dotnet / dotnet/wpf

Enabling SingleFile analyzer flags different pieces of code as dangerous

Open
#5,226 1 comment 2 reactions 0 assignees View on GitHub
Bug Investigate
Dominant language
C#
Stars
7.7k
Forks
1.3k
Avg merge
1d 11h
Merged PRs (30d)
61

Description

**Problem description:**
After enabling the single file analyzer in the wpf repository there is several pieces of code that are flagged as dangerous if used in a single file configuration. The following are the problems found in the code along with the effect they would have if deployed as single file.

- [ ] [IncrementalCompileAnalyzer.cs](https://github.com/dotnet/wpf/blob/3390df7638a3fab1c23373b7cc9904677e65be2b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/MS/Internal/Tasks/IncrementalCompileAnalyzer.cs#L88)
Method AnalyzeInputFiles call IsFileChanged with Assembly.Location() as the input file string, internally IsFileChanged will throw if the input file is empty

- [ ] [TaskHelper.cs](https://github.com/dotnet/wpf/blob/3390df7638a3fab1c23373b7cc9904677e65be2b/src/Microsoft.DotNet.Wpf/src/PresentationBuildTasks/MS/Internal/Tasks/TaskHelper.cs#L55)
Method DisplayLogo calls GetVersionInfo with Assembly.Location as the path, later on we check if the path exists which will throw

- [ ] [WinRT.cs](https://github.com/dotnet/wpf/blob/3390df7638a3fab1c23373b7cc9904677e65be2b/src/Microsoft.DotNet.Wpf/src/PresentationFramework/MS/Internal/WindowsRuntime/Generated/WinRT.cs#L114)
Field _currenModuleDirectory does GetDirectoryName on assembly.Location() which throws a System.ArgumentException if parameter contains invalid characters, is empty, or contains only white spaces, in this case will throw since argument is empty.

- [ ] [SerializerDescriptor.cs](https://github.com/dotnet/wpf/blob/3390df7638a3fab1c23373b7cc9904677e65be2b/src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Documents/Serialization/SerializerDescriptor.cs#L102)
Method CreateFromFactoryInstance creates a serializer descriptor with assemblyPath set to empty.

- [ ] [AssemblyFilter.cs](https://github.com/dotnet/wpf/blob/3390df7638a3fab1c23373b7cc9904677e65be2b/src/Microsoft.DotNet.Wpf/src/PresentationFramework/MS/Internal/AppModel/AssemblyFilter.cs#L49)
Method AssemblyNameWithFileVersion calls GetVersionInfo on assembly.Location which will throw an System.ArgumentException if parameter is empty

- [ ] [TextRangeSerialization.cs](https://github.com/dotnet/wpf/blob/3390df7638a3fab1c23373b7cc9904677e65be2b/src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Documents/TextRangeSerialization.cs#L576-L580)
Method WriteStartXamlElement uses System.Reflection.Module.Name() which returns <Unknown> when published as single file. This will make the xmlWriter print a namespace with assembly set to <Unknown>

For each of these cases we should do any of the following:
- Suppress the warning because the code is considered safe
- Create code workarounds that handle the case when publishing a single file app
- Mark the method with RequiresAssemblyFiles to flag the code as dangerous for single file.

This issue tracks the progress to understand the following:
If the warnings can be suppressed because the code will never be used in a published application.
For TextRangeSerialization.cs, does having <Unknown> creates an unexpected behavior later on?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.