-
Notifications
You must be signed in to change notification settings - Fork 3.3k
Open
Labels
Description
EFCore.Relational has some usage of JetBrains.Annotations.StringFormatMethodAttribute on methods that accept raw SQL, e.g. https://github.com/dotnet/efcore/blob/main/src/EFCore.Relational/Extensions/RelationalDatabaseFacadeExtensions.cs#L402
This attribute is designed for string.Format-like API and not SQL, so it leads to false-positive analysis reports (e.g. see https://youtrack.jetbrains.com/issue/RSRP-501500). Do I understand original pull request !5658 correctly: was the attribute used to highlight interpolated/concatenated strings containing unescaped user data injected into SQL?
Could the attribute be replaced with [StringSyntax("sql")] on corresponding parameters?