public void SqlCommandConcatinationAnalyserReportsNothingIfArgumentsIsMethodCall()
{
string code = @"
using System;
using System.Data.SqlClient;
public class TestClass
{
public void TestMethod(SqlConnection connection)
{
SqlCommand sql = new SqlCommand(this.GetCommand(), connection);
}
private string GetCommand()
{
return ""SELECT * FROM dbo.Users"";
}
}
";
CompilationUnitSyntax root = CSharpSyntaxTree.ParseText(code).GetCompilationUnitRoot();
SqlCommandConcatinationAnalyser analyser = new SqlCommandConcatinationAnalyser();
analyser.Visit(root);
IReadOnlyCollection <AnalyserItem> result = analyser.AnalyserItems;
Assert.Empty(result);
}
public void SqlCommandConcatinationAnalyserReportsIfArgumentsVariableIsConcatenatedWithMethodCall()
{
string code = @"
using System;
using System.Data.SqlClient;
public class TestClass
{
public void TestMethod(SqlConnection connection)
{
string cmd = ""SELECT * FROM dbo.Users WHERE id = "" + this.GetID();
SqlCommand sql = new SqlCommand(cmd, connection);
}
private int GetID()
{
return 1;
}
}
";
CompilationUnitSyntax root = CSharpSyntaxTree.ParseText(code).GetCompilationUnitRoot();
SqlCommandConcatinationAnalyser analyser = new SqlCommandConcatinationAnalyser();
analyser.Visit(root);
IReadOnlyCollection <AnalyserItem> result = analyser.AnalyserItems;
Assert.NotEmpty(result);
Assert.Equal(1, result.Count);
Assert.Equal("Concatinated SQL string", result.Last().Message);
Assert.Equal(9, result.Last().NodeReference.GetSyntax().GetLocation().GetMappedLineSpan().StartLinePosition.Line);
}
public void SqlCommandConcatinationAnalyserReportsNothingIfArgumentsVariableIsParameter()
{
string code = @"
using System;
using System.Data.SqlClient;
public class TestClass
{
public void TestMethod(SqlConnection connection, string cmd)
{
SqlCommand sql = new SqlCommand(cmd, connection);
}
}
";
CompilationUnitSyntax root = CSharpSyntaxTree.ParseText(code).GetCompilationUnitRoot();
SqlCommandConcatinationAnalyser analyser = new SqlCommandConcatinationAnalyser();
analyser.Visit(root);
IReadOnlyCollection <AnalyserItem> result = analyser.AnalyserItems;
Assert.Empty(result);
}