Enable code analysis, sdl checks, binskim and fix related errors

[yao-msft]

Microsoft Reviewers: Open in CodeFlow

[github-actions]

Misspellings found, please review:

• ruleset

To accept these changes, run the following commands from this repository on this branch

pushd $(git rev-parse --show-toplevel)
perl -e '
my @expect_files=qw('".github/actions/spelling/expect.txt"');
@ARGV=@expect_files;
my @stale=qw('"sourc "');
my $re=join "|", @stale;
my $suffix=".".time();
my $previous="";
sub maybe_unlink { unlink($_[0]) if $_[0]; }
while (<>) {
  if ($ARGV ne $old_argv) { maybe_unlink($previous); $previous="$ARGV$suffix"; rename($ARGV, $previous); open(ARGV_OUT, ">$ARGV"); select(ARGV_OUT); $old_argv = $ARGV; }
  next if /^(?:$re)(?:(?:\r|\n)*$| .*)/; print;
}; maybe_unlink($previous);'
perl -e '
my $new_expect_file=".github/actions/spelling/expect.txt";
use File::Path qw(make_path);
make_path ".github/actions/spelling";
open FILE, q{<}, $new_expect_file; chomp(my @words = <FILE>); close FILE;
my @add=qw('"ruleset "');
my %items; @items{@words} = @words x (1); @items{@add} = @add x (1);
@words = sort {lc($a) cmp lc($b)} keys %items;
open FILE, q{>}, $new_expect_file; for my $word (@words) { print FILE "$word\n" if $word =~ /\w/; };
close FILE;'
popd

[yao-msft]

/azp run

[azure-pipelines]

Pull request contains merge conflicts.

[yao-msft]

/azp run

[azure-pipelines]

Pull request contains merge conflicts.

[JohnMcPMS]

Why here but not the two lines below? The difference is rvalue vs lvalue, but the lifetime of the rvalue is until the end of the statement. So converting to string_view is just as valid. This is either a mistake/overcaution in the analysis, or an error in my understanding.

[yao-msft]

The code analysis error is C26449( https://docs.microsoft.com/en-us/cpp/code-quality/c26449?view=msvc-160 )
It specifically checks view created from temporary. It is most likely an overcaution because we immediately use the view within the statement. This is to make code analysis happy.

---

In reply to: 613644294 [](ancestors = 613644294)

[JohnMcPMS]

I think the ternary is confusing it, since that link specifically calls out:

Temporaries created for function call arguments are not flagged. It is safe to pass spans from such temporaries if target functions don’t retain data pointers in external variables.