Skip to content

StringFormatMethodAttribute misusage #37024

@mrEDitor

Description

@mrEDitor

EFCore.Relational has some usage of JetBrains.Annotations.StringFormatMethodAttribute on methods that accept raw SQL, e.g. https://github.com/dotnet/efcore/blob/main/src/EFCore.Relational/Extensions/RelationalDatabaseFacadeExtensions.cs#L402

This attribute is designed for string.Format-like API and not SQL, so it leads to false-positive analysis reports (e.g. see https://youtrack.jetbrains.com/issue/RSRP-501500). Do I understand original pull request !5658 correctly: was the attribute used to highlight interpolated/concatenated strings containing unescaped user data injected into SQL?

Could the attribute be replaced with [StringSyntax("sql")] on corresponding parameters?

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions