Summary
--visibility and --exclude-visibility accept comma-separated values and split/deduplicate the raw input before enforcing the small supported visibility set.
Evidence
QueryCommandRunner.AddVisibilityFilterValues calls rawValue.Split(,, StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries), lowercases the values, runs Distinct, and materializes a list before checking entries against KnownVisibilityFilters.
Impact
A very large CSV value can cause unnecessary allocations and CPU work even though only public, protected, internal, and private are supported.
Expected
Cap the raw CSV length and entry count before splitting, then validate against the known visibility set.
Summary
--visibilityand--exclude-visibilityaccept comma-separated values and split/deduplicate the raw input before enforcing the small supported visibility set.Evidence
QueryCommandRunner.AddVisibilityFilterValuescallsrawValue.Split(,, StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries), lowercases the values, runsDistinct, and materializes a list before checking entries againstKnownVisibilityFilters.Impact
A very large CSV value can cause unnecessary allocations and CPU work even though only public, protected, internal, and private are supported.
Expected
Cap the raw CSV length and entry count before splitting, then validate against the known visibility set.