Efcore: Microsoft.EntityFrameworkCore.Analyzers - warning EF1000: Possible SQL injection vulnerability.

[zd-dalibor]

Microsoft.EntityFrameworkCore.Analyzers shows this warning:

Title: Possible SQL injection vulnerability.
ID: EF1000
Message: The SQL expression passed to '{0}' embeds data that will not be parameterized. Review for potential SQL injection vulnerability. See https://go.microsoft.com/fwlink/?linkid=871170 for more information.
Help link: https://bingdev.cloudapp.net/BingUrl.svc/Get?selectedText=The SQL expression passed to '{0}' embeds data that will not be parameterized. Review for potential SQL injection vulnerability. See https:%2F%2Fgo.microsoft.com%2Ffwlink%2F%3Flinkid%3D871170 for more information.&mainLanguage=C%23&projectType=&requestId=d3919894-237e-4175-9a44-a7b17ceb7df3&clientId=&errorCode=EF1000

The main problem is that I cannot find where is this warning in my code. Message does not tell anything about line number or file where this problem exists.

I search my whole project for {0} but I do not have it.

Is there some way to get more detailed message for this warning or is there some way to suppress this warning, not globally but at code level with some comment in case it is false warning.

Further technical details

EF Core version: 2.1.3
Database Provider: Microsoft.EntityFrameworkCore.SqlServer
Operating system: Windows 10
IDE: Visual Studio 2017 15.8.6

[ajcvickers]

@dalibor983 Does it show in the VS warnings window? Can you double click on it to go to the code line involved?

[zd-dalibor]

@ajcvickers No, this warning is shown in solution explorer window under dependencies

|- Project Name
|--- Dependencies
|----- .NETStandard 2.0
|------- Analyzers
|--------- Microsoft.EntityFrameworkCore.Analyzers
|----------- EF1000: Possible SQL injection vulnerability.

Noting happens when I double click on EF1000: Possible SQL injection vulnerability. :disappointed:

[ajcvickers]

@dalibor983 Can you post the full text in the context of all the other text around it?

[zd-dalibor]

@ajcvickers There are no any text around it. I can get more information only when I goes to properties of EF1000: Possible SQL injection vulnerability. and in property window I got this:

Category: Security
Default severity: Warning
Description: 
Effective severity: Warning
Enabled by default: True
Help link: https://bingdev.cloudapp.net/BingUrl.svc/Get?selectedText=The SQL expression passed to '{0}' embeds data that will not be parameterized. Review for potential SQL injection vulnerability. See https:%2F%2Fgo.microsoft.com%2Ffwlink%2F%3Flinkid%3D871170 for more information.&mainLanguage=C%23&projectType=&requestId=30ad45c4-9af9-4c7a-9c3d-ff4856396d6a&clientId=&errorCode=EF1000
ID: EF1000
Message: The SQL expression passed to '{0}' embeds data that will not be parameterized. Review for potential SQL injection vulnerability. See https://go.microsoft.com/fwlink/?linkid=871170 for more information.
Tags: 
Title: Possible SQL injection vulnerability.

[smitpatel]

It's not an error. It is Visual Studio's way to show all the warnings from given analyzer so that you can set severity of each of them using GUI tool.
FWIW, this is what is being talked about.

[zd-dalibor]

@smitpatel In my case there is also yellow exclamation mark and in properties window Message property with value The SQL expression passed to '{0}' embeds data that will not be parameterized. Review for potential SQL injection vulnerability. See https://go.microsoft.com/fwlink/?linkid=871170 for more information.

Something like this:
.

If this is not error or warning how to remove yellow exclamation mark?

[smitpatel]

The yellow exclamation mark on dependencies in VS is sign of dependencies are not available. If you run package restore and use correct SDK, yellow mark will go away. It is nothing specific about EFCore.Analyzers. It's more of telling that there is an issue with dependencies this project is referencing.

[zd-dalibor]

@smitpatel yellow exclamation mark stands at EF1000: Possible SQL injection vulnerability.. This image is only for illustration how yellow exclamation mark look like

[smitpatel]

@dalibor983 - Again, that yellow exclamation is about dependency issue. EFCore neither has a way to generate that yellow mark nor have control over it. If there is any errors generated by EFCore analyzer then it will be included in Error List window in VS. If you are not able to get rid of that yellow mark, perhaps file an issue with VS as it seems like project system issue.

[zd-dalibor]

@smitpatel yellow exclamation mark in solution explorer nothing in error list

[smitpatel]

@dalibor983 - Can you file issue with VS using VS feedback system?
More info: https://docs.microsoft.com/en-us/visualstudio/ide/how-to-report-a-problem-with-visual-studio-2017?view=vs-2017

[Liero]

I have similar problem:

I've checked the file and it does exist.

I've added EF Core Sql Server nuget package using Visual Studio Package Management UI into .NET Standard 2.0 Library and referenced the lib in .NET Core Web Application.

dotnet --list-sdks
2.1.401 [C:\Program Files\dotnet\sdk]
2.1.402 [C:\Program Files\dotnet\sdk]
2.1.403 [C:\Program Files\dotnet\sdk]
2.1.500 [C:\Program Files\dotnet\sdk]

It is quite disturbing.

[Liero]

@ajcvickers: why it was closed? Not resolved, not answered imho...

[ajcvickers]

@Liero We haven't been able to reproduce the yellow warning rectangle--I just used the steps you listed and still don't see it. But even if we could, since we're removing the analyzer in the 3.0 release anyway it's unlikely that there would be any additional action on our side other than to continue with that plan.

[Liero]

@ajcvickers: understood. meanwhile, the warning rectangle disappeared from my solution although I have done nothing with the packages. maybe PC restart helped....

[zd-dalibor]

@Liero

meanwhile, the warning rectangle disappeared from my solution although

Try to run some dotnet ef cli command in the project, I think warning rectangle will appear again.

For example try to run this while visual studio is opened and your project is loaded:

dotnet ef migrations list

[mrawais]

i just unload project and reload project, the warning is disappeared.

[NipunKalra]

I was getting this as well. The solution which worked for me was Installing net core 2.2 SDK and restart.

[iAmVico]

I updated one of the NuGet packages (Microsoft.VisualStudio.Web.CodeGeneration.Design 2.2.2 to 2.2.3) and it disappeared as well.

[codingmoi]

I got this warning too. What I did was to remove all files inside the obj folder in my project then build your project again.

[aydjay]

I got this warning too!

I cleaned the affected project, deleted the obj folder and reloaded the project.

[RamyTayseer]

This is detailed issue, so your recommendation is needed?

[RamyTayseer]

This is detailed issue, so your recommendation is needed?

Solved by remove string format