Create rule S6932: Use model binding instead of reading raw request data

analyzers/rspec/cs/S6932.json

@@ -0,0 +1,25 @@
+{
+  "title": "Use model binding instead of reading raw request data",
+  "type": "CODE_SMELL",
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "5min"
+  },
+  "tags": [
+    "asp.net"
+  ],
+  "defaultSeverity": "Major",
+  "ruleSpecification": "RSPEC-6932",
+  "sqKey": "S6932",
+  "scope": "Main",
+  "quickfix": "infeasible",
+  "code": {
+    "impacts": {
+      "MAINTAINABILITY": "HIGH",
+      "RELIABILITY": "MEDIUM",
+      "SECURITY": "MEDIUM"
+    },
+    "attribute": "FOCUSED"
+  }
+}

analyzers/rspec/cs/Sonar_way_profile.json

@@ -307,6 +307,7 @@
     "S6797",
     "S6798",
     "S6800",
-    "S6803"
+    "S6803",
+    "S6932"
   ]
 }

analyzers/src/RuleDescriptorGenerator/packages.lock.json

@@ -929,6 +929,7 @@
         "type": "Project",
         "dependencies": {
           "Microsoft.CodeAnalysis.CSharp.Workspaces": "[1.3.2, )",
+          "Microsoft.CodeAnalysis.VisualBasic.Workspaces": "[1.3.2, )",
           "Microsoft.Composition": "[1.0.27, )",
           "System.Collections.Immutable": "[1.1.37, )"
         }

analyzers/src/SonarAnalyzer.CFG/ShimLayer/AnalysisContext/CompilationStartAnalysisContextExtensions.cs

@@ -0,0 +1,65 @@
+/*
+ * SonarAnalyzer for .NET
+ * Copyright (C) 2015-2024 SonarSource SA
+ * mailto: contact AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+using System.Diagnostics.CodeAnalysis;
+using static System.Linq.Expressions.Expression;
+
+namespace SonarAnalyzer.ShimLayer.AnalysisContext;
+
+// Code is executed in static initializers and is not detected by the coverage tool
+// See the SonarAnalysisContextTest.SonarCompilationStartAnalysisContext_RegisterSymbolStartAction family of tests to check test coverage manually
+[ExcludeFromCodeCoverage]
+public static class CompilationStartAnalysisContextExtensions
+{
+    private static readonly Action<CompilationStartAnalysisContext, Action<SymbolStartAnalysisContextWrapper>, SymbolKind> RegisterSymbolStartActionWrapper =
+        CreateRegisterSymbolStartAnalysisWrapper();
+
+    public static void RegisterSymbolStartAction(this CompilationStartAnalysisContext context, Action<SymbolStartAnalysisContextWrapper> action, SymbolKind symbolKind) =>
+        RegisterSymbolStartActionWrapper(context, action, symbolKind);
+
+    private static Action<CompilationStartAnalysisContext, Action<SymbolStartAnalysisContextWrapper>, SymbolKind> CreateRegisterSymbolStartAnalysisWrapper()
+    {
+        if (typeof(CompilationStartAnalysisContext).GetMethod(nameof(RegisterSymbolStartAction)) is not { } registerMethod)
+        {
+            return static (_, _, _) => { };
+        }
+
+        var contextParameter = Parameter(typeof(CompilationStartAnalysisContext));
+        var shimmedActionParameter = Parameter(typeof(Action<SymbolStartAnalysisContextWrapper>));
+        var symbolKindParameter = Parameter(typeof(SymbolKind));
+
+        var roslynSymbolStartAnalysisContextType = typeof(CompilationStartAnalysisContext).Assembly.GetType("Microsoft.CodeAnalysis.Diagnostics.SymbolStartAnalysisContext");
+        var roslynSymbolStartAnalysisActionType = typeof(Action<>).MakeGenericType(roslynSymbolStartAnalysisContextType);
+        var roslynSymbolStartAnalysisContextParameter = Parameter(roslynSymbolStartAnalysisContextType);
+        var sonarSymbolStartAnalysisContextCtor = typeof(SymbolStartAnalysisContextWrapper).GetConstructors().Single();
+
+        // Action<Roslyn.SymbolStartAnalysisContext> registerAction = roslynSymbolStartAnalysisContextParameter =>
+        //    shimmedActionParameter.Invoke(new Sonar.SymbolStartAnalysisContextWrapper(roslynSymbolStartAnalysisContextParameter))
+        var registerAction = Lambda(
+            delegateType: roslynSymbolStartAnalysisActionType,
+            body: Call(shimmedActionParameter, nameof(Action.Invoke), [], New(sonarSymbolStartAnalysisContextCtor, roslynSymbolStartAnalysisContextParameter)),
+            parameters: roslynSymbolStartAnalysisContextParameter);
+
+        // (contextParameter, shimmedActionParameter, symbolKindParameter) => contextParameter.RegisterSymbolStartAction(registerAction, symbolKindParameter)
+        return Lambda<Action<CompilationStartAnalysisContext, Action<SymbolStartAnalysisContextWrapper>, SymbolKind>>(
+            Call(contextParameter, registerMethod, registerAction, symbolKindParameter),
+            contextParameter, shimmedActionParameter, symbolKindParameter).Compile();
+    }
+}

analyzers/src/SonarAnalyzer.CFG/ShimLayer/AnalysisContext/SymbolStartAnalysisContextWrapper.cs

@@ -0,0 +1,165 @@
+/*
+ * SonarAnalyzer for .NET
+ * Copyright (C) 2015-2024 SonarSource SA
+ * mailto: contact AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+using System.Diagnostics.CodeAnalysis;
+using static System.Linq.Expressions.Expression;
+using CS = Microsoft.CodeAnalysis.CSharp;
+using VB = Microsoft.CodeAnalysis.VisualBasic;
+
+namespace SonarAnalyzer.ShimLayer.AnalysisContext;
+
+// Code is executed in static initializers and is not detected by the coverage tool
+// See the RegisterSymbolStartActionWrapperTest family of tests to check test coverage manually
+[ExcludeFromCodeCoverage]
+public readonly struct SymbolStartAnalysisContextWrapper
+{
+    private static readonly Func<object, CancellationToken> CancellationTokenAccessor;
+    private static readonly Func<object, Compilation> CompilationAccessor;
+    private static readonly Func<object, AnalyzerOptions> OptionsAccessor;
+    private static readonly Func<object, ISymbol> SymbolAccessor;
+
+    private static readonly Action<object, Action<CodeBlockAnalysisContext>> RegisterCodeBlockActionMethod;
+    private static readonly Action<object, Action<CodeBlockStartAnalysisContext<CS.SyntaxKind>>> RegisterCodeBlockStartActionCS;
+    private static readonly Action<object, Action<CodeBlockStartAnalysisContext<VB.SyntaxKind>>> RegisterCodeBlockStartActionVB;
+    private static readonly Action<object, Action<OperationAnalysisContext>, ImmutableArray<OperationKind>> RegisterOperationActionMethod;
+    private static readonly Action<object, Action<OperationBlockAnalysisContext>> RegisterOperationBlockActionMethod;
+    private static readonly Action<object, Action<OperationBlockStartAnalysisContext>> RegisterOperationBlockStartActionMethod;
+    private static readonly Action<object, Action<SymbolAnalysisContext>> RegisterSymbolEndActionMethod;
+    private static readonly Action<object, Action<SyntaxNodeAnalysisContext>, ImmutableArray<CS.SyntaxKind>> RegisterSyntaxNodeActionCS;
+    private static readonly Action<object, Action<SyntaxNodeAnalysisContext>, ImmutableArray<VB.SyntaxKind>> RegisterSyntaxNodeActionVB;
+
+    public CancellationToken CancellationToken => CancellationTokenAccessor(RoslynSymbolStartAnalysisContext);
+    public Compilation Compilation => CompilationAccessor(RoslynSymbolStartAnalysisContext);
+    public AnalyzerOptions Options => OptionsAccessor(RoslynSymbolStartAnalysisContext);
+    public ISymbol Symbol => SymbolAccessor(RoslynSymbolStartAnalysisContext);
+    private object RoslynSymbolStartAnalysisContext { get; }
+
+    static SymbolStartAnalysisContextWrapper()
+    {
+        var symbolStartAnalysisContextType = typeof(CompilationStartAnalysisContext).Assembly.GetType("Microsoft.CodeAnalysis.Diagnostics.SymbolStartAnalysisContext");
+        CancellationTokenAccessor = CreatePropertyAccessor<CancellationToken>(nameof(CancellationToken));
+        CompilationAccessor = CreatePropertyAccessor<Compilation>(nameof(Compilation));
+        OptionsAccessor = CreatePropertyAccessor<AnalyzerOptions>(nameof(Options));
+        SymbolAccessor = CreatePropertyAccessor<ISymbol>(nameof(Symbol));
+        RegisterCodeBlockActionMethod = CreateRegistrationMethod<CodeBlockAnalysisContext>(nameof(RegisterCodeBlockAction));
+        RegisterCodeBlockStartActionCS =
+            CreateRegistrationMethod<CodeBlockStartAnalysisContext<CS.SyntaxKind>>(nameof(RegisterCodeBlockStartAction), typeof(CS.SyntaxKind));
+        RegisterCodeBlockStartActionVB =
+            CreateRegistrationMethod<CodeBlockStartAnalysisContext<VB.SyntaxKind>>(nameof(RegisterCodeBlockStartAction), typeof(VB.SyntaxKind));
+        RegisterOperationActionMethod =
+            CreateRegistrationMethodWithAdditionalParameter<OperationAnalysisContext, ImmutableArray<OperationKind>>(nameof(RegisterOperationAction));
+        RegisterOperationBlockActionMethod = CreateRegistrationMethod<OperationBlockAnalysisContext>(nameof(RegisterOperationBlockAction));
+        RegisterOperationBlockStartActionMethod = CreateRegistrationMethod<OperationBlockStartAnalysisContext>(nameof(RegisterOperationBlockStartAction));
+        RegisterSymbolEndActionMethod = CreateRegistrationMethod<SymbolAnalysisContext>(nameof(RegisterSymbolEndAction));
+        RegisterSyntaxNodeActionCS = CreateRegistrationMethodWithAdditionalParameter<SyntaxNodeAnalysisContext, ImmutableArray<CS.SyntaxKind>>(
+            nameof(RegisterSyntaxNodeAction), typeof(CS.SyntaxKind));
+        RegisterSyntaxNodeActionVB = CreateRegistrationMethodWithAdditionalParameter<SyntaxNodeAnalysisContext, ImmutableArray<VB.SyntaxKind>>(
+            nameof(RegisterSyntaxNodeAction), typeof(VB.SyntaxKind));
+
+        // receiverParameter => ((symbolStartAnalysisContextType)receiverParameter)."propertyName"
+        Func<object, TProperty> CreatePropertyAccessor<TProperty>(string propertyName)
+        {
+            var receiverParameter = Parameter(typeof(object));
+            return Lambda<Func<object, TProperty>>(
+                Property(Convert(receiverParameter, symbolStartAnalysisContextType), propertyName),
+                receiverParameter).Compile();
+        }
+
+        // (object receiverParameter, Action<TContext> registerActionParameter) =>
+        //     ((symbolStartAnalysisContextType)receiverParameter)."registrationMethodName"<typeArguments>(registerActionParameter)
+        Action<object, Action<TContext>> CreateRegistrationMethod<TContext>(string registrationMethodName, params Type[] typeArguments)
+        {
+            var receiverParameter = Parameter(typeof(object));
+            var registerActionParameter = Parameter(typeof(Action<TContext>));
+            return Lambda<Action<object, Action<TContext>>>(
+                Call(Convert(receiverParameter, symbolStartAnalysisContextType), registrationMethodName, typeArguments, registerActionParameter),
+                receiverParameter,
+                registerActionParameter).Compile();
+        }
+
+        // (object receiverParameter, Action<TContext> registerActionParameter, TParameter additionalParameter) =>
+        //     ((symbolStartAnalysisContextType)receiverParameter)."registrationMethodName"<typeArguments>(registerActionParameter, additionalParameter)
+        Action<object, Action<TContext>, TParameter> CreateRegistrationMethodWithAdditionalParameter<TContext, TParameter>(string registrationMethodName, params Type[] typeArguments)
+        {
+            var receiverParameter = Parameter(typeof(object));
+            var registerActionParameter = Parameter(typeof(Action<TContext>));
+            var additionalParameter = Parameter(typeof(TParameter));
+            return Lambda<Action<object, Action<TContext>, TParameter>>(
+                Call(Convert(receiverParameter, symbolStartAnalysisContextType), registrationMethodName, typeArguments, registerActionParameter, additionalParameter),
+                receiverParameter,
+                registerActionParameter,
+                additionalParameter).Compile();
+        }
+    }
+
+    public SymbolStartAnalysisContextWrapper(object roslynSymbolStartAnalysisContext) =>
+        RoslynSymbolStartAnalysisContext = roslynSymbolStartAnalysisContext;
+
+    public void RegisterCodeBlockAction(Action<CodeBlockAnalysisContext> action) =>
+        RegisterCodeBlockActionMethod(RoslynSymbolStartAnalysisContext, action);
+
+    public void RegisterCodeBlockStartAction<TLanguageKindEnum>(Action<CodeBlockStartAnalysisContext<TLanguageKindEnum>> action) where TLanguageKindEnum : struct
+    {
+        var languageKindType = typeof(TLanguageKindEnum);
+        if (languageKindType == typeof(CS.SyntaxKind))
+        {
+            var cast = (Action<CodeBlockStartAnalysisContext<CS.SyntaxKind>>)action;
+            RegisterCodeBlockStartActionCS(RoslynSymbolStartAnalysisContext, cast);
+        }
+        else if (languageKindType == typeof(VB.SyntaxKind))
+        {
+            var cast = (Action<CodeBlockStartAnalysisContext<VB.SyntaxKind>>)action;
+            RegisterCodeBlockStartActionVB(RoslynSymbolStartAnalysisContext, cast);
+        }
+        else
+        {
+            throw new ArgumentException("Invalid type parameter.", nameof(TLanguageKindEnum));
+        }
+    }
+
+    public void RegisterOperationAction(Action<OperationAnalysisContext> action, ImmutableArray<OperationKind> operationKinds) =>
+        RegisterOperationActionMethod(RoslynSymbolStartAnalysisContext, action, operationKinds);
+
+    public void RegisterOperationBlockAction(Action<OperationBlockAnalysisContext> action) =>
+        RegisterOperationBlockActionMethod(RoslynSymbolStartAnalysisContext, action);
+
+    public void RegisterOperationBlockStartAction(Action<OperationBlockStartAnalysisContext> action) =>
+        RegisterOperationBlockStartActionMethod(RoslynSymbolStartAnalysisContext, action);
+
+    public void RegisterSymbolEndAction(Action<SymbolAnalysisContext> action) =>
+        RegisterSymbolEndActionMethod(RoslynSymbolStartAnalysisContext, action);
+
+    public void RegisterSyntaxNodeAction<TLanguageKindEnum>(Action<SyntaxNodeAnalysisContext> action, params TLanguageKindEnum[] syntaxKinds) where TLanguageKindEnum : struct
+    {
+        var languageKindType = typeof(TLanguageKindEnum);
+        if (languageKindType == typeof(CS.SyntaxKind))
+        {
+            RegisterSyntaxNodeActionCS(RoslynSymbolStartAnalysisContext, action, syntaxKinds.Cast<CS.SyntaxKind>().ToImmutableArray());
+        }
+        else if (languageKindType == typeof(VB.SyntaxKind))
+        {
+            RegisterSyntaxNodeActionVB(RoslynSymbolStartAnalysisContext, action, syntaxKinds.Cast<VB.SyntaxKind>().ToImmutableArray());
+        }
+        else
+        {
+            throw new ArgumentException("Invalid type parameter.", nameof(TLanguageKindEnum));
+        }
+    }
+}

analyzers/src/SonarAnalyzer.CFG/SonarAnalyzer.CFG.csproj

@@ -9,6 +9,7 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="1.3.2" />
+    <PackageReference Include="Microsoft.CodeAnalysis.VisualBasic.Workspaces" Version="1.3.2" />
     <PackageReference Include="Microsoft.CodeAnalysis.PerformanceSensitiveAnalyzers" Version="3.3.1">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

analyzers/src/SonarAnalyzer.CFG/packages.lock.json

@@ -18,6 +18,16 @@
         "resolved": "3.3.1",
         "contentHash": "eT+kgNCDdTRbQ5WF6BGx1HI3D5jYfHteza/koefhWC2vNZGxObA74XxwWfg40dy3uUv7dn3OGKLK5GUPLroVog=="
       },
+      "Microsoft.CodeAnalysis.VisualBasic.Workspaces": {
+        "type": "Direct",
+        "requested": "[1.3.2, )",
+        "resolved": "1.3.2",
+        "contentHash": "I5Z2WBgFsx0G22Na1uVFPDkT6Ob4XI+g91GPN8JWldYUMlmIBcUDBfGmfr8oQPdUipvThpaU1x1xZrnNwRR8JA==",
+        "dependencies": {
+          "Microsoft.CodeAnalysis.VisualBasic": "[1.3.2]",
+          "Microsoft.CodeAnalysis.Workspaces.Common": "[1.3.2]"
+        }
+      },
       "Microsoft.Composition": {
         "type": "Direct",
         "requested": "[1.0.27, )",
@@ -117,6 +127,14 @@
           "Microsoft.CodeAnalysis.Common": "[1.3.2]"
         }
       },
+      "Microsoft.CodeAnalysis.VisualBasic": {
+        "type": "Transitive",
+        "resolved": "1.3.2",
+        "contentHash": "yllH3rSYEc0bV15CJ2T9Jtx+tSXO5/OVNb+xofuWrACn65Q5VqeFBKgcbgwpyVY/98ypPcGQIWNQL2A/L1seJg==",
+        "dependencies": {
+          "Microsoft.CodeAnalysis.Common": "1.3.2"
+        }
+      },
       "Microsoft.CodeAnalysis.Workspaces.Common": {
         "type": "Transitive",
         "resolved": "1.3.2",