[Bug]: C# emitter does not guard against null `ToString()` when serializing exploded query parameters backed by string structs

[joseharriaga]

Describe the bug

When a TypeSpec model property is a string-backed struct (e.g. an extensible enum backed by a string) and it is used as an exploded @query array parameter, the C# emitter generates code that calls .ToString() on each element and passes the result directly to AppendQuery(..., escape: true).

Because a default-constructed string-backed struct has a null internal string, .ToString() can return null. Uri.EscapeDataString (called internally by AppendQuery) throws an ArgumentNullException when passed a null string, causing a runtime crash.

Example of the generated code pattern that is unsafe:

foreach (var @param in include)
{
    uri.AppendQuery("include[]", @param.ToString(), true);
}

The emitter should guard against null/empty values before appending each exploded query parameter, for example:

foreach (var @param in include)
{
    if (!string.IsNullOrEmpty(@param.ToString()))
    {
        uri.AppendQuery("include[]", @param.ToString(), true);
    }
}

This was identified in openai/openai-dotnet#1255 where IncludedConversationItemProperty is a string-backed struct and the generated ConversationClient.RestClient.cs contained this pattern in multiple locations (lines 43, 62, and 103 of the generated file).

Reproduction

1. Define a TypeSpec model with a string-backed extensible enum, e.g.:

@doc("An extensible string enum")
union MyStringEnum {
  string,
  valueA: "value-a",
  valueB: "value-b",
}

2. Use it as an exploded array query parameter on an operation:

op myOp(
  @query(#{ explode: true }) include: MyStringEnum[],
): void;

3. Emit the C# client with @typespec/http-client-csharp.
4. Observe the generated code calls @param.ToString() without a null guard inside the foreach loop before passing to AppendQuery(..., escape: true).
5. At runtime, constructing a default MyStringEnum value (null internal string) and including it in the include list causes Uri.EscapeDataString to throw ArgumentNullException.

Checklist

• Follow our Code of Conduct
• Check that there isn't already an issue that request the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion.
• The provided reproduction is a minimal reproducible example of the bug.

[github-actions]

🎯 Issue Triage

The C# emitter generates unsafe code when serializing exploded @query array parameters backed by string structs (extensible enums): it calls .ToString() without a null guard, causing Uri.EscapeDataString to throw ArgumentNullException at runtime for default-constructed struct values.

Category: Bug
Area: emitter:client:csharp

🔗 [Playground Reproduction]((typespec.io/redacted)

📋 Reproduction code

import "`@typespec/http`";
using TypeSpec.Http;

`@doc`("An extensible string enum")
union MyStringEnum {
  string,
  valueA: "value-a",
  valueB: "value-b",
}

op myOp(
  `@query`(#{ explode: true }) include: MyStringEnum[],
): void;

🔍 Analysis

• Affected component: @typespec/http-client-csharp — the code path that generates foreach loops for exploded array query parameters backed by string-backed structs.
• Root cause: The emitter emits uri.AppendQuery(name, @param.ToString(), true) directly inside the loop. A default-constructed string-backed struct (e.g., new MyStringEnum()) has a null internal _value field, so .ToString() returns null. Uri.EscapeDataString(null) throws ArgumentNullException.
• Fix direction: Add a !string.IsNullOrEmpty(@param.ToString()) guard before each AppendQuery call in the generated foreach, or ensure the ToString() override returns an empty string for default-constructed instances.
• Real-world impact: Identified in openai/openai-dotnet#1255 — affects ConversationClient.RestClient.cs at lines 43, 62, and 103.
• Related (different root cause): [Bug]: C# client emits wrong query string for @query(#{explode: true}) on nested object models #11123 — C# emitter emits wrong query string for @query(#{explode: true}) on nested object models (closed).

📝 Suggested next steps

• Locate the C# emitter code that generates the foreach loop for exploded array query params.
• Add a null/empty guard (if (!string.IsNullOrEmpty(@param.ToString()))) before each AppendQuery call, or fix the ToString() override of string-backed structs to never return null.
• Add a regression test covering extensible enum (string-backed union) used as an exploded @query array.

Generated by Agentic Triage