CA1516 emits an empty diagnostic message (no message text), producing a SARIF result with no message
- Dominant language
- C#
- Stars
- 3.2k
- Forks
- 1.3k
- PR merge metrics
- PR metrics pending
Description
### Describe the bug
CA1516 reports a diagnostic with an empty message string. Every other rule emits message text; CA1516 emits none. This surfaces two ways:
1. In normal build output the line reads `warning CA1516:` with nothing after the colon.
2. When an error log is produced (`/errorlog` / ``), the `result` object has no `message` property at all (the compiler omits an empty message). In SARIF v2.1.0 `result.message` is required, so the emitted log violates the SARIF v2 schema — any strict SARIF v2 consumer fails to deserialize it.
### Steps to reproduce
Minimal project (no other dependencies)
repro.csproj
```csproj
net9.0
true
latest-all
```
Program.cs
```cs
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;
public static class Repro
{
public static Vector256 M(Vector256 a, Vector256 b)
=> Avx2.And(a, b); // CA1516
}
```
Build (SARIF v2.1 error log):
`dotnet build repro.csproj -p:ErrorLog=errorlog.sarif,version=2.1`
### Expected behavior
CA1516 emits a non-empty, descriptive message (e.g., "Replace the platform-specific intrinsic 'Avx2.And' with the cross-platform equivalent 'a & b'."), and the SARIF `result` contains a populated `message.text`.
### Actual behavior
• Console: warning CA1516: (empty).
• SARIF result for CA1516:
```json
{
"ruleId": "CA1516",
"ruleIndex": 108,
"level": "warning",
"locations": [ /* ... */ ],
"properties": { "warningLevel": 1, "customProperties": { "RuleKind": "op_BitwiseAnd" } }
// note: no "message" property
}
```
The rule descriptor has `shortDescription`/`fullDescription` but the per-result message is empty, implying the rule's `MessageFormat` resource is empty/unset (while `Title`/`Description` are set).
### Is this a regression?
Reproduced on both `net9.0` and `net10.0` targets (identical behavior) with .NET SDK 10.0.302 / C# compiler 5.6.0-2.26329.109; also with `Microsoft.CodeAnalysis.NetAnalyzers` 5.0.3. The empty message is TFM-independent (it's the analyzer's `MessageFormat`, not the compilation target).
### Are there any workarounds?
Yes, but only by disabling the rule so it is never reported — which removes the malformed result from the error log:
```editorconfig
# .editorconfig
dotnet_diagnostic.CA1516.severity = none
```
or
```csproj
$(NoWarn);CA1516
```
The following do not work (each validated against the emitted SARIF):
• `#pragma warning disable CA1516` / `[SuppressMessage]` — source suppression still writes the diagnostic to the error log (as `suppressedInSource`) with no `message`, so strict SARIF v2 consumers still fail to deserialize.
• Emitting the error log as SARIF v2 (`-p:ErrorLog=log.sarif,version=2.1`) — the compiler omits the empty message in v2 as well, so the `result` is still missing the required `message` property.
The rule-disable workaround avoids the crash but loses the (otherwise useful) CA1516 signal entirely, so it's a stopgap rather than a fix.
### dotnet --info output
```console
.NET SDK:
Version: 10.0.302
Commit: 35b593bebf
Workload version: 10.0.300-manifests.714b12c0
MSBuild version: 18.6.11+35b593beb
Runtime Environment:
OS Name: Windows
OS Version: 10.0.26200
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\10.0.302\
.NET workloads installed:
There are no installed workloads to display.
Configured to use workload sets when installing new manifests.
No workload sets are installed. Run "dotnet workload restore" to install a workload set.
Host:
Version: 10.0.10
Architecture: x64
Commit: f7d90799ce
.NET SDKs installed:
8.0.423 [C:\Program Files\dotnet\sdk]
9.0.316 [C:\Program Files\dotnet\sdk]
10.0.110 [C:\Program Files\dotnet\sdk]
10.0.302 [C:\Program Files\dotnet\sdk]
.NET runtimes installed:
Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.29 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.18 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 10.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.29 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.18 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 10.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.29 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 9.0.18 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 10.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]
Environment variables:
Not set
```
### IDE version
_No response_
### Other details
Also reproduced with Microsoft.CodeAnalysis.NetAnalyzers 5.0.3
SARIF v2.1.0 requires `result.message`. A single CA1516 hit makes the compiler-generated error log non-conformant, breaking downstream SARIF v2 tooling. Concretely, it hard-crashes Microsoft Guardian's SARIF import with `JsonSerializationException: Required property 'message' not found in JSON`, failing the entire SDL pipeline for any project that uses platform-specific intrinsics.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.