C#: Models for Microsoft.Data.SqlClient.

[michaelnebel]

In this PR we

• Add explicit Models as Data models for Microsoft.Data.SqlClient.[SqlCommand|SqlDataAdapter].
• Add stubs for Microsoft.Data.SqlClient using the stub generator.
• Convert tests for cs/sql-injection to inline expectations tests.

Note that prior to this change Microsoft.Data.SqlClient.SqlCommand was identified as a sink since it is declared in type that implements the System.Data.IDbCommand interface. Furthermore, Microsoft.Data.SqlClient.SqlDataAdapter was not modelled as a sink.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

• Changes to framework-coverage-csharp.rst:

-    Others,"``Amazon.Lambda.APIGatewayEvents``, ``Amazon.Lambda.Core``, ``Dapper``, ``ILCompiler``, ``ILLink.RoslynAnalyzer``, ``ILLink.Shared``, ``ILLink.Tasks``, ``Internal.IL``, ``Internal.Pgo``, ``Internal.TypeSystem``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.AspNetCore.Components``, ``Microsoft.AspNetCore.Http``, ``Microsoft.AspNetCore.Mvc``, ``Microsoft.AspNetCore.WebUtilities``, ``Microsoft.CSharp``, ``Microsoft.Diagnostics.Tools.Pgo``, ``Microsoft.DotNet.Build.Tasks``, ``Microsoft.DotNet.PlatformAbstractions``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.Diagnostics.Metrics``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.JSInterop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``Mono.Linker``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``SourceGenerators``, ``Windows.Security.Cryptography.Core``",60,2253,152,4
+    Others,"``Amazon.Lambda.APIGatewayEvents``, ``Amazon.Lambda.Core``, ``Dapper``, ``ILCompiler``, ``ILLink.RoslynAnalyzer``, ``ILLink.Shared``, ``ILLink.Tasks``, ``Internal.IL``, ``Internal.Pgo``, ``Internal.TypeSystem``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.AspNetCore.Components``, ``Microsoft.AspNetCore.Http``, ``Microsoft.AspNetCore.Mvc``, ``Microsoft.AspNetCore.WebUtilities``, ``Microsoft.CSharp``, ``Microsoft.Data.SqlClient``, ``Microsoft.Diagnostics.Tools.Pgo``, ``Microsoft.DotNet.Build.Tasks``, ``Microsoft.DotNet.PlatformAbstractions``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.Diagnostics.Metrics``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.JSInterop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``Mono.Linker``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``SourceGenerators``, ``Windows.Security.Cryptography.Core``",60,2257,159,4
-    Totals,,107,14399,400,9
+    Totals,,107,14403,407,9

• Changes to framework-coverage-csharp.csv:

+ Microsoft.Data.SqlClient,7,,4,,,,,,,,,,7,,,,,,,,,4,

[Copilot]

Pull Request Overview

Adds support for modeling Microsoft.Data.SqlClient sinks and establishes stubs for related assemblies to enable inline expectation tests.

• Include Microsoft.Data.SqlClient in the stub-generation script.
• Add stub project and code files for various .NET libraries under csharp/ql/test/resources/stubs.
• (Also converted cs/sql-injection tests to inline expectations, not shown here.)

Reviewed Changes

Copilot reviewed 64 out of 66 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
csharp/scripts/stubs/make_stubs_all.py	Include "Microsoft.Data.SqlClient" in the list of libraries for stub generation.
csharp/ql/test/resources/stubs/System.Threading.Tasks.Extensions/4.5.4/System.Threading.Tasks.Extensions.csproj	Add stub project for System.Threading.Tasks.Extensions 4.5.4.
csharp/ql/test/resources/stubs/System.Text.Json/4.7.2/System.Text.Json.csproj	Add stub project for System.Text.Json 4.7.2.
csharp/ql/test/resources/stubs/System.Text.Encodings.Web/4.7.2/System.Text.Encodings.Web.csproj	Add stub project for System.Text.Encodings.Web 4.7.2.
csharp/ql/test/resources/stubs/System.Security.Cryptography.ProtectedData/9.0.4/System.Security.Cryptography.ProtectedData.csproj	Add stub project for System.Security.Cryptography.ProtectedData 9.0.4.
…	…

[hvitved]

Note that prior to this change Microsoft.Data.SqlClient.SqlCommand was identified as a sink since it is declared in type that implements the System.Data.IDbCommand interface.

Why do we then need to (re)model it?

[michaelnebel]

Note that prior to this change Microsoft.Data.SqlClient.SqlCommand was identified as a sink since it is declared in type that implements the System.Data.IDbCommand interface.

Why do we then need to (re)model it?

• For consistency with other sealed classes and model them using MaD.
• It might be what is causing the result from missing in the reported issue; If the build-mode: none for some reason doesn't correctly extract the type information (the inheritance hierarchy) then the method will not be identified as a sink.

[michaelnebel]

DCA looks uneventful.