Steeltoe
Steeltoe copied to clipboard
Address S3994/S3995/S3996: Use Uri instead of string in parameters/returns/properties
Address existing violations of the following, related rules:
- S3994: URI Parameters should not be strings
- S3995: URI return values should not be strings
- S3996: URI properties should not be strings
in the codebase and set severity to Warning in Steeltoe.Debug.ruleset and Steeltoe.Release.ruleset.
To find existing violations, enable the rule (see above) and rebuild src/Steeltoe.All.sln to make them appear in the Output window.
To address the violations, choose from the following on a case-by-case basis:
- Fix the violation by changing the code to not violate the rule
- When the method calls into a .NET method that has an overload for Uri, call that instead and update the method signature to take a Uri instead of a string. Consider adding an overload that takes a string, which calls this method
- Suppress the violation in code using
#pragma warning disable/restore, preceded by a justification comment if not obvious
Note: This issue mitigates security risks, though it requires a more thorough investigation on the best path forward. Should we enable (some of) the rules, or are there too many false positives, leading to numerous suppressions?
Many violations (see the list at https://github.com/SteeltoeOSS/Steeltoe/pull/1053#issuecomment-1332214236) originate from Connectors, which allow a comma-separated URI format that's incompatible with System.Uri. It's unclear to me whether we need to preserve support for that format.