dotnet / dotnet/efcore

StringFormatMethodAttribute misusage

Open
#37,024 0 comments 0 reactions 1 assignee Claimed by @AndriySvyryd View on GitHub
area-query
Dominant language
C#
Stars
14.8k
Forks
3.4k
PR merge metrics
PR metrics pending

Description

EFCore.Relational has some usage of [`JetBrains.Annotations.StringFormatMethodAttribute`](https://www.jetbrains.com/help/resharper/Reference__Code_Annotation_Attributes.html#StringFormatMethodAttribute) on methods that accept raw SQL, e.g. https://github.com/dotnet/efcore/blob/main/src/EFCore.Relational/Extensions/RelationalDatabaseFacadeExtensions.cs#L402

This attribute is designed for `string.Format`-like API and not SQL, so it leads to false-positive analysis reports (e.g. see https://youtrack.jetbrains.com/issue/RSRP-501500). Do I understand original pull request [!5658](https://github.com/dotnet/efcore/pull/5658) correctly: was the attribute used to highlight interpolated/concatenated strings containing unescaped user data injected into SQL?

Could the attribute be replaced with [`[StringSyntax("sql")]`](https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.codeanalysis.stringsyntaxattribute?view=net-9.0) on corresponding parameters?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.