using Microsoft.AspNetCore.Mvc; namespace Testing { public class ViewModel { public string RequestId { get; set; } // Considered tainted. public object RequestIdField; // Not considered tainted as it is a field. public string RequestIdOnlyGet { get; } // Not considered tainted as there is no setter. public string RequestIdPrivateSet { get; private set; } // Not considered tainted as it has a private setter. public static object RequestIdStatic { get; set; } // Not considered tainted as it is static. private string RequestIdPrivate { get; set; } // Not considered tainted as it is private. } public class TestController : Controller { public object MyAction(ViewModel viewModel) { throw null; } } }