ArgumentNullException in SourceTriggeredTaintedDataAnalyzerBase for VB assembly attributes

[mavasani]

Unit test for ReviewCodeForSqlInjectionVulnerabilitiesTests

        [Fact]
        public async Task AssemblyAttributeRegressionTest()
        {
            await VerifyVisualBasicWithDependenciesAsync(@"<Assembly: System.Reflection.AssemblyTitle(""Title"")>");
        }

Exception call stack

    // error AD0001: Analyzer 'Microsoft.NetCore.Analyzers.Security.ReviewCodeForSqlInjectionVulnerabilities' threw an exception of type 'System.ArgumentNullException' with message 'Value cannot be null. (Parameter 'key')'.
    Exception occurred with following context:
    Compilation: TestProject
    ISymbol:  (Namespace)
    
    System.ArgumentNullException: Value cannot be null. (Parameter 'key')
       at System.Collections.Immutable.Requires.FailArgumentNullException(String parameterName)
       at System.Collections.Immutable.ImmutableDictionary`2.TryGetValue(TKey key, TValue& value)
       at Analyzer.Utilities.AggregateCategorizedAnalyzerConfigOptions.TryGetOptionValue[T](String optionName, OptionKind kind, SyntaxTree tree, DiagnosticDescriptor rule, TryParseValue`1 tryParseValue, T defaultValue, T& value) in c:\roslyn-analyzers\src\Utilities\Compiler\Options\AggregateCategorizedAnalyzerConfigOptions.cs:line 101
       at Analyzer.Utilities.AggregateCategorizedAnalyzerConfigOptions.GetOptionValue[T](String optionName, SyntaxTree tree, DiagnosticDescriptor rule, TryParseValue`1 tryParseValue, T defaultValue, OptionKind kind) in c:\roslyn-analyzers\src\Utilities\Compiler\Options\AggregateCategorizedAnalyzerConfigOptions.cs:line 79
       at Analyzer.Utilities.AnalyzerOptionsExtensions.GetNonFlagsEnumOptionValue[TEnum](AnalyzerOptions options, String optionName, DiagnosticDescriptor rule, SyntaxTree tree, Compilation compilation, TEnum defaultValue, CancellationToken cancellationToken) in c:\roslyn-analyzers\src\Utilities\Compiler\Options\AnalyzerOptionsExtensions.cs:line 187
       at Analyzer.Utilities.AnalyzerOptionsExtensions.GetInterproceduralAnalysisKindOption(AnalyzerOptions options, DiagnosticDescriptor rule, SyntaxTree tree, Compilation compilation, InterproceduralAnalysisKind defaultValue, CancellationToken cancellationToken) in c:\roslyn-analyzers\src\Utilities\FlowAnalysis\Options\AnalyzerOptionsExtensions_FlowAnalysis.cs:line 31
       at Microsoft.CodeAnalysis.FlowAnalysis.DataFlow.InterproceduralAnalysisConfiguration.Create(AnalyzerOptions analyzerOptions, DiagnosticDescriptor rule, SyntaxTree tree, Compilation compilation, InterproceduralAnalysisKind defaultInterproceduralAnalysisKind, CancellationToken cancellationToken, UInt32 defaultMaxInterproceduralMethodCallChain, UInt32 defaultMaxInterproceduralLambdaOrLocalFunctionCallChain) in c:\roslyn-analyzers\src\Utilities\FlowAnalysis\FlowAnalysis\Framework\DataFlow\InterproceduralAnalysisConfiguration.cs:line 62
       at Microsoft.CodeAnalysis.FlowAnalysis.DataFlow.InterproceduralAnalysisConfiguration.Create(AnalyzerOptions analyzerOptions, ImmutableArray`1 rules, SyntaxTree tree, Compilation compilation, InterproceduralAnalysisKind defaultInterproceduralAnalysisKind, CancellationToken cancellationToken, UInt32 defaultMaxInterproceduralMethodCallChain, UInt32 defaultMaxInterproceduralLambdaOrLocalFunctionCallChain) in c:\roslyn-analyzers\src\Utilities\FlowAnalysis\FlowAnalysis\Framework\DataFlow\InterproceduralAnalysisConfiguration.cs:line 111
       at Microsoft.CodeAnalysis.FlowAnalysis.DataFlow.InterproceduralAnalysisConfiguration.Create(AnalyzerOptions analyzerOptions, ImmutableArray`1 rules, ISymbol symbol, Compilation compilation, InterproceduralAnalysisKind defaultInterproceduralAnalysisKind, CancellationToken cancellationToken, UInt32 defaultMaxInterproceduralMethodCallChain, UInt32 defaultMaxInterproceduralLambdaOrLocalFunctionCallChain) in c:\roslyn-analyzers\src\Utilities\FlowAnalysis\FlowAnalysis\Framework\DataFlow\InterproceduralAnalysisConfiguration.cs:line 93
       at Microsoft.NetCore.Analyzers.Security.SourceTriggeredTaintedDataAnalyzerBase.<>c__DisplayClass6_0.<Initialize>b__1(OperationBlockStartAnalysisContext operationBlockStartContext) in c:\roslyn-analyzers\src\NetAnalyzers\Core\Microsoft.NetCore.Analyzers\Security\SourceTriggeredTaintedDataAnalyzerBase.cs:line 80
       at Microsoft.CodeAnalysis.Diagnostics.AnalyzerExecutor.<>c__62`6.<ExecuteBlockActionsCore>b__62_2(ValueTuple`5 data)
       at Microsoft.CodeAnalysis.Diagnostics.AnalyzerExecutor.ExecuteAndCatchIfThrows_NoLock[TArg](DiagnosticAnalyzer analyzer, Action`1 analyze, TArg argument, Nullable`1 info)
    -----

[mavasani]

I am testing a fix and will send PRs to 2.9.x and release/5.0.2xx branches soon. FYI @dotpaul

[reduckted]

I'm seeing the same exceptions from all of these analyzers when using .NET SDK 5.0.102:

• Microsoft.NetCore.Analyzers.Security.DoNotAddArchiveItemPathToTheTargetFileSystemPath
• Microsoft.NetCore.Analyzers.Security.DoNotHardCodeCertificate
• Microsoft.NetCore.Analyzers.Security.DoNotHardCodeEncryptionKey
• Microsoft.NetCore.Analyzers.Security.ReviewCodeForCommandExecutionVulnerabilities
• Microsoft.NetCore.Analyzers.Security.ReviewCodeForDllInjectionVulnerabilities
• Microsoft.NetCore.Analyzers.Security.ReviewCodeForFilePathInjectionVulnerabilities
• Microsoft.NetCore.Analyzers.Security.ReviewCodeForRegexInjectionVulnerabilities
• Microsoft.NetCore.Analyzers.Security.ReviewCodeForSqlInjectionVulnerabilities
• Microsoft.NetCore.Analyzers.Security.ReviewCodeForXmlInjectionVulnerabilities
• Microsoft.NetCore.Analyzers.Security.ReviewCodeForXPathInjectionVulnerabilities

@mavasani, does your PR fix all of those, or could some of those exceptions be caused by a different problem?