StringFormatMethodAttribute misusage
- Dominant language
- C#
- Stars
- 14.8k
- Forks
- 3.4k
- PR merge metrics
- PR metrics pending
Description
EFCore.Relational has some usage of [`JetBrains.Annotations.StringFormatMethodAttribute`](https://www.jetbrains.com/help/resharper/Reference__Code_Annotation_Attributes.html#StringFormatMethodAttribute) on methods that accept raw SQL, e.g. https://github.com/dotnet/efcore/blob/main/src/EFCore.Relational/Extensions/RelationalDatabaseFacadeExtensions.cs#L402
This attribute is designed for `string.Format`-like API and not SQL, so it leads to false-positive analysis reports (e.g. see https://youtrack.jetbrains.com/issue/RSRP-501500). Do I understand original pull request [!5658](https://github.com/dotnet/efcore/pull/5658) correctly: was the attribute used to highlight interpolated/concatenated strings containing unescaped user data injected into SQL?
Could the attribute be replaced with [`[StringSyntax("sql")]`](https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.codeanalysis.stringsyntaxattribute?view=net-9.0) on corresponding parameters?
Contributor guide
Assessment
This issue has not been assessed yet.