S3900: ShouldExecute method

[zsolt-kolbay-sonarsource]

Part of #6793
Task 4

[antonioaversa]

LGTM, just a couple of suggestions.

[Tim-Pohlmann]

I added additional notes to the unresolved conversations.

[martin-strecker-sonarsource]

/cc @pavel-mikula-sonarsource regarding the proposal on how to test "ShouldExecute":

#6942 (comment)

[martin-strecker-sonarsource]

Why is all of this language specific? Where is the common base class?

[martin-strecker-sonarsource]

Do we have exceptions regarding this parameters (extension methods)? Do we need to take this into account here?

[martin-strecker-sonarsource]

If all parameters are out parameters, ShouldExecute should return false.

[zsolt-kolbay-sonarsource]

I initially added the common base class, but got a comment for it. So it will be added later with the VB.NET implementation.

Invocation of an extension method will not raise an issue. However, this will not be dealt with in this PR, as ShouldExecute() only operates on the syntax level and can't check whether a method call is referring to an extension method.

I added a filter for out params.

[martin-strecker-sonarsource]

Shouldn't it be enough to check the parent only? What do you consider a dereference? I would say

• p.Invocation(); but not p?.Invocation();
• p.PropertyAccess, but not p?.PropertyAccess;
• p[0]; but not p?[0];
• p->Deref(); // Unsafe code only. Can p null here null? I don't know. I think p must be a struct but I'm not sure.
• await p; // FYI: there is an await? p language proposal also Champion "Null-conditional await" dotnet/csharplang#35
• foreach(var i in p)
• throw p
• p + p No. I think all unary and binary operators like + or ! are okay
• M(p) No. Passing around is okay.

Is there something else?
I think in all cases we just need to look at the parent.

[martin-strecker-sonarsource]

This is more relevant for VB as there is no casing difference, but we might also add another check, where we also check, that the identifier is indeed referring to a parameter:
In a case like so:

void M(int Length)
{
    someList.Length.ToString(); // Length can not be a parameter here
}

[zsolt-kolbay-sonarsource]

I changed the syntax walker to check the parents instead of all ancestors.
I'm not sure about the additional check. Is there an easy way to do it without using the semantic model?

[martin-strecker-sonarsource]

Please add a test case for a PointerMemberAccess

@pavel-mikula-sonarsource Do we want to support dereferences in unsafe code like in the linked example?

[martin-strecker-sonarsource]

I'm not sure about the additional check. Is there an easy way to do it without using the semantic model?

You just need to make sure, that there is nothing left to the parameter name:

• parameter.Invoke() // <- okay
• somethingLeft.parameter.Invoke() // <- not okay

@Tim-Pohlmann added GetLeftOfDot or something like that recently. You can use that to get the left-hand side of what you have found as a candidate.

[zsolt-kolbay-sonarsource]

I tried to find GetLeftOfDot and similar methods in Tim's PR, but couldn't find them. Any chance you remember where it is?
Does it take more complex expressions into consideration? Like:
(parameter as object).ToString(); // Noncompliant

[martin-strecker-sonarsource]

It's not implemented yet: #6863

[Tim-Pohlmann]

GetLeftOfDot is in Roslyn, but we don't have it in our code base yet. I have used a workaround and created an issue to add it. Maybe this helps you:
#6753 (comment)

[zsolt-kolbay-sonarsource]

As it's not yet available in the project, I'll address this in another PR.

[martin-strecker-sonarsource]

Suggested change

	static bool HasNoDeclaredAccessabilityModifier(SyntaxTokenList modifiers) =>
	static bool HasNoDeclaredAccessibilityModifier(SyntaxTokenList modifiers) =>

[zsolt-kolbay-sonarsource]

https://en.wiktionary.org/wiki/accessability 😎

[martin-strecker-sonarsource]

[zsolt-kolbay-sonarsource]

Oops 🤣 I mistook switched the lines in the Commit suggestion and thought yours was the wrong one. Mea culpa! Corrected it.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

100.0% Coverage
0.0% Duplication

[pavel-mikula-sonarsource]

ITs: Summary for Automapper, Ember-MM, Net5

[pavel-mikula-sonarsource]

Lost TP

        public void ConvertUsing(ITypeConverter<TSource, TDestination> converter)
        {
            ConvertUsing(converter.Convert);
        }

[pavel-mikula-sonarsource]

Lost TP

        public void Configure(TypeMap typeMap)
        {
            var destMember = DestinationMember;

            if(destMember.DeclaringType.ContainsGenericParameters)
            {
                destMember = typeMap.DestinationSetters.Single(m => m.Name == destMember.Name);
            }

            var propertyMap = typeMap.FindOrCreatePropertyMapFor(destMember, typeof(TMember) == typeof(object) ? destMember.GetMemberType() : typeof(TMember));

            Apply(propertyMap);
        }

[pavel-mikula-sonarsource]

Lost foreach

[pavel-mikula-sonarsource]

This looks like FP to me, we should have learned NotNull on the 1st line.

        public static PropertyMap GetPropertyMap(this IGlobalConfiguration config, MemberInfo sourceMemberInfo, Type destinationMemberType)
        {
            var typeMap = config.CheckIfMapExists(sourceMemberInfo.DeclaringType, destinationMemberType);

            var propertyMap = typeMap.PropertyMaps
                .FirstOrDefault(pm => pm.CanResolveValue &&
                                      pm.SourceMember != null && pm.SourceMember.Name == sourceMemberInfo.Name);

            if (propertyMap == null)
                throw PropertyConfigurationException(typeMap, sourceMemberInfo.Name);   // Noncompliant FP

            return propertyMap;
        }

[pavel-mikula-sonarsource]

Interesting FP, we don't support Object.ReferenceEquals

            public bool Equals(EmberPlugin other)
            {
                if (Object.ReferenceEquals(this, other))
                    return true;

                if (Object.ReferenceEquals(other, null))
                    return false;

                return this.Plugin.GetType() == other.Plugin.GetType();
            }

[pavel-mikula-sonarsource]

ITs: Dump for Nancy

[pavel-mikula-sonarsource]

Lost TP: We don't run for operators?

        public static implicit operator Func<NancyContext, CancellationToken, Task>(AfterPipeline pipeline)
        {
            return pipeline.Invoke;
        }

[pavel-mikula-sonarsource]

Lost TP: Delegate invocation, or nested lambda

        public IReadOnlyCollection<Type> GetTypesAssignableTo(Type type, TypeResolveStrategy strategy)
        {
            return this.cache.GetOrAdd(type, t => this.GetTypesAssignableTo(type)).Where(strategy.Invoke).ToArray();
        }

[pavel-mikula-sonarsource]

Interesting FP, there is ?? null check before

public static MidFunc UseNancy(NancyOptions options = null)
        {
            options = options ?? new NancyOptions();
            options.Bootstrapper.Initialise();

[pavel-mikula-sonarsource]

This is interesting method - FPs and FNs

        public static void ShouldHaveRedirectedTo(this BrowserResponse response, string location, StringComparison stringComparer = StringComparison.Ordinal)
        {
            var validRedirectStatuses = new[]
            {
                HttpStatusCode.MovedPermanently,
                HttpStatusCode.SeeOther,
                HttpStatusCode.TemporaryRedirect
            };

            if (!validRedirectStatuses.Any(x => x == response.StatusCode))   // FN here due to lambda
            {
                throw new AssertException(
                    string.Format("Status code should be one of 'MovedPermanently, SeeOther, TemporaryRedirect', but was {0}.", response.StatusCode));
            }

            if (!response.Headers["Location"].Equals(location, stringComparer))  // TP considering the lambda not being supported
            {
                throw new AssertException(string.Format("Location should have been: {0}, but was {1}", location, response.Headers["Location"]));   // FP here, the `if` should have learned NotNull
            }
        }

[pavel-mikula-sonarsource]

Lost TP, delegate reference

        public virtual IEnumerable<ModelValidationRule> GetRules(ValidationAttribute attribute, PropertyDescriptor descriptor)
        {
            yield return new ModelValidationRule(ruleType, attribute.FormatErrorMessage, new [] { descriptor == null ? string.Empty : descriptor.Name });
        }

[pavel-mikula-sonarsource]

This 2nd issue looks like FP, the 1st dereference should have learned NotNull.

        public Response RenderView(ViewLocationResult viewLocationResult, dynamic model, IRenderContext renderContext)
        {
            Template parsed;
            Hash hashedModel;
            HttpStatusCode status;

            try
            {
                // Set the parsed template
                parsed = renderContext.ViewCache.GetOrAdd(
                    viewLocationResult,
                    x =>
                    {
                        using (var reader = viewLocationResult.Contents.Invoke())
                            return Template.Parse(reader.ReadToEnd());
                    });

                hashedModel = Hash.FromAnonymousObject(new
                {
                    Model = new DynamicDrop(model),
                    ViewBag = new DynamicDrop(renderContext.Context.ViewBag)
                });

[pavel-mikula-sonarsource]

This is a TP, but why didn't the one above didn't go away?

        public static string RenderMasterPage(string templateContent)
        {
            var second =
               templateContent.Substring(   // Old FP? the `IndexOf` below is called first and should have infered `NotNull`
                   templateContent.IndexOf("<!DOCTYPE html>", StringComparison.OrdinalIgnoreCase), // New TP here
                   templateContent.IndexOf("<body", StringComparison.OrdinalIgnoreCase));

[pavel-mikula-sonarsource]

ITs: Dump for akka.net

[pavel-mikula-sonarsource]

I think this is a new FP, because it raises on extension methods. We generally consider invocations of extension methods safe:

        public static IActorRef GetOrElse(this IActorRef actorRef, Func<IActorRef> elseValue)
        {
            return actorRef.IsNobody() ? elseValue() : actorRef;
        }

[pavel-mikula-sonarsource]

This is a lost FP, that is good.
Also there's interesting FN above it:

        public static ActorSelection ActorSelection(string path, ActorSystem system, IActorRef lookupRoot)
        {
            var provider = ((ActorSystemImpl)system).Provider;  // FN

[pavel-mikula-sonarsource]

This FP is interesting, because it's inside lambda after a null check in outer method

        public override object RegisterExtension(IExtensionId extension)
        {
            if (extension == null) return null;

            _extensions.GetOrAdd(extension.ExtensionType, t => new Lazy<object>(() => extension.CreateExtension(this), LazyThreadSafetyMode.ExecutionAndPublication));

            return extension.Get(this);
        }

[pavel-mikula-sonarsource]

FP after a null check

        public NewtonSoftJsonSerializer(ExtendedActorSystem system, NewtonSoftJsonSerializerSettings settings)
            : base(system)
        {
            Settings = new JsonSerializerSettings
            {
                PreserveReferencesHandling = settings.PreserveObjectReferences
                    ? PreserveReferencesHandling.Objects
                    : PreserveReferencesHandling.None,
                NullValueHandling = NullValueHandling.Ignore,
                DefaultValueHandling = DefaultValueHandling.Ignore,
                MissingMemberHandling = MissingMemberHandling.Ignore,
                ConstructorHandling = ConstructorHandling.AllowNonPublicDefaultConstructor,
                TypeNameHandling = settings.EncodeTypeNames
                    ? TypeNameHandling.All
                    : TypeNameHandling.None,
            };

            if (system != null)
            {
                var settingsSetup = system.Settings.Setup.Get<NewtonSoftJsonSerializerSetup>()
                    .GetOrElse(NewtonSoftJsonSerializerSetup.Create(s => {}));

                settingsSetup.ApplySettings(Settings);
            }

[pavel-mikula-sonarsource]

FP inside foreach?

        public Serialization(ExtendedActorSystem system)
        {
            System = system;
            _nullSerializer = new NullSerializer(system);
            AddSerializer("null", _nullSerializer);

            var serializersConfig = system.Settings.Config.GetConfig("akka.actor.serializers").AsEnumerable().ToList(); // True positive here
            var serializerBindingConfig = system.Settings.Config.GetConfig("akka.actor.serialization-bindings").AsEnumerable().ToList();
            var serializerSettingsConfig = system.Settings.Config.GetConfig("akka.actor.serialization-settings");

            _serializerDetails = system.Settings.Setup.Get<SerializationSetup>()
                .Select(x => x.CreateSerializers(system)).GetOrElse(ImmutableHashSet<SerializerDetails>.Empty);

            foreach (var kvp in serializersConfig)
            {
                var serializerTypeName = kvp.Value.GetString();
                var serializerType = Type.GetType(serializerTypeName);
                if (serializerType == null)
                {
                    system.Log.Warning("The type name for serializer '{0}' did not resolve to an actual Type: '{1}'", kvp.Key, serializerTypeName); // FP here, was the state lost after AddSerializer below?
                    continue;
                }

                var serializerConfig = serializerSettingsConfig.GetConfig(kvp.Key);

                var serializer = !serializerConfig.IsNullOrEmpty()
                    ? (Serializer)Activator.CreateInstance(serializerType, system, serializerConfig)
                    : (Serializer)Activator.CreateInstance(serializerType, system);

                AddSerializer(kvp.Key, serializer);
            }

[pavel-mikula-sonarsource]

LGTM, the changed ITs are expected at this stage