Steeltoe icon indicating copy to clipboard operation
Steeltoe copied to clipboard

Address S3994/S3995/S3996: Use Uri instead of string in parameters/returns/properties

Open bart-vmware opened this issue 3 years ago • 1 comments

Address existing violations of the following, related rules:

in the codebase and set severity to Warning in Steeltoe.Debug.ruleset and Steeltoe.Release.ruleset.

To find existing violations, enable the rule (see above) and rebuild src/Steeltoe.All.sln to make them appear in the Output window.

To address the violations, choose from the following on a case-by-case basis:

  • Fix the violation by changing the code to not violate the rule
    • When the method calls into a .NET method that has an overload for Uri, call that instead and update the method signature to take a Uri instead of a string. Consider adding an overload that takes a string, which calls this method
  • Suppress the violation in code using #pragma warning disable/restore, preceded by a justification comment if not obvious

Note: This issue mitigates security risks, though it requires a more thorough investigation on the best path forward. Should we enable (some of) the rules, or are there too many false positives, leading to numerous suppressions?

bart-vmware avatar Dec 05 '22 13:12 bart-vmware

Many violations (see the list at https://github.com/SteeltoeOSS/Steeltoe/pull/1053#issuecomment-1332214236) originate from Connectors, which allow a comma-separated URI format that's incompatible with System.Uri. It's unclear to me whether we need to preserve support for that format.

bart-vmware avatar Dec 05 '22 13:12 bart-vmware