Reproducer for S1192 FP: SQL Named Parameters (#9593)

analyzers/tests/SonarAnalyzer.Test/Rules/StringLiteralShouldNotBeDuplicatedTest.cs

@@ -26,6 +26,15 @@ namespace SonarAnalyzer.Test.Rules
     [TestClass]
     public class StringLiteralShouldNotBeDuplicatedTest
     {
+#if NET
+        private static readonly ImmutableArray<MetadataReference> DapperReferences = [
+            CoreMetadataReference.SystemDataCommon,
+            CoreMetadataReference.SystemComponentModelPrimitives,
+            ..NuGetMetadataReference.Dapper(),
+            ..NuGetMetadataReference.SystemDataSqlClient()
+        ];
+#endif
+
         private readonly VerifierBuilder builderCS = new VerifierBuilder<CS.StringLiteralShouldNotBeDuplicated>();
 
         [TestMethod]
@@ -58,6 +67,19 @@ public void StringLiteralShouldNotBeDuplicated_CSharp11() =>
                 .WithOptions(ParseOptionsHelper.FromCSharp11)
                 .Verify();
 
+        [TestMethod]
+        public void StringLiteralShouldNotBeDuplicated_CS_Dapper() =>
+            builderCS.AddPaths("StringLiteralShouldNotBeDuplicated.Dapper.cs")
+                .AddReferences(DapperReferences)
+                .Verify();
+
+        [TestMethod]
+        public void StringLiteralShouldNotBeDuplicated_VB_Dapper() =>
+            new VerifierBuilder<VB.StringLiteralShouldNotBeDuplicated>()
+                .AddPaths("StringLiteralShouldNotBeDuplicated.Dapper.vb")
+                .AddReferences(DapperReferences)
+                .Verify();
+
 #endif
 
         [TestMethod]

analyzers/tests/SonarAnalyzer.Test/TestCases/StringLiteralShouldNotBeDuplicated.Dapper.cs

@@ -0,0 +1,43 @@
+using Dapper;
+using System.Data.SqlClient;
+
+// https://github.com/SonarSource/sonar-dotnet/issues/9569
+public class RepeatedParameterNamesInDatabase
+{
+    public void ExecuteSqlCommandsForUsers(SqlConnection connection)
+    {
+        var query = "SELECT * FROM Users WHERE Name = @name";
+        var param = new DynamicParameters();
+        param.Add("@name", "John Doe");                     // Noncompliant - FP: @Name refers to parameters in different SQL tables.
+        var result = connection.Query<User>(query, param);  // Renaming one does not necessitate renaming of parameters with the same name from other tables.
+    }
+
+    public void ExecuteSqlCommandsForCompanies(SqlConnection connection)
+    {
+        var query = "SELECT * FROM Companies WHERE Name = @name";
+        var param = new DynamicParameters();
+        param.Add("@name", "Constosco");                    // Secondary - FP
+        var result = connection.Query<Company>(query, param);
+    }
+
+    public void ExecuteSqlCommandsForProducts(SqlConnection connection)
+    {
+        var query = "SELECT * FROM Companies WHERE Name = @name";
+        var param = new DynamicParameters();
+        param.Add("@name", "CleanBot 9000");                // Secondary - FP
+        var result = connection.Query<Product>(query, param);
+    }
+
+    public void ExecuteSqlCommandsForCountries(SqlConnection connection)
+    {
+        var query = "SELECT * FROM Countries WHERE Name = @name";
+        var param = new DynamicParameters();
+        param.Add("@name", "Norway");                       // Secondary - FP
+        var result = connection.Query<Country>(query, param);
+    }
+
+    public class Product { }
+    public class Country { }
+    public class Company { }
+    public class User { }
+}

analyzers/tests/SonarAnalyzer.Test/TestCases/StringLiteralShouldNotBeDuplicated.Dapper.vb

@@ -0,0 +1,42 @@
+Imports Dapper
+Imports System.Data.SqlClient
+
+' https://github.com/SonarSource/sonar-dotnet/issues/9569
+Public Class RepeatedParameterNamesInDatabase
+    Public Sub ExecuteSqlCommandsForUsers(connection As SqlConnection)
+        Dim query = "SELECT * FROM Users WHERE Name = @name"
+        Dim param = New DynamicParameters()
+        param.Add("@name", "John Doe")                          ' Noncompliant - FP: @Name refers to parameters in different SQL tables.
+        Dim result = connection.Query(Of User)(query, param)    ' Renaming one does not necessitate renaming of parameters with the same name from other tables.
+    End Sub
+
+    Public Sub ExecuteSqlCommandsForCompanies(connection As SqlConnection)
+        Dim query = "SELECT * FROM Companies WHERE Name = @name"
+        Dim param = New DynamicParameters()
+        param.Add("@name", "Constosco")                         ' Secondary - FP
+        Dim result = connection.Query(Of Company)(query, param)
+    End Sub
+
+    Public Sub ExecuteSqlCommandsForProducts(connection As SqlConnection)
+        Dim query = "SELECT * FROM Companies WHERE Name = @name"
+        Dim param = New DynamicParameters()
+        param.Add("@name", "CleanBot 9000")                     ' Secondary - FP
+        Dim result = connection.Query(Of Product)(query, param)
+    End Sub
+
+    Public Sub ExecuteSqlCommandsForCountries(connection As SqlConnection)
+        Dim query = "SELECT * FROM Countries WHERE Name = @name"
+        Dim param = New DynamicParameters()
+        param.Add("@name", "Norway")                            ' Secondary - FP
+        Dim result = connection.Query(Of Country)(query, param)
+    End Sub
+
+    Public Class Product
+    End Class
+    Public Class Country
+    End Class
+    Public Class Company
+    End Class
+    Public Class User
+    End Class
+End Class

analyzers/tests/SonarAnalyzer.Test/TestCases/StringLiteralShouldNotBeDuplicated.cs

@@ -129,3 +129,4 @@ public class SpecialChar
             + "Say \"hello\"";                        // Secondary
     }
 }
+

analyzers/tests/SonarAnalyzer.Test/TestCases/StringLiteralShouldNotBeDuplicated.vb

@@ -109,3 +109,49 @@
     End Class
 
 End Namespace
+
+' https://github.com/SonarSource/sonar-dotnet/issues/9569
+Namespace SqlNamedParameters
+    Public Class Program
+        Public Sub ExecuteSqlCommands()
+            Dim userCommand = New SqlCommand("SELECT * FROM Users WHERE Name = @Name")
+            userCommand.AddParameter(New SqlParameter("@Name", "John Doe"))                    ' Noncompliant - FP: @Name refers to parameters in different SQL tables.
+            Dim users = userCommand.ExecuteQuery()                                             ' Renaming one does not necessitate renaming of parameters with the same name from other tables.
+
+            Dim companyCommand = New SqlCommand("SELECT * FROM Companies WHERE Name = @Name")
+            companyCommand.AddParameter(New SqlParameter("@Name", "Contosco"))                 ' Secondary - FP
+            Dim companies = companyCommand.ExecuteQuery()
+
+            Dim productCommand = New SqlCommand("SELECT * FROM Products WHERE Name = @Name")
+            productCommand.AddParameter(New SqlParameter("@Name", "CleanBot 9000"))            ' Secondary - FP
+            Dim products = productCommand.ExecuteQuery()
+
+            Dim countryCommand = New SqlCommand("SELECT * FROM Countries WHERE Name = @Name")
+            countryCommand.AddParameter(New SqlParameter("@Name", "Norway"))                   ' Secondary - FP
+            Dim countries = countryCommand.ExecuteQuery()
+        End Sub
+    End Class
+
+    Public Class SqlCommand
+        Public ReadOnly Property CommandText As String
+        Public Sub New(commandText As String)
+            Me.CommandText = commandText
+        End Sub
+
+        Public Sub AddParameter(parameter As SqlParameter)
+        End Sub
+
+        Public Function ExecuteQuery() As Object
+            Return Nothing
+        End Function
+    End Class
+
+    Public Class SqlParameter
+        Public ReadOnly Property Name As String
+        Public ReadOnly Property Value As String
+        Public Sub New(name As String, value As String)
+            Me.Name = name
+            Me.Value = value
+        End Sub
+    End Class
+End Namespace