fix/security reports

src/Microsoft.OpenApi/Expressions/RuntimeExpression.cs

@@ -78,23 +78,29 @@ public static RuntimeExpression Build(string expression)
         /// </summary>
         public override int GetHashCode()
         {
-            return Expression.GetHashCode();
+            return StringComparer.Ordinal.GetHashCode(Expression);
         }
 
         /// <summary>
         /// Equals implementation for IEquatable.
         /// </summary>
         public override bool Equals(object? obj)
         {
-            return Equals(obj as RuntimeExpression);
+            if (obj == null)
+            {
+                return false;
+            }
+            if (ReferenceEquals(this, obj))
+            {
+                return true;
+            }
+            return obj.GetType() == GetType() && Equals((RuntimeExpression)obj);
         }
 
-        /// <summary>
-        /// Equals implementation for object of the same type.
-        /// </summary>
-        public bool Equals(RuntimeExpression? obj)
+        /// <inheritdoc />
+        public bool Equals(RuntimeExpression? other)
         {
-            return obj != null && obj.Expression == Expression;
+            return other is not null && StringComparer.Ordinal.Equals(Expression, other.Expression);
         }
 
         /// <inheritdoc />

src/Microsoft.OpenApi/Extensions/OpenApiReferencableExtensions.cs

@@ -64,10 +64,9 @@ private static IOpenApiReferenceable ResolveReferenceOnHeaderElement(
             if (OpenApiConstants.Examples.Equals(propertyName, StringComparison.Ordinal) &&
                 !string.IsNullOrEmpty(mapKey) &&
                 headerElement?.Examples != null &&
-                headerElement.Examples.TryGetValue(mapKey, out var exampleElement) &&
-                exampleElement is IOpenApiReferenceable referenceable)
+                headerElement.Examples.TryGetValue(mapKey, out var exampleElement))
             {
-                return referenceable;
+                return exampleElement;
             }
             throw new OpenApiException(string.Format(SRResource.InvalidReferenceId, pointer));
         }
@@ -81,10 +80,9 @@ private static IOpenApiReferenceable ResolveReferenceOnParameterElement(
             if (OpenApiConstants.Examples.Equals(propertyName, StringComparison.Ordinal) &&
                 !string.IsNullOrEmpty(mapKey) &&
                 parameterElement?.Examples != null &&
-                parameterElement.Examples.TryGetValue(mapKey, out var exampleElement) &&
-                exampleElement is IOpenApiReferenceable referenceable)
+                parameterElement.Examples.TryGetValue(mapKey, out var exampleElement))
             {
-                return referenceable;
+                return exampleElement;
             }
             throw new OpenApiException(string.Format(SRResource.InvalidReferenceId, pointer));
         }
@@ -99,17 +97,15 @@ private static IOpenApiReferenceable ResolveReferenceOnResponseElement(
             {
                 if (OpenApiConstants.Headers.Equals(propertyName, StringComparison.Ordinal) &&
                     responseElement?.Headers != null &&
-                    responseElement.Headers.TryGetValue(mapKey, out var headerElement) &&
-                    headerElement is IOpenApiReferenceable referenceable)
+                    responseElement.Headers.TryGetValue(mapKey, out var headerElement))
                 {
-                    return referenceable;
+                    return headerElement;
                 }
                 if (OpenApiConstants.Links.Equals(propertyName, StringComparison.Ordinal) &&
                     responseElement?.Links != null &&
-                    responseElement.Links.TryGetValue(mapKey, out var linkElement) &&
-                    linkElement is IOpenApiReferenceable referenceable2)
+                    responseElement.Links.TryGetValue(mapKey, out var linkElement))
                 {
-                    return referenceable2;
+                    return linkElement;
                 }
             }
             throw new OpenApiException(string.Format(SRResource.InvalidReferenceId, pointer));

src/Microsoft.OpenApi/Models/OpenApiDocument.cs

@@ -296,15 +296,12 @@ public void SerializeAsV2(IOpenApiWriter writer)
                         .OfType<OpenApiSchemaReference>()
                         .Where(k => k.Reference?.Id is not null)
                         .ToDictionary<OpenApiSchemaReference, string, IOpenApiSchema>(
-                            k => k.Reference?.Id!,
+                            k => k.Reference.Id!,
                             v => v
                         );
 
 
-                    foreach (var schema in openApiSchemas.Values.ToList())
-                    {
-                        FindSchemaReferences.ResolveSchemas(Components, openApiSchemas!);
-                    }
+                    FindSchemaReferences.ResolveSchemas(Components, openApiSchemas);
 
                     writer.WriteOptionalMap(
                        OpenApiConstants.Definitions,
@@ -723,8 +720,10 @@ internal class FindSchemaReferences : OpenApiVisitorBase
 
         public static void ResolveSchemas(OpenApiComponents? components, Dictionary<string, IOpenApiSchema> schemas)
         {
-            var visitor = new FindSchemaReferences();
-            visitor.Schemas = schemas;
+            var visitor = new FindSchemaReferences
+            {
+                Schemas = schemas
+            };
             var walker = new OpenApiWalker(visitor);
             walker.Walk(components);
         }

src/Microsoft.OpenApi/Writers/OpenApiWriterAnyExtensions.cs

@@ -114,7 +114,7 @@ private static void WriteObject(this IOpenApiWriter writer, JsonObject? entity)
 
         private static void WritePrimitive(this IOpenApiWriter writer, JsonValue jsonValue)
         {
-            if (jsonValue.TryGetValue(out string? stringValue))
+            if (jsonValue.TryGetValue(out string? stringValue) && stringValue is not null)
                 writer.WriteValue(stringValue);
             else if (jsonValue.TryGetValue(out DateTime dateTimeValue))
                 writer.WriteValue(dateTimeValue.ToString("o", CultureInfo.InvariantCulture)); // ISO 8601 format

src/Microsoft.OpenApi/Writers/OpenApiWriterBase.cs

@@ -238,55 +238,53 @@ public virtual void WriteValue(object? value)
                 return;
             }
 
-            var type = value.GetType();
-
-            if (type == typeof(string))
+            if (value is string strValue)
             {
-                WriteValue((string)(value));
+                WriteValue(strValue);
             }
-            else if (type == typeof(int) || type == typeof(int?))
+            else if (value is int intValue)
             {
-                WriteValue((int)value);
+                WriteValue(intValue);
             }
-            else if (type == typeof(uint) || type == typeof(uint?))
+            else if (value is uint uintValue)
             {
-                WriteValue((uint)value);
+                WriteValue(uintValue);
             }
-            else if (type == typeof(long) || type == typeof(long?))
+            else if (value is long longValue)
             {
-                WriteValue((long)value);
+                WriteValue(longValue);
             }
-            else if (type == typeof(bool) || type == typeof(bool?))
+            else if (value is bool boolValue)
             {
-                WriteValue((bool)value);
+                WriteValue(boolValue);
             }
-            else if (type == typeof(float) || type == typeof(float?))
+            else if (value is float floatValue)
             {
-                WriteValue((float)value);
+                WriteValue(floatValue);
             }
-            else if (type == typeof(double) || type == typeof(double?))
+            else if (value is double doubleValue)
             {
-                WriteValue((double)value);
+                WriteValue(doubleValue);
             }
-            else if (type == typeof(decimal) || type == typeof(decimal?))
+            else if (value is decimal decimalValue)
             {
-                WriteValue((decimal)value);
+                WriteValue(decimalValue);
             }
-            else if (type == typeof(DateTime) || type == typeof(DateTime?))
+            else if (value is DateTime DateTimeValue)
             {
-                WriteValue((DateTime)value);
+                WriteValue(DateTimeValue);
             }
-            else if (type == typeof(DateTimeOffset) || type == typeof(DateTimeOffset?))
+            else if (value is DateTimeOffset DateTimeOffsetValue)
             {
-                WriteValue((DateTimeOffset)value);
+                WriteValue(DateTimeOffsetValue);
             }
             else if (value is IEnumerable<object> enumerable)
             {
                 WriteEnumerable(enumerable);
             }
             else
             {
-                throw new OpenApiWriterException(string.Format(SRResource.OpenApiUnsupportedValueType, type.FullName));
+                throw new OpenApiWriterException(string.Format(SRResource.OpenApiUnsupportedValueType, value.GetType().FullName));
             }
         }
 

src/Microsoft.OpenApi/Writers/OpenApiYamlWriter.cs

@@ -170,7 +170,7 @@ public override void WritePropertyName(string name)
         /// <param name="value">The string value.</param>
         public override void WriteValue(string value)
         {
-            if (!UseLiteralStyle || value?.IndexOfAny(new[] { '\n', '\r' }) == -1)
+            if (!UseLiteralStyle || value.IndexOfAny(['\n', '\r']) == -1)
             {
                 WriteValueSeparator();
 
@@ -190,7 +190,7 @@ public override void WriteValue(string value)
                 WriteChompingIndicator(value);
 
                 // Write indentation indicator when it starts with spaces
-                if (value is not null && value.StartsWith(" ", StringComparison.OrdinalIgnoreCase))
+                if (value[0] == ' ')
                 {
                     Writer.Write(IndentationString.Length);
                 }

test/Microsoft.OpenApi.Tests/PublicApi/PublicApi.approved.txt

@@ -115,7 +115,7 @@ namespace Microsoft.OpenApi.Expressions
         public const string Prefix = "$";
         protected RuntimeExpression() { }
         public abstract string Expression { get; }
-        public bool Equals(Microsoft.OpenApi.Expressions.RuntimeExpression? obj) { }
+        public bool Equals(Microsoft.OpenApi.Expressions.RuntimeExpression? other) { }
         public override bool Equals(object? obj) { }
         public override int GetHashCode() { }
         public override string ToString() { }