fix/security reports

.github/workflows/codeql-analysis.yml

@@ -6,6 +6,7 @@ on:
   pull_request:
   schedule:
     - cron: '0 8 * * *'
+  workflow_dispatch:
 
 permissions:
   contents: read # these permissions are required to run the codeql analysis

src/Microsoft.OpenApi/Expressions/RuntimeExpression.cs

@@ -10,7 +10,7 @@
     /// <summary>
     /// Base class for the Open API runtime expression.
     /// </summary>
     public abstract class RuntimeExpression : IEquatable<RuntimeExpression>
     {
         /// <summary>
         /// The dollar sign prefix for a runtime expression.
@@ -78,23 +78,29 @@
         /// </summary>
         public override int GetHashCode()
         {
-            return Expression.GetHashCode();
+            return StringComparer.Ordinal.GetHashCode(Expression);
         }
 
         /// <summary>
         /// Equals implementation for IEquatable.
         /// </summary>
         public override bool Equals(object? obj)
         {
-            return Equals(obj as RuntimeExpression);
+            if (obj == null)
+            {
+                return false;
+            }
+            if (ReferenceEquals(this, obj))
+            {
+                return true;
+            }
+            return obj.GetType() == GetType() && Equals((RuntimeExpression)obj);
         }
 
-        /// <summary>
-        /// Equals implementation for object of the same type.
-        /// </summary>
-        public bool Equals(RuntimeExpression? obj)
+        /// <inheritdoc />
+        public bool Equals(RuntimeExpression? other)
         {
-            return obj != null && obj.Expression == Expression;
+            return other is not null && StringComparer.Ordinal.Equals(Expression, other.Expression);
         }
 
         /// <inheritdoc />

src/Microsoft.OpenApi/Extensions/OpenApiReferencableExtensions.cs

@@ -64,10 +64,9 @@ private static IOpenApiReferenceable ResolveReferenceOnHeaderElement(
             if (OpenApiConstants.Examples.Equals(propertyName, StringComparison.Ordinal) &&
                 !string.IsNullOrEmpty(mapKey) &&
                 headerElement?.Examples != null &&
-                headerElement.Examples.TryGetValue(mapKey, out var exampleElement) &&
-                exampleElement is IOpenApiReferenceable referenceable)
+                headerElement.Examples.TryGetValue(mapKey, out var exampleElement))
             {
-                return referenceable;
+                return exampleElement;
             }
             throw new OpenApiException(string.Format(SRResource.InvalidReferenceId, pointer));
         }
@@ -81,10 +80,9 @@ private static IOpenApiReferenceable ResolveReferenceOnParameterElement(
             if (OpenApiConstants.Examples.Equals(propertyName, StringComparison.Ordinal) &&
                 !string.IsNullOrEmpty(mapKey) &&
                 parameterElement?.Examples != null &&
-                parameterElement.Examples.TryGetValue(mapKey, out var exampleElement) &&
-                exampleElement is IOpenApiReferenceable referenceable)
+                parameterElement.Examples.TryGetValue(mapKey, out var exampleElement))
             {
-                return referenceable;
+                return exampleElement;
             }
             throw new OpenApiException(string.Format(SRResource.InvalidReferenceId, pointer));
         }
@@ -99,17 +97,15 @@ private static IOpenApiReferenceable ResolveReferenceOnResponseElement(
             {
                 if (OpenApiConstants.Headers.Equals(propertyName, StringComparison.Ordinal) &&
                     responseElement?.Headers != null &&
-                    responseElement.Headers.TryGetValue(mapKey, out var headerElement) &&
-                    headerElement is IOpenApiReferenceable referenceable)
+                    responseElement.Headers.TryGetValue(mapKey, out var headerElement))
                 {
-                    return referenceable;
+                    return headerElement;
                 }
                 if (OpenApiConstants.Links.Equals(propertyName, StringComparison.Ordinal) &&
                     responseElement?.Links != null &&
-                    responseElement.Links.TryGetValue(mapKey, out var linkElement) &&
-                    linkElement is IOpenApiReferenceable referenceable2)
+                    responseElement.Links.TryGetValue(mapKey, out var linkElement))
                 {
-                    return referenceable2;
+                    return linkElement;
                 }
             }
             throw new OpenApiException(string.Format(SRResource.InvalidReferenceId, pointer));

src/Microsoft.OpenApi/Models/OpenApiDocument.cs

@@ -89,7 +89,7 @@
                 {
                     return;
                 }
                 _tags = value is HashSet<OpenApiTag> tags && tags.Comparer is OpenApiTagComparer ?
                         tags :
                         new HashSet<OpenApiTag>(value, OpenApiTagComparer.Instance);
             }
@@ -265,7 +265,7 @@
         /// <summary>
         /// Serialize <see cref="OpenApiDocument"/> to OpenAPI object V2.0.
         /// </summary>
         public void SerializeAsV2(IOpenApiWriter writer)
         {
             Utils.CheckArgumentNull(writer);
 
@@ -296,15 +296,12 @@
                         .OfType<OpenApiSchemaReference>()
                         .Where(k => k.Reference?.Id is not null)
                         .ToDictionary<OpenApiSchemaReference, string, IOpenApiSchema>(
-                            k => k.Reference?.Id!,
+                            k => k.Reference.Id!,
                             v => v
                         );
 
 
-                    foreach (var schema in openApiSchemas.Values.ToList())
-                    {
-                        FindSchemaReferences.ResolveSchemas(Components, openApiSchemas!);
-                    }
+                    FindSchemaReferences.ResolveSchemas(Components, openApiSchemas);
 
                     writer.WriteOptionalMap(
                        OpenApiConstants.Definitions,
@@ -417,7 +414,7 @@
             return server.ReplaceServerUrlVariables([]);
         }
 
         private static void WriteHostInfoV2(IOpenApiWriter writer, List<OpenApiServer>? servers)
         {
             if (servers == null || !servers.Any())
             {
@@ -547,7 +544,7 @@
 
             return ConvertByteArrayToString(hash ?? []);
 
             async Task WriteDocumentAsync(TextWriter writer, CancellationToken token)
             {
                 var openApiJsonWriter = new OpenApiJsonWriter(writer, new() { Terse = true });
                 SerializeAsV31(openApiJsonWriter);
@@ -723,8 +720,10 @@
 
         public static void ResolveSchemas(OpenApiComponents? components, Dictionary<string, IOpenApiSchema> schemas)
         {
-            var visitor = new FindSchemaReferences();
-            visitor.Schemas = schemas;
+            var visitor = new FindSchemaReferences
+            {
+                Schemas = schemas
+            };
             var walker = new OpenApiWalker(visitor);
             walker.Walk(components);
         }

src/Microsoft.OpenApi/Writers/OpenApiWriterAnyExtensions.cs

@@ -114,7 +114,7 @@
 
         private static void WritePrimitive(this IOpenApiWriter writer, JsonValue jsonValue)
         {
-            if (jsonValue.TryGetValue(out string? stringValue))
+            if (jsonValue.TryGetValue(out string? stringValue) && stringValue is not null)
                 writer.WriteValue(stringValue);
             else if (jsonValue.TryGetValue(out DateTime dateTimeValue))
                 writer.WriteValue(dateTimeValue.ToString("o", CultureInfo.InvariantCulture)); // ISO 8601 format

src/Microsoft.OpenApi/Writers/OpenApiWriterBase.cs

@@ -137,7 +137,7 @@
         /// Write float value.
         /// </summary>
         /// <param name="value">The float value.</param>
         public virtual void WriteValue(float value)
         {
             WriteValueSeparator();
             Writer.Write(value);
@@ -238,55 +238,53 @@
                 return;
             }
 
-            var type = value.GetType();
-
-            if (type == typeof(string))
+            if (value is string strValue)
             {
-                WriteValue((string)(value));
+                WriteValue(strValue);
             }
-            else if (type == typeof(int) || type == typeof(int?))
+            else if (value is int intValue)
             {
-                WriteValue((int)value);
+                WriteValue(intValue);
             }
-            else if (type == typeof(uint) || type == typeof(uint?))
+            else if (value is uint uintValue)
             {
-                WriteValue((uint)value);
+                WriteValue(uintValue);
             }
-            else if (type == typeof(long) || type == typeof(long?))
+            else if (value is long longValue)
             {
-                WriteValue((long)value);
+                WriteValue(longValue);
             }
-            else if (type == typeof(bool) || type == typeof(bool?))
+            else if (value is bool boolValue)
             {
-                WriteValue((bool)value);
+                WriteValue(boolValue);
             }
-            else if (type == typeof(float) || type == typeof(float?))
+            else if (value is float floatValue)
             {
-                WriteValue((float)value);
+                WriteValue(floatValue);
             }
-            else if (type == typeof(double) || type == typeof(double?))
+            else if (value is double doubleValue)
             {
-                WriteValue((double)value);
+                WriteValue(doubleValue);
             }
-            else if (type == typeof(decimal) || type == typeof(decimal?))
+            else if (value is decimal decimalValue)
             {
-                WriteValue((decimal)value);
+                WriteValue(decimalValue);
             }
-            else if (type == typeof(DateTime) || type == typeof(DateTime?))
+            else if (value is DateTime DateTimeValue)
             {
-                WriteValue((DateTime)value);
+                WriteValue(DateTimeValue);
             }
-            else if (type == typeof(DateTimeOffset) || type == typeof(DateTimeOffset?))
+            else if (value is DateTimeOffset DateTimeOffsetValue)
             {
-                WriteValue((DateTimeOffset)value);
+                WriteValue(DateTimeOffsetValue);
             }
             else if (value is IEnumerable<object> enumerable)
             {
                 WriteEnumerable(enumerable);
             }
             else
             {
-                throw new OpenApiWriterException(string.Format(SRResource.OpenApiUnsupportedValueType, type.FullName));
+                throw new OpenApiWriterException(string.Format(SRResource.OpenApiUnsupportedValueType, value.GetType().FullName));
             }
         }
 

src/Microsoft.OpenApi/Writers/OpenApiYamlWriter.cs

@@ -73,7 +73,7 @@
 
             var currentScope = CurrentScope();
 
             // If the object is empty, indicate it by writing { }
             if (previousScope.ObjectCount == 0)
             {
                 // If we are in an object, write a white space preceding the braces.
@@ -151,7 +151,7 @@
             // The top level scope should have no indentation and it is already in its own line.
             // The first property of an object inside array can go after the array prefix (-) directly.
             else if (!IsTopLevelScope() && !currentScope.IsInArray)
             {
                 Writer.WriteLine();
                 WriteIndentation();
             }
@@ -168,9 +168,9 @@
         /// Write string value.
         /// </summary>
         /// <param name="value">The string value.</param>
         public override void WriteValue(string value)
         {
-            if (!UseLiteralStyle || value?.IndexOfAny(new[] { '\n', '\r' }) == -1)
+            if (!UseLiteralStyle || value.IndexOfAny(['\n', '\r']) == -1)
             {
                 WriteValueSeparator();
 
@@ -190,7 +190,7 @@
                 WriteChompingIndicator(value);
 
                 // Write indentation indicator when it starts with spaces
-                if (value is not null && value.StartsWith(" ", StringComparison.OrdinalIgnoreCase))
+                if (value[0] == ' ')
                 {
                     Writer.Write(IndentationString.Length);
                 }

test/Microsoft.OpenApi.Tests/PublicApi/PublicApi.approved.txt

@@ -115,7 +115,7 @@ namespace Microsoft.OpenApi.Expressions
         public const string Prefix = "$";
         protected RuntimeExpression() { }
         public abstract string Expression { get; }
-        public bool Equals(Microsoft.OpenApi.Expressions.RuntimeExpression? obj) { }
+        public bool Equals(Microsoft.OpenApi.Expressions.RuntimeExpression? other) { }
         public override bool Equals(object? obj) { }
         public override int GetHashCode() { }
         public override string ToString() { }