — their
+            # methods are infrastructure, not route surface.  ASP.NET
+            # MVC's runtime routing won't dispatch to an abstract type.
+            if cls.is_abstract:
+                continue
+            # A controller in an Orchard module that declares its own
+            # `[RoutePrefix]` or class-level `[Route]` opts out of the
+            # module convention — at runtime, attribute routing takes
+            # precedence over `StandardExtensionRouteProvider`.  Defer
+            # to the inherited attribute-routing logic for that class.
+            if any(d.name in ("Route", "RoutePrefix") for d in cls.decorators):
+                class_prefix = self._get_class_prefix(cls, parsed_file)
+                is_conventional = not any(d.name == "Route" for d in cls.decorators)
+                for method in cls.methods:
+                    if not _method_is_public(method, source_lines):
+                        continue
+                    routes.extend(
+                        self._extract_routes_from_method(
+                            method,
+                            class_prefix,
+                            cls,
+                            parsed_file,
+                            context,
+                            is_conventional_mvc=is_conventional,
+                            maproute_overrides=None,
+                        )
+                    )
+                continue
+            # Web API 2 (`: ApiController`) and MVC 5 (`: Controller`)
+            # are routed by DIFFERENT Orchard providers:
+            #   MVC 5  → StandardExtensionRouteProvider.cs:49
+            #     /<displayPath>/{controller}/{action}/{id} (front)
+            #     /Admin/<displayPath>/{action}/{id} (admin)
+            #   Web API 2 → StandardExtensionHttpRouteProvider.cs:32
+            #     api/<displayPath>/{controller}/{id} (verb-based, no action)
+            is_api_controller = any(self._base_name(b) == "ApiController" for b in cls.base_classes)
+            controller_name = cls.name
+            if controller_name.endswith("Controller"):
+                controller_name = controller_name[: -len("Controller")]
+            if is_api_controller:
+                class_prefix = f"/api/{module_name}/{controller_name}"
+            elif controller_name == "Admin":
+                class_prefix = f"/Admin/{module_name}"
+            else:
+                class_prefix = f"/{module_name}/{controller_name}"
+
+            for method in cls.methods:
+                # Skip non-public methods — MVC routing requires `public`.
+                # Internal overloads (e.g. `internal ActionResult
+                # EditPOST(int id, string returnUrl)`) and private helpers
+                # are implementation, not route surface.
+                if not _method_is_public(method, source_lines):
+                    continue
+                method_routes = self._extract_routes_from_method(
+                    method,
+                    class_prefix,
+                    cls,
+                    parsed_file,
+                    context,
+                    is_conventional_mvc=True,
+                    maproute_overrides=None,
+                )
+                # Web API 2: verb-based routing — no action segment in URL.
+                # Multiple methods with different `[HttpGet]`/`[HttpPost]`
+                # attributes share the same URL.
+                #
+                # MVC 5: force the Orchard URL template
+                # `<prefix>/<action>/{id}` — overrides the inherited
+                # convention which (a) strips "Index" as the MVC 5
+                # default action and (b) doesn't append `/{id}`.
+                #
+                # `[ActionName("Foo")]` aliases the URL action segment
+                # for MVC 5; multiple C# methods can share one URL via
+                # this attribute + `[FormValueRequired]` filters.
+                if is_api_controller:
+                    for r in method_routes:
+                        r.path = f"{class_prefix}/{{id}}"
+                else:
+                    action_name = self._orchard_action_name(method)
+                    for r in method_routes:
+                        r.path = f"{class_prefix}/{action_name}/{{id}}"
+                routes.extend(method_routes)
+
+        # Routes.cs files in an Orchard module can implement
+        # `IRouteProvider` and register additional `new Route("URL", ...)`
+        # patterns alongside the default convention (e.g. `/rss`,
+        # `/Admin/Reports`, `/{*path}`).  Emit one route per call.
+        if any(
+            self._base_name(b) == "IRouteProvider"
+            for cls in parsed_file.classes
+            for b in cls.base_classes
+        ):
+            routes.extend(self._extract_iroute_provider_routes(parsed_file))
+        return routes
+
+    @staticmethod
+    def _base_name(base: str) -> str:
+        return base.rsplit(".", 1)[-1]
+
+    def _extract_iroute_provider_routes(
+        self,
+        parsed_file: ParsedFile,
+    ) -> list[ExtractedRoute]:
+        """Parse `new Route("URL", { ... })` calls in an Orchard
+        `IRouteProvider` implementation file.  Each call becomes one
+        emitted route at the URL-string-literal line."""
+        if parsed_file.path is None:
+            return []
+        try:
+            text = Path(parsed_file.path).read_text(
+                encoding="utf-8",
+                errors="replace",
+            )
+        except OSError:
+            return []
+
+        routes: list[ExtractedRoute] = []
+        for match in _NEW_ROUTE_RE.finditer(text):
+            parsed = _parse_route_call_args(text, match.end())
+            if parsed is None:
+                continue
+            url_pattern, controller, action, url_offset = parsed
+            path = "/" + url_pattern.lstrip("/")
+            line_num = text.count("\n", 0, url_offset) + 1
+
+            handler_label = (
+                f"{(controller or 'Home').title()}Controller.{(action or 'Index').title()}"
+            )
+            handler_qname = QualifiedName(module="", name=handler_label)
+
+            routes.append(
+                ExtractedRoute(
+                    method=HttpMethod.GET,
+                    path=path,
+                    handler_function=handler_qname,
+                    handler_location=CodeLocation(
+                        file=Path(parsed_file.path),
+                        line=line_num,
+                    ),
+                    tags=["aspnet_legacy", "orchard_route_provider"],
+                    confidence=Confidence.MEDIUM,
+                    kind="http",
+                )
+            )
+        return routes
+
+    def _orchard_action_name(self, method: ParsedFunction) -> str:
+        """Return the URL action segment for an Orchard module action.
+
+        `[ActionName("Foo")]` aliases the URL action regardless of the
+        C# method name; without it the C# method name is used verbatim.
+        """
+        for dec in method.decorators:
+            if dec.name == "ActionName":
+                alias = self._dec_path(dec)
+                if alias:
+                    return alias
+        return method.name
+
+    def _get_class_prefix(self, cls: ParsedClass, parsed_file: ParsedFile) -> str:
+        """
+        Resolve class-level route prefix.
+
+        Priority order:
+        1. [RoutePrefix("api/values")] — Web API 2 attribute
+        2. [Route("prefix")] — both MVC 5 and Web API 2
+        3. Conventional fallback:
+           - ApiController subclass → /api/{ControllerName}
+           - Controller subclass → /{ControllerName}
+        """
+        controller_name = cls.name
+        if controller_name.endswith("Controller"):
+            controller_name = controller_name[: -len("Controller")]
+
+        for dec in cls.decorators:
+            if dec.name == "RoutePrefix":
+                path = self._dec_path(dec)
+                if path:
+                    path = path.replace("[controller]", controller_name)
+                    path = path.replace("[Controller]", controller_name)
+                    return ("/" + path.strip("/")).rstrip("/")
+
+        for dec in cls.decorators:
+            if dec.name == "Route":
+                path = self._dec_path(dec)
+                if path:
+                    path = path.replace("[controller]", controller_name)
+                    path = path.replace("[Controller]", controller_name)
+                    return path.rstrip("/")
+
+        # Conventional routing fallback.  ApiController subclass → /api/{x};
+        # any other recognised controller (incl. intermediate-base subclasses
+        # like BasePublicController) → /{x}.
+        for base in cls.base_classes:
+            simple = base.rsplit(".", 1)[-1]
+            if simple in _WEB_API_BASES:
+                return f"/api/{controller_name}"
+        if self._is_controller(cls):
+            return f"/{controller_name}"
+        return ""
+
+    def _extract_params(
+        self,
+        method: ParsedFunction,
+        path: str,
+        context: AnalysisContext | None,
+        parsed_file: ParsedFile,
+    ) -> tuple[
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        ExtractedBody | None,
+    ]:
+        import re
+
+        path_params, query_params, header_params, cookie_params, body = super()._extract_params(
+            method, path, context, parsed_file
+        )
+
+        # [FromUri] is Web API 2's catch-all "bind from URL" attribute.
+        # Parameters that appear in the route template are path params; the
+        # rest are query params.  The parent already handles [FromRoute] and
+        # [FromQuery]; we only need to process parameters that the parent left
+        # unclassified because it doesn't know [FromUri].
+        #
+        # We detect them by re-inspecting the raw parameter list: any param
+        # with [FromUri] in its metadata that the parent did NOT emit is
+        # processed here.
+        already_named = (
+            {p.name for p in path_params}
+            | {p.name for p in query_params}
+            | {p.name for p in header_params}
+        )
+        path_tpl_names = set(re.findall(r"\{([^}:]+)(?::[^}]+)?\}", path))
+
+        for param in method.parameters:
+            if param.name in already_named:
+                continue
+            meta = param.metadata or {}
+            if "FromUri" not in meta:
+                continue
+            constraints = self._extract_constraints(meta)
+            if param.name in path_tpl_names:
+                path_params.append(
+                    ExtractedParameter(
+                        name=param.name,
+                        location=ParameterLocation.PATH,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+            else:
+                query_params.append(
+                    ExtractedParameter(
+                        name=param.name,
+                        location=ParameterLocation.QUERY,
+                        type_annotation=param.type_annotation,
+                        required=param.default_value is None and param.default_value != "null",
+                        default_value=param.default_value,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+
+        return path_params, query_params, header_params, cookie_params, body
+
+    # -------------------------------------------------------------------------
+    # Auth scheme detection overrides
+    # -------------------------------------------------------------------------
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        schemes = super().extract_auth_schemes(parsed_file)
+        schemes.extend(self._detect_legacy_auth(parsed_file))
+        return schemes
+
+    def _detect_legacy_auth(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        """Detect legacy ASP.NET auth patterns not present in ASP.NET Core."""
+        schemes: list[ExtractedAuthScheme] = []
+
+        # FormsAuthentication / WindowsAuthentication usage in code
+        for call in parsed_file.call_sites:
+            callee_lower = call.callee_name.lower()
+            if "formsauthentication" in callee_lower:
+                schemes.append(
+                    ExtractedAuthScheme(
+                        scheme_type=AuthSchemeType.SESSION_COOKIE,
+                        name="forms_authentication",
+                        location=call.location,
+                        config={"detected_via": call.callee_name},
+                        confidence=Confidence.HIGH,
+                    )
+                )
+                break
+            if "windowsauthentication" in callee_lower or "windowsidentity" in callee_lower:
+                schemes.append(
+                    ExtractedAuthScheme(
+                        scheme_type=AuthSchemeType.CUSTOM,
+                        name="windows_authentication",
+                        location=call.location,
+                        config={"detected_via": call.callee_name, "scheme": "Windows"},
+                        confidence=Confidence.HIGH,
+                    )
+                )
+                break
+
+        # GlobalFilters.Filters.Add(new AuthorizeAttribute()) — app-wide auth
+        for call in parsed_file.call_sites:
+            if call.callee_name.split(".")[-1] == "Add" and any(
+                a.expression_text and "AuthorizeAttribute" in a.expression_text
+                for a in call.arguments
+                if hasattr(a, "expression_text") and a.expression_text
+            ):
+                schemes.append(
+                    ExtractedAuthScheme(
+                        scheme_type=AuthSchemeType.CUSTOM,
+                        name="global_authorize_filter",
+                        location=call.location,
+                        config={"detected_via": "GlobalFilters.Filters.Add(AuthorizeAttribute)"},
+                        confidence=Confidence.MEDIUM,
+                    )
+                )
+                break
+
+        # FilterConfig / WebApiConfig class with auth registration
+        for cls in parsed_file.classes:
+            if any(kw in cls.name.lower() for kw in _AUTH_CLASS_KEYWORDS):
+                for method in cls.methods:
+                    for call in parsed_file.call_sites:
+                        callee_lower = call.callee_name.lower()
+                        if "authorize" in callee_lower and "filter" in callee_lower:
+                            schemes.append(
+                                ExtractedAuthScheme(
+                                    scheme_type=AuthSchemeType.CUSTOM,
+                                    name=f"{cls.name}.{method.name}",
+                                    location=call.location,
+                                    config={
+                                        "class": cls.name,
+                                        "method": method.name,
+                                        "framework": "aspnet_legacy",
+                                    },
+                                    confidence=Confidence.MEDIUM,
+                                )
+                            )
+                            return schemes  # one entry is enough
+
+        return schemes
+
+
+def _read_source_lines(path: Path | None) -> list[str] | None:
+    """Read a source file once and return its lines, or None on any
+    error.  Used for cheap source-line inspection (visibility, decorator
+    walks) where the parser doesn't expose enough structure."""
+    if path is None:
+        return None
+    try:
+        return Path(path).read_text(encoding="utf-8", errors="replace").splitlines()
+    except OSError:
+        return None
+
+
+def _method_is_public(
+    method: ParsedFunction,
+    source_lines: list[str] | None,
+) -> bool:
+    """
+    Best-effort access-modifier detection from the method's signature
+    line.  `ParsedFunction` doesn't track `access_modifier` (only
+    `ParsedField` does), so we read the C# source.
+
+    The parser sets `method.location.line` at the top of the method's
+    AST node — which for decorated methods is the topmost attribute
+    line, not the signature line with the access modifier.  So we
+    scan forward from that line for the first line containing
+    `<MethodName>(`, then check for the `public` keyword on that line.
+
+    C# methods in classes default to `private` when no access modifier
+    is present, so absence of `public` (and absence of any non-public
+    modifier) is treated as non-routable.
+
+    Returns True defensively when source isn't readable or the
+    signature line can't be located (preserves pre-existing emission
+    for cases the parser surfaces unusually).
+    """
+    if source_lines is None or method.location is None:
+        return True
+    line_idx = method.location.line - 1
+    if line_idx < 0:
+        return True
+    name_re = re.compile(rf"\b{re.escape(method.name)}\s*\(")
+    for i in range(line_idx, min(len(source_lines), line_idx + 15)):
+        line = source_lines[i]
+        if not name_re.search(line):
+            continue
+        pre_paren = line.split("(", 1)[0]
+        tokens = set(re.findall(r"\b\w+\b", pre_paren))
+        if "public" in tokens:
+            return True
+        if tokens & {"private", "protected", "internal"}:
+            return False
+        return False  # no explicit modifier — C# default is private
+    return True  # couldn't locate signature line — defensive
+
+
+# Matches the start of a `new Route(` constructor call.  The body is
+# parsed via paren-balanced scanning to handle nested initializers
+# (`new RouteValueDictionary { ... }` lists, nested objects, etc.).
+_NEW_ROUTE_RE = re.compile(r"\bnew\s+Route\s*\(")
+
+# Match key/value pairs inside a `RouteValueDictionary { ... }` initializer.
+# Used to pull out the `controller` and `action` defaults for a route.
+_ROUTE_DICT_KV_RE = re.compile(r'\{\s*"([A-Za-z_]\w*)"\s*,\s*"([^"]*)"\s*\}')
+
+
+def _parse_route_call_args(
+    text: str,
+    start: int,
+) -> tuple[str, str | None, str | None, int] | None:
+    """
+    Parse the argument list of a `new Route(...)` call starting at
+    `text[start:]` (positioned just past the opening `(`).  Returns
+    `(url_pattern, controller, action, url_literal_offset)` or None
+    when the URL isn't a plain string literal.
+
+    Uses paren-balanced scanning to find the call's matching `)`, then
+    regex over the args text to extract:
+      - First positional string literal → URL pattern
+      - `{"controller", "X"}` in the RouteValueDictionary → controller
+      - `{"action", "Y"}` in the RouteValueDictionary → action
+    """
+    depth = 1
+    i = start
+    in_str = False
+    while i < len(text):
+        c = text[i]
+        if in_str:
+            if c == "\\":
+                i += 2
+                continue
+            if c == '"':
+                in_str = False
+            i += 1
+            continue
+        if c == '"':
+            in_str = True
+            i += 1
+            continue
+        if c == "(":
+            depth += 1
+        elif c == ")":
+            depth -= 1
+            if depth == 0:
+                args_text = text[start:i]
+                # Parse the first positional argument as a C# string
+                # literal — plain `"..."`, verbatim `@"..."` (where `""`
+                # is an embedded quote), or fail.
+                #
+                # Interpolated `$"..."` (and the verbatim-interpolated
+                # `$@"..."` / `@$"..."`) are intentionally deferred:
+                # emitting interpolated templates with `{placeholder}`
+                # segments would create routes whose paths can't match a
+                # resolved-value GT.  Closing that gap is v7 charter
+                # work: a constant-resolution pass over `const string`
+                # / `static readonly string` fields in scope, followed
+                # by GT updates for any newly-emitted resolved URLs.
+                parsed_lit = parse_csharp_string_literal(args_text, 0)
+                if parsed_lit is None:
+                    return None
+                url_pattern, lit_open_pos, _lit_end = parsed_lit
+                url_offset = start + lit_open_pos
+                controller: str | None = None
+                action: str | None = None
+                for kv_match in _ROUTE_DICT_KV_RE.finditer(args_text):
+                    key, value = kv_match.group(1), kv_match.group(2)
+                    if key == "controller" and controller is None:
+                        controller = value
+                    elif key == "action" and action is None:
+                        action = value
+                return url_pattern, controller, action, url_offset
+        i += 1
+    return None
+
+
+def _detect_orchard_module(file_path: Path | None) -> str | None:
+    """
+    Detect whether `file_path` lives inside an Orchard CMS module.
+
+    Returns the module name (the directory containing `Module.txt`) or
+    None when no enclosing module is found.  Walks up from the file's
+    directory looking for `Module.txt` — Orchard's per-module manifest
+    file.  Depth-limited (4 levels) so unrelated controllers in deep
+    directory trees don't trigger spurious detection.
+
+    Reference: Module.txt is checked by Orchard's extension loader
+    (`src/Orchard/Environment/Extensions/`) to identify a directory as
+    a loadable module.
+    """
+    if file_path is None:
+        return None
+    p = Path(file_path)
+    try:
+        current = p.parent if p.is_file() else p
+    except OSError:
+        return None
+    with contextlib.suppress(OSError):
+        current = current.resolve()
+    for depth, ancestor in enumerate([current, *current.parents]):
+        if depth > 4:
+            return None
+        try:
+            if (ancestor / "Module.txt").is_file():
+                return ancestor.name
+        except OSError:
+            return None
+        if ancestor.parent == ancestor:
+            return None
+    return None
+
+
+# Self-registration
+_legacy_aspnet_plugin = LegacyAspNetPlugin()
+FrameworkPluginRegistry.register(_legacy_aspnet_plugin)