dotnet / dotnet/sdk

CA1516 emits an empty diagnostic message (no message text), producing a SARIF result with no message

Open
#55,403 2 comments 1 reaction 3 assignees Claimed by @nagilson View on GitHub
Area-Microsoft.CodeAnalysis.NetAnalyzers cookie
Dominant language
C#
Stars
3.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

### Describe the bug

CA1516 reports a diagnostic with an empty message string. Every other rule emits message text; CA1516 emits none. This surfaces two ways:

1. In normal build output the line reads `warning CA1516:` with nothing after the colon.
2. When an error log is produced (`/errorlog` / ``), the `result` object has no `message` property at all (the compiler omits an empty message). In SARIF v2.1.0 `result.message` is required, so the emitted log violates the SARIF v2 schema — any strict SARIF v2 consumer fails to deserialize it.

### Steps to reproduce

Minimal project (no other dependencies)

 repro.csproj 

```csproj


net9.0
true
latest-all

```

 Program.cs 

```cs
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public static class Repro
{
public static Vector256 M(Vector256 a, Vector256 b)
=> Avx2.And(a, b); // CA1516
}
```

Build (SARIF v2.1 error log):

`dotnet build repro.csproj -p:ErrorLog=errorlog.sarif,version=2.1`

### Expected behavior

CA1516 emits a non-empty, descriptive message (e.g., "Replace the platform-specific intrinsic 'Avx2.And' with the cross-platform equivalent 'a & b'."), and the SARIF `result` contains a populated `message.text`.

### Actual behavior

• Console:  warning CA1516:  (empty).
• SARIF  result  for CA1516:

```json
{
"ruleId": "CA1516",
"ruleIndex": 108,
"level": "warning",
"locations": [ /* ... */ ],
"properties": { "warningLevel": 1, "customProperties": { "RuleKind": "op_BitwiseAnd" } }
// note: no "message" property
}
```

The rule descriptor has `shortDescription`/`fullDescription` but the per-result message is empty, implying the rule's `MessageFormat` resource is empty/unset (while `Title`/`Description` are set).

### Is this a regression?

Reproduced on both `net9.0` and `net10.0` targets (identical behavior) with .NET SDK 10.0.302 / C# compiler 5.6.0-2.26329.109; also with `Microsoft.CodeAnalysis.NetAnalyzers` 5.0.3. The empty message is TFM-independent (it's the analyzer's `MessageFormat`, not the compilation target).

### Are there any workarounds?

Yes, but only by disabling the rule so it is never reported — which removes the malformed result from the error log:

```editorconfig
# .editorconfig
dotnet_diagnostic.CA1516.severity = none
```

or

```csproj

$(NoWarn);CA1516
```

The following do not work (each validated against the emitted SARIF):

• `#pragma warning disable CA1516` / `[SuppressMessage]` — source suppression still writes the diagnostic to the error log (as `suppressedInSource`) with no `message`, so strict SARIF v2 consumers still fail to deserialize.
• Emitting the error log as SARIF v2 (`-p:ErrorLog=log.sarif,version=2.1`) — the compiler omits the empty message in v2 as well, so the `result` is still missing the required `message` property.

The rule-disable workaround avoids the crash but loses the (otherwise useful) CA1516 signal entirely, so it's a stopgap rather than a fix.

### dotnet --info output

```console
.NET SDK:
Version: 10.0.302
Commit: 35b593bebf
Workload version: 10.0.300-manifests.714b12c0
MSBuild version: 18.6.11+35b593beb

Runtime Environment:
OS Name: Windows
OS Version: 10.0.26200
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\10.0.302\

.NET workloads installed:
There are no installed workloads to display.
Configured to use workload sets when installing new manifests.
No workload sets are installed. Run "dotnet workload restore" to install a workload set.

Host:
Version: 10.0.10
Architecture: x64
Commit: f7d90799ce

.NET SDKs installed:
8.0.423 [C:\Program Files\dotnet\sdk]
9.0.316 [C:\Program Files\dotnet\sdk]
10.0.110 [C:\Program Files\dotnet\sdk]
10.0.302 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.29 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.18 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 10.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.29 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.18 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 10.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.29 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 9.0.18 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 10.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
Not set
```

### IDE version

_No response_

### Other details

Also reproduced with  Microsoft.CodeAnalysis.NetAnalyzers  5.0.3

SARIF v2.1.0 requires `result.message`. A single CA1516 hit makes the compiler-generated error log non-conformant, breaking downstream SARIF v2 tooling. Concretely, it hard-crashes Microsoft Guardian's SARIF import with `JsonSerializationException: Required property 'message' not found in JSON`, failing the entire SDL pipeline for any project that uses platform-specific intrinsics.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.