Fix S3900 FP: when object is validated with extension method

[tnoiretisa]

Description

When we use method extension to check collection are not null, S3900 raise :(

Repro steps

Have an method extension like that
public static bool IsNotNullOrEmpty<T>([ValidatedNotNull]this IEnumerable<T> src)
My code

public static void Test(List<string> lst)
{
    if (lst.IsNotNullOrEmpty())
    {
        foreach (string item in lst) <-- S3900 raise on "lst"
        {
            // Do something
        }
    }
}

Expected behavior

Don't raise rules

Actual behavior

Rules raise

Related information

• SonarLint 4.12.0.0
• Visual Studio 2017

[Corniel]

I Could reproduce this. I also added the test on a internal method. In that case, the ValidatedNotNullAttribute is indeed recognized.

using System;
using System.Collections.Generic;
using System.Linq;

namespace SonarAnalyzer.Experiments.CSharp
{
public static class S3900
{
    public static void Extension(List<string> list)
    {
        if (list.IsNotNullOrEmpty())
        {
            foreach (string item in list) // Compliant
            {
                // Do something
            }
        }
    }

    public static void Method(List<string> list)
    {
        if (HasAny(list))
        {
            foreach (string item in list) // Compliant
            {
                // Do something
            }
        }
    }

    private static bool HasAny<T>([ValidatedNotNull]IEnumerable<T> src)
    {
        if (src is null)
        {
            return false;
        }
        return src.Any();
    }
}
public static class S3900Exentsions
{
    public static bool IsNotNullOrEmpty<T>([ValidatedNotNull]this IEnumerable<T> src)
    {
        if (src is null)
        {
            return false;
        }
        return src.Any();
    }
}

[AttributeUsage(AttributeTargets.Parameter)]
public sealed class ValidatedNotNullAttribute : Attribute { }
}

[christophe-zurn-sonarsource]

@tnoiretisa @Corniel Thanks for reporting this and giving additional details !

[andrei-epure-sonarsource]

Another report from community for this: https://community.sonarsource.com/t/sometime-in-the-last-2-weeks-at-least-one-of-our-pipelines-started-reporting-hundreds-of-s3900-warnings-that-it-was-not-reporting-before/53509

I gave an outline of our plans for S3900 in this answer.