Repository navigation
Fix SonarCloud and CodeQL findings - #61
Merged
Merged
Conversation
- Add regex timeout via GeneratedRegex in XmlDocReader (S6444) - Reduce cognitive complexity and parameter counts in several methods - Replace Path.Combine with Path.Join in tests - Apply analyzer suggestions in tests (static readonly arrays, generated regex, etc.) - Exclude intentional DotNet fixture shapes from CodeQL queries Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The broad cross-language refactor includes an unresolved design-document mismatch, and C++ tests were not run locally.
No open issues 🎉
What changed in this PR
This PR addresses SonarCloud and CodeQL findings across .NET, C++, VHDL, and tooling through generated regexes, analyzer-oriented refactors, test updates, and targeted fixture exclusions.
Changes:
- Replaces runtime regexes with source-generated regexes and timeout protection.
- Refactors analyzer-sensitive parameters, paths, collections, and parser state.
- Adds targeted CodeQL exclusions for intentional fixtures.
| File | Summary |
|---|---|
test/ApiMark.Vhdl.Tests/VhdlFileNamingTests.cs |
Uses generated regexes and Path.Join. |
test/ApiMark.Vhdl.Tests/VhdlEmitterGradualDisclosureTests.cs |
Uses generated regex handling and LINQ. |
test/ApiMark.Tool.Tests/ConsoleCollection.cs |
Adds the test namespace. |
test/ApiMark.Tool.Tests/Cli/ContextTests.cs |
Reuses response-file test data. |
test/ApiMark.DotNet.Tests/ExternalXmlDocResolverTests.cs |
Updates xUnit type assertions. |
test/ApiMark.DotNet.Tests/DotNetSyntheticNamingTests.cs |
Uses generated regexes and joined paths. |
test/ApiMark.DotNet.Tests/DotNetGeneratorTests.cs |
Reuses headers and generated link regexes. |
test/ApiMark.DotNet.Tests/DotNetFileNamingTests.cs |
Uses generated regexes and shared test data. |
test/ApiMark.DotNet.Tests/DotNetEmitterOverloadIndexTests.cs |
Reuses expected data and generated regexes. |
test/ApiMark.DotNet.Tests/DotNetEmitterModifierAndConstraintTests.cs |
Clarifies nullable flow after lookup. |
test/ApiMark.DotNet.Tests/DotNetEmitterInheritedMembersTests.cs |
Reuses expected data and generated regexes. |
test/ApiMark.DotNet.Tests/DotNetEmitterInheritanceDocsTests.cs |
Reuses expected documentation data and paths. |
test/ApiMark.DotNet.Tests/DotNetEmitterGenericNamingTests.cs |
Uses generated regexes and LINQ. |
test/ApiMark.DotNet.Tests/DotNetEmitterFileNameLegalityTests.cs |
Uses SearchValues, generated regexes, and joined paths. |
test/ApiMark.DotNet.Tests/DotNetEmitterExternalNestedLinkTests.cs |
Uses a generated external-link regex. |
test/ApiMark.DotNet.Tests/DotNetEmitterBreadcrumbTests.cs |
Uses generated regexes and projected targets. |
test/ApiMark.DotNet.Fixtures.External/NestedExternalTypes.cs |
Documents intentionally empty fixture methods. |
test/ApiMark.DotNet.Fixtures.External/ExternalChainClasses.cs |
Documents intentionally empty fixture methods. |
test/ApiMark.Cpp.Tests/CppFileNamingTests.cs |
Uses generated regexes and Path.Join. |
test/ApiMark.Cpp.Tests/CppEmitterGradualDisclosureTests.cs |
Uses generated regexes and joined paths. |
test/ApiMark.Cpp.Tests/ClangAstParserTests.cs |
Uses generated PID matching and timed waiting. |
src/ApiMark.Tool/Cli/Context.cs |
Extracts response-file parsing. |
src/ApiMark.DotNet/XmlDocReader.cs |
Adds a timed generated regex. |
src/ApiMark.DotNet/TypeLinkResolver.cs |
Narrows an internal collection parameter. |
src/ApiMark.DotNet/ExternalXmlDocResolver.cs |
Extracts shared member lookup logic. |
src/ApiMark.DotNet/DotNetEmitterSingleFile.cs |
Reuses inherited-member headers. |
src/ApiMark.DotNet/DotNetEmitterGradualDisclosure.cs |
Reduces helper parameter counts through context reuse. |
src/ApiMark.DotNet/DotNetEmitter.cs |
Reuses the public accessibility constant. |
src/ApiMark.DotNet/CrefTargetResolver.cs |
Uses span-based type-name formatting. |
src/ApiMark.Cpp/DocumentationCoverageChecker.cs |
Splits class-member checks. |
src/ApiMark.Cpp/CppEmitterGradualDisclosure.cs |
Narrows the overload collection type. |
src/ApiMark.Cpp/CppAst/ClangAstParser.cs |
Encapsulates mutable class parsing state. |
src/ApiMark.Core/FileNameRules.cs |
Simplifies character transformation logic. |
.github/codeql-config.yml |
Excludes intentional fixture findings. |
Review effort: Lite
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Oct 19, 2026
This was referenced Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the SonarCloud vulnerability (S6444 regex timeout) and new-code issues, plus CodeQL findings.
Validation: all test projects pass locally, including ApiMark.Cpp.Tests (223/223 on net8.0, net9.0 and net10.0, with LLVM 22.1.8). Code review and formal review of the 16 affected review-sets found no issues.