New rule S3063: "StringBuilder" data should be used

analyzers/rspec/cs/S3063_c#.html

@@ -0,0 +1,37 @@
+<p><code>StringBuilder</code> instances that are <code>append</code>ed but never <code>toString</code>ed needlessly clutter the code, and worse are a
+drag on performance. Either they should be removed, or the missing <code>toString</code> call added.</p>
+<h2>Noncompliant Code Example</h2>
+<pre>
+public void doSomething(List&lt;string&gt; strings) {
+  StringBuilder sb = new StringBuilder();  // Noncompliant
+  sb.Append("Got: ");
+  foreach(string str in strings) {
+    sb.Append(str).Append(", ");
+    // ...
+  }
+}
+</pre>
+<h2>Compliant Solution</h2>
+<pre>
+public void doSomething(List&lt;string&gt; strings) {
+  foreach(string str in strings) {
+    // ...
+  }
+}
+</pre>
+<p>or</p>
+<pre>
+public void doSomething(List&lt;string&gt; strings) {
+  StringBuilder sb = new StringBuilder();  // Noncompliant
+  sb.Append("Got: ");
+  foreach(string str in strings) {
+    sb.Append(str).Append(", ");
+    // ...
+  }
+  _logger.LogInformation(sb.toString, DateTimeOffset.UtcNow);
+}
+</pre>
+<h2>Exceptions</h2>
+<p>This rule ignores <code>StringBuilder</code>s that are passed as method arguments on the grounds that they are likely <code>toString</code>ed
+there.</p>
+

analyzers/rspec/cs/S3063_c#.json

@@ -0,0 +1,17 @@
+{
+  "title": "\"StringBuilder\" data should be used",
+  "type": "CODE_SMELL",
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "5min"
+  },
+  "tags": [
+    "performance"
+  ],
+  "defaultSeverity": "Major",
+  "ruleSpecification": "RSPEC-3063",
+  "sqKey": "S3063",
+  "scope": "Main",
+  "quickfix": "unknown"
+}

analyzers/rspec/cs/Sonar_way_profile.json

@@ -125,6 +125,7 @@
     "S3010",
     "S3011",
     "S3060",
+    "S3063",
     "S3168",
     "S3169",
     "S3172",

analyzers/rspec/vbnet/S3063_vb.net.html

@@ -0,0 +1,37 @@
+<p><code>StringBuilder</code> instances that are <code>append</code>ed but never <code>toString</code>ed needlessly clutter the code, and worse are a
+drag on performance. Either they should be removed, or the missing <code>toString</code> call added.</p>
+<h2>Noncompliant Code Example</h2>
+<pre>
+Public Sub doSomething(ByVal strings As List(Of String))
+    Dim sb As StringBuilder = New StringBuilder()
+    sb.Append("Got: ")
+
+    For Each str As String In strings
+        sb.Append(str).Append(", ")
+    Next
+End Sub
+</pre>
+<h2>Compliant Solution</h2>
+<pre>
+Public Sub doSomething(ByVal strings As List(Of String))
+    For Each str As String In strings
+    Next
+End Sub
+</pre>
+<p>or</p>
+<pre>
+Public Sub doSomething(ByVal strings As List(Of String))
+    Dim sb As StringBuilder = New StringBuilder()
+    sb.Append("Got: ")
+
+    For Each str As String In strings
+        sb.Append(str).Append(", ")
+    Next
+
+    My.Application.Log.WriteEntry(sb.toString)
+End Sub
+</pre>
+<h2>Exceptions</h2>
+<p>This rule ignores <code>StringBuilder</code>s that are passed as method arguments on the grounds that they are likely <code>toString</code>ed
+there.</p>
+

analyzers/rspec/vbnet/S3063_vb.net.json

@@ -0,0 +1,17 @@
+{
+  "title": "\"StringBuilder\" data should be used",
+  "type": "CODE_SMELL",
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "5min"
+  },
+  "tags": [
+    "performance"
+  ],
+  "defaultSeverity": "Major",
+  "ruleSpecification": "RSPEC-3063",
+  "sqKey": "S3063",
+  "scope": "Main",
+  "quickfix": "unknown"
+}

analyzers/rspec/vbnet/Sonar_way_profile.json

@@ -71,6 +71,7 @@
     "S2761",
     "S2951",
     "S3011",
+    "S3063",
     "S3358",
     "S3385",
     "S3449",

analyzers/src/SonarAnalyzer.CSharp/Facade/CSharpSyntaxKindFacade.cs

@@ -79,5 +79,6 @@ internal sealed class CSharpSyntaxKindFacade : ISyntaxKindFacade<SyntaxKind>
         SyntaxKindEx.RecordClassDeclaration,
         SyntaxKindEx.RecordStructDeclaration,
     };
+    public SyntaxKind VariableDeclarator => SyntaxKind.VariableDeclarator;
     public SyntaxKind WhitespaceTrivia => SyntaxKind.WhitespaceTrivia;
 }

analyzers/src/SonarAnalyzer.CSharp/Rules/UnusedStringBuilder.cs

@@ -0,0 +1,68 @@
+/*
+ * SonarAnalyzer for .NET
+ * Copyright (C) 2015-2023 SonarSource SA
+ * mailto: contact AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+namespace SonarAnalyzer.Rules.CSharp;
+
+[DiagnosticAnalyzer(LanguageNames.CSharp)]
+public sealed class UnusedStringBuilder : UnusedStringBuilderBase<SyntaxKind, VariableDeclaratorSyntax, IdentifierNameSyntax>
+{
+    private static readonly SyntaxKind[] SkipChildren =
+    {
+        SyntaxKind.ClassDeclaration,
+    };
+
+    protected override ILanguageFacade<SyntaxKind> Language => CSharpFacade.Instance;
+
+    protected override string GetName(SyntaxNode declaration) => declaration.GetName();
+
+    protected override SyntaxNode GetScope(VariableDeclaratorSyntax declarator) =>
+        declarator.Parent.Parent is { Parent: GlobalStatementSyntax { Parent: CompilationUnitSyntax } }
+        ? declarator.Parent.Parent.Parent.Parent
+        : declarator.Parent.Parent.Parent;
+
+    protected override ILocalSymbol RetrieveStringBuilderObject(VariableDeclaratorSyntax declarator, SemanticModel semanticModel) =>
+        declarator is
+        {
+            Parent.Parent: LocalDeclarationStatementSyntax,
+            Initializer.Value: { } expression,
+        }
+        && IsStringBuilderObjectCreation(expression, semanticModel)
+            ? semanticModel.GetDeclaredSymbol(declarator) as ILocalSymbol
+            : null;
+
+    protected override bool IsStringBuilderRead(string name, ILocalSymbol symbol, SyntaxNode node, SemanticModel model) =>
+        node switch
+        {
+            InvocationExpressionSyntax invocation => StringBuilderAccessInvocations.Contains(invocation.Expression.GetName()) && IsSameReference(invocation.Expression, name, symbol, model),
+            ReturnStatementSyntax returnStatement => IsSameReference(returnStatement.Expression, name, symbol, model),
+            InterpolationSyntax interpolation => IsSameReference(interpolation.Expression, name, symbol, model),
+            ElementAccessExpressionSyntax elementAccess => IsSameReference(elementAccess.Expression, name, symbol, model),
+            ArgumentSyntax argument => IsSameReference(argument.Expression, name, symbol, model),
+            MemberAccessExpressionSyntax memberAccess => StringBuilderAccessExpressions.Contains(memberAccess.Name.GetName()) && IsSameReference(memberAccess.Expression, name, symbol, model),
+            _ => false,
+        };
+
+    protected override bool DescendIntoChildren(SyntaxNode node) =>
+        !(node.IsAnyKind(SkipChildren) && node.IsKind(SyntaxKindEx.LocalFunctionStatement) && ((LocalFunctionStatementSyntaxWrapper)node).Modifiers.Any(SyntaxKind.StaticKeyword));
+
+    private static bool IsStringBuilderObjectCreation(ExpressionSyntax expression, SemanticModel semanticModel) =>
+        ObjectCreationFactory.TryCreate(expression) is { } creation
+        && creation.IsKnownType(KnownType.System_Text_StringBuilder, semanticModel);
+}

analyzers/src/SonarAnalyzer.CSharp/Wrappers/ObjectCreationFactory.cs

@@ -44,6 +44,11 @@ node switch
                 _ => throw new InvalidOperationException("Unexpected type: " + node.GetType().Name)
             };
 
+        public static IObjectCreation TryCreate(SyntaxNode node) =>
+             node.IsAnyKind(SyntaxKind.ObjectCreationExpression, SyntaxKindEx.ImplicitObjectCreationExpression)
+                 ? Create(node)
+                 : null;
+
         private class ObjectCreation : IObjectCreation
         {
             private readonly ObjectCreationExpressionSyntax objectCreation;

analyzers/src/SonarAnalyzer.Common/Facade/ISyntaxKindFacade.cs

@@ -54,5 +54,6 @@ public interface ISyntaxKindFacade<out TSyntaxKind>
     abstract TSyntaxKind[] StringLiteralExpressions { get; }
     abstract TSyntaxKind StructDeclaration { get; }
     abstract TSyntaxKind[] TypeDeclaration { get; }
+    abstract TSyntaxKind VariableDeclarator { get; }
     abstract TSyntaxKind WhitespaceTrivia { get; }
 }

analyzers/src/SonarAnalyzer.Common/Rules/UnusedStringBuilderBase.cs

@@ -0,0 +1,65 @@
+/*
+ * SonarAnalyzer for .NET
+ * Copyright (C) 2015-2023 SonarSource SA
+ * mailto: contact AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+namespace SonarAnalyzer.Rules;
+
+public abstract class UnusedStringBuilderBase<TSyntaxKind, TVariableDeclarator, TIdentifierName> : SonarDiagnosticAnalyzer<TSyntaxKind>
+    where TSyntaxKind : struct
+    where TVariableDeclarator : SyntaxNode
+    where TIdentifierName : SyntaxNode
+{
+    private const string DiagnosticId = "S3063";
+
+    internal readonly string[] StringBuilderAccessInvocations = { "ToString", "CopyTo", "GetChunks" };
+    internal readonly string[] StringBuilderAccessExpressions = { "Length" };
+
+    protected override string MessageFormat => """Remove this "StringBuilder"; ".ToString()" is never called.""";
+
+    protected abstract string GetName(SyntaxNode declaration);
+    protected abstract SyntaxNode GetScope(TVariableDeclarator declarator);
+    protected abstract ILocalSymbol RetrieveStringBuilderObject(TVariableDeclarator declaration, SemanticModel semanticModel);
+    protected abstract bool IsStringBuilderRead(string name, ILocalSymbol symbol, SyntaxNode node, SemanticModel model);
+    protected abstract bool DescendIntoChildren(SyntaxNode node);
+
+    protected UnusedStringBuilderBase() : base(DiagnosticId) { }
+
+    protected sealed override void Initialize(SonarAnalysisContext context) =>
+        context.RegisterNodeAction(Language.GeneratedCodeRecognizer, c =>
+        {
+            var variableDeclaration = (TVariableDeclarator)c.Node;
+
+            if (RetrieveStringBuilderObject(variableDeclaration, c.SemanticModel) is not { } symbol
+                || GetScope(variableDeclaration).DescendantNodes(DescendIntoChildren).Any(node =>
+                    IsStringBuilderRead(GetName(variableDeclaration), symbol, node, c.SemanticModel)))
+            {
+                return;
+            }
+            c.ReportIssue(Diagnostic.Create(Rule, variableDeclaration.GetLocation()));
+        }, Language.SyntaxKind.VariableDeclarator);
+
+    internal bool IsSameReference(SyntaxNode expression, string name, ILocalSymbol symbol, SemanticModel semanticModel) =>
+        expression is not null && GetLocalReferences(expression).Any(x => IsSameVariable(x, name, symbol, semanticModel));
+
+    internal bool IsSameVariable(SyntaxNode identifier, string name, ILocalSymbol symbol, SemanticModel semanticModel) =>
+        GetName(identifier).Equals(name, Language.NameComparison) && symbol.Equals(semanticModel.GetSymbolInfo(identifier).Symbol);
+
+    internal static IEnumerable<TIdentifierName> GetLocalReferences(SyntaxNode node) =>
+        node.DescendantNodesAndSelf().OfType<TIdentifierName>();
+}

analyzers/src/SonarAnalyzer.VisualBasic/Facade/VisualBasicSyntaxKindFacade.cs

@@ -65,5 +65,6 @@ internal sealed class VisualBasicSyntaxKindFacade : ISyntaxKindFacade<SyntaxKind
     public SyntaxKind[] StringLiteralExpressions => new[] { SyntaxKind.StringLiteralExpression };
     public SyntaxKind StructDeclaration => SyntaxKind.StructureBlock;
     public SyntaxKind[] TypeDeclaration => new[] { SyntaxKind.ClassBlock, SyntaxKind.StructureBlock, SyntaxKind.InterfaceBlock, SyntaxKind.EnumBlock };
+    public SyntaxKind VariableDeclarator => SyntaxKind.VariableDeclarator;
     public SyntaxKind WhitespaceTrivia => SyntaxKind.WhitespaceTrivia;
 }

analyzers/src/SonarAnalyzer.VisualBasic/Rules/UnusedStringBuilder.cs

@@ -0,0 +1,63 @@
+/*
+ * SonarAnalyzer for .NET
+ * Copyright (C) 2015-2023 SonarSource SA
+ * mailto: contact AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+using StyleCop.Analyzers.Lightup;
+
+namespace SonarAnalyzer.Rules.VisualBasic;
+
+[DiagnosticAnalyzer(LanguageNames.VisualBasic)]
+public sealed class UnusedStringBuilder : UnusedStringBuilderBase<SyntaxKind, VariableDeclaratorSyntax, IdentifierNameSyntax>
+{
+    private static readonly SyntaxKind[] SkipChildren = { };
+
+    protected override ILanguageFacade<SyntaxKind> Language => VisualBasicFacade.Instance;
+
+    protected override string GetName(SyntaxNode declaration) =>
+        declaration is VariableDeclaratorSyntax variableDeclarator
+            ? variableDeclarator.Names[0].Identifier.ValueText ?? string.Empty
+            : declaration.GetName();
+
+    protected override SyntaxNode GetScope(VariableDeclaratorSyntax declarator) => declarator.Parent.Parent.Parent;
+
+    protected override ILocalSymbol RetrieveStringBuilderObject(VariableDeclaratorSyntax declarator, SemanticModel semanticModel) =>
+        declarator is
+        {
+            Parent: LocalDeclarationStatementSyntax,
+            Initializer.Value: ObjectCreationExpressionSyntax { } objectCreation,
+        }
+        && objectCreation.Type.IsKnownType(KnownType.System_Text_StringBuilder, semanticModel)
+            ? semanticModel.GetDeclaredSymbol(declarator.Names.First()) as ILocalSymbol
+            : null;
+
+    protected override bool IsStringBuilderRead(string name, ILocalSymbol symbol, SyntaxNode node, SemanticModel model) =>
+        node switch
+        {
+            InvocationExpressionSyntax invocation =>
+                (StringBuilderAccessInvocations.Contains(invocation.GetName()) && IsSameReference(invocation.Expression, name, symbol, model))
+                || (IsSameReference(invocation.Expression, name, symbol, model) && model.GetOperation(invocation).Kind is OperationKindEx.PropertyReference),
+            ReturnStatementSyntax returnStatement => IsSameReference(returnStatement.Expression, name, symbol, model),
+            InterpolationSyntax interpolation => IsSameReference(interpolation.Expression, name, symbol, model),
+            ArgumentSyntax argument => IsSameReference(argument.GetExpression(), name, symbol, model),
+            MemberAccessExpressionSyntax memberAccess => StringBuilderAccessExpressions.Contains(memberAccess.Name.GetName()) && IsSameReference(memberAccess.Expression, name, symbol, model),
+            _ => false,
+        };
+
+    protected override bool DescendIntoChildren(SyntaxNode node) => !node.IsAnyKind(SkipChildren);
+}

analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingCS.cs

@@ -2987,7 +2987,7 @@ internal static class RuleTypeMappingCS
         ["S3060"] = "CODE_SMELL",
         // ["S3061"],
         // ["S3062"],
-        // ["S3063"],
+        ["S3063"] = "CODE_SMELL",
         // ["S3064"],
         // ["S3065"],
         // ["S3066"],

analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingVB.cs

@@ -2987,7 +2987,7 @@ internal static class RuleTypeMappingVB
         // ["S3060"],
         // ["S3061"],
         // ["S3062"],
-        // ["S3063"],
+        ["S3063"] = "CODE_SMELL",
         // ["S3064"],
         // ["S3065"],
         // ["S3066"],