Address CCR: don't claim guaranteed downstream encoding

Copilot Code Review correctly pointed out that bracketing between
BeginWriteTagHelperAttribute()/EndWriteTagHelperAttribute() only proves
the value is captured into a buffer rather than written directly to the
response; it does not, by itself, guarantee that every tag helper later
HTML-attribute-encodes that buffer. Reworded the doc comments and the
change note to justify the exclusion on "not a direct write to the
response" rather than on assumed downstream encoding.

No logic change; XSS.ql compiles and the CWE-079/XSS test still passes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: felickz

csharp/ql/lib/change-notes/2026-09-18-razor-tag-helper-attribute-xss-fp.md

@@ -1,4 +1,4 @@
 ---
 category: majorAnalysis
 ---
-* Fixed a false positive in `cs/web/xss` for ASP.NET Core Razor Pages/MVC views: `WriteLiteral` calls generated for tag helper attribute values (for example, `asp-for`) are HTML-attribute-encoded before being rendered, so they are no longer treated as XSS sinks.
+* Fixed a false positive in `cs/web/xss` for ASP.NET Core Razor Pages/MVC views: `WriteLiteral` calls generated for tag helper attribute values (for example, `asp-for`) capture the value into an internal buffer instead of writing it directly to the response, so they are no longer treated as XSS sinks.

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Html.qll

@@ -184,10 +184,10 @@ class MicrosoftAspNetCoreMvcHtmlHelperRawSink extends AspNetCoreHtmlSink {
  *
  * The Razor source generator emits this bracketing for every literal or expression segment of an
  * HTML attribute value on an element that also carries a tag helper (for example `asp-for`). Such
- * a `WriteLiteral` call does not write directly, unencoded, to the response: `WriteLiteral`
- * appends to an internal string buffer, `EndWriteTagHelperAttribute()` returns that buffer, and
- * the buffered text is subsequently stored as a tag helper attribute value and HTML-attribute-
- * encoded when the tag helper's output is rendered. This is therefore not a real sink.
+ * a `WriteLiteral` call does not write directly to the response: `WriteLiteral` appends to an
+ * internal string buffer, and `EndWriteTagHelperAttribute()` returns that buffer as a tag helper
+ * attribute value rather than as page markup. This is therefore not a direct-write sink, unlike an
+ * unbracketed `WriteLiteral` call, whose argument is written straight to the response.
  *
  * Because a basic block cannot contain a branch, requiring `beginCall`, `writeLiteral`, and
  * `endCall` to appear (in that order) in the same basic block, with no other
@@ -244,8 +244,8 @@ private predicate isBracketedForTagHelperAttribute(Call writeLiteral) {
  * a `.cshtml` file.
  *
  * `WriteLiteral` calls whose argument is captured for a tag helper attribute value (see
- * `isBracketedForTagHelperAttribute`) are excluded, since such values are HTML-attribute-encoded
- * later and are not written unencoded to the response.
+ * `isBracketedForTagHelperAttribute`) are excluded, since such calls buffer the value as a tag
+ * helper attribute rather than writing it directly to the response.
  */
 class MicrosoftAspNetRazorPageWriteLiteralSink extends AspNetCoreHtmlSink {
   MicrosoftAspNetRazorPageWriteLiteralSink() {