{"action":"closed","issue":{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/282","repository_url":"https://api.github.com/repos/dotnet/roslyn-analyzers","labels_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/282/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/282/comments","events_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/282/events","html_url":"https://github.com/dotnet/roslyn-analyzers/issues/282","id":104149195,"number":282,"title":"FxCop CA2100 does not fire for string array arguments","user":{"login":"lgolding","id":11762653,"avatar_url":"https://avatars.githubusercontent.com/u/11762653?v=3","gravatar_id":"","url":"https://api.github.com/users/lgolding","html_url":"https://github.com/lgolding","followers_url":"https://api.github.com/users/lgolding/followers","following_url":"https://api.github.com/users/lgolding/following{/other_user}","gists_url":"https://api.github.com/users/lgolding/gists{/gist_id}","starred_url":"https://api.github.com/users/lgolding/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lgolding/subscriptions","organizations_url":"https://api.github.com/users/lgolding/orgs","repos_url":"https://api.github.com/users/lgolding/repos","events_url":"https://api.github.com/users/lgolding/events{/privacy}","received_events_url":"https://api.github.com/users/lgolding/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/labels/Area-Desktop.Analyzers","name":"Area-Desktop.Analyzers","color":"5319e7"},{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/labels/Feature%20Request","name":"Feature Request","color":"fc2929"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/milestones/2","html_url":"https://github.com/dotnet/roslyn-analyzers/milestones/Unknown","labels_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/milestones/2/labels","id":1284517,"number":2,"title":"Unknown","description":"","creator":{"login":"srivatsn","id":20570,"avatar_url":"https://avatars.githubusercontent.com/u/20570?v=3","gravatar_id":"","url":"https://api.github.com/users/srivatsn","html_url":"https://github.com/srivatsn","followers_url":"https://api.github.com/users/srivatsn/followers","following_url":"https://api.github.com/users/srivatsn/following{/other_user}","gists_url":"https://api.github.com/users/srivatsn/gists{/gist_id}","starred_url":"https://api.github.com/users/srivatsn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/srivatsn/subscriptions","organizations_url":"https://api.github.com/users/srivatsn/orgs","repos_url":"https://api.github.com/users/srivatsn/repos","events_url":"https://api.github.com/users/srivatsn/events{/privacy}","received_events_url":"https://api.github.com/users/srivatsn/received_events","type":"User","site_admin":false},"open_issues":29,"closed_issues":6,"state":"open","created_at":"2015-09-01T17:26:26Z","updated_at":"2016-03-18T19:13:46Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-08-31T22:51:52Z","updated_at":"2016-03-18T19:13:46Z","closed_at":"2016-03-18T19:13:46Z","body":"FxCop [CA2100](https://msdn.microsoft.com/en-us/library/ms182310.aspx) fires when the `CommandText` property of a class that implements the `IDbCommand` interface (such as `SqlCommand`) is assigned from \"a string that is built from a string argument to the method.\" The rationale is that the argument might have come from user input.\r\n\r\nThe rule also fires when such a string is passed as the `cmdText` parameter to a `SqlCommand` constructor.\r\n\r\nFor example:\r\n````\r\npublic void Method(string input)\r\n{\r\n    SqlCommand command = new SqlCommand();\r\n\r\n    // CA2100:\r\n    command.CommandText = \"SELECT * FROM Customers WHERE ID=\" + input;\r\n\r\n    // CA2100:\r\n    command = new SqlCommand(\"SELECT * FROM Customers WHERE ID=\" + input);\r\n}\r\n````\r\nHowever, the rule does not fire when the argument is a `string[]`, even though that array might also have come from user input:\r\n````\r\npublic void Method(string[] inputs)\r\n{\r\n    // No diagnostic:\r\n    SqlCommand command = new SqlCommand();\r\n    command.CommandText = \"SELECT * FROM Customers WHERE ID=\" + string.Join(\",\", inputs);\r\n\r\n    // No diagnostic:\r\n    command = new SqlCommand((\"SELECT * FROM Customers WHERE ID=\" + string.Join(\",\", inputs));\r\n}\r\n````"}}