C# Code Analysis CA2000

Question

I have a function which I thought I had fixed the CA2000 warning in Code Analysis for, but it just won't go away. The warning is on SqlCommand. Here's the function:

protected internal void LogUserSession(int? managerID)
{
    using (var sqlCommand = new SqlCommand())
    {
        sqlCommand.SetCommand("usp_UserActivity_Create");

        SqlParameter prmSessionID = new SqlParameter();
        prmSessionID.ParameterName = "@sessionID";
        prmSessionID.Direction = ParameterDirection.Input;
        prmSessionID.SqlDbType = SqlDbType.VarChar;
        prmSessionID.Size = 32;
        prmSessionID.SetValue(SessionID);

        SqlParameter prmUsername = new SqlParameter();
        prmUsername.ParameterName = "@username";
        prmUsername.Direction = ParameterDirection.Input;
        prmUsername.SqlDbType = SqlDbType.VarChar;
        prmUsername.Size = 32;
        prmUsername.SetValue(Username);

        SqlParameter prmLoginID = new SqlParameter();
        prmLoginID.ParameterName = "@loginID";
        prmLoginID.Direction = ParameterDirection.Output;
        prmLoginID.SqlDbType = SqlDbType.Int;

        sqlCommand.Parameters.Add(prmSessionID);
        sqlCommand.Parameters.Add(prmUsername);
        sqlCommand.Parameters.Add(prmLoginID);

        using (sqlCommand.Connection = new SqlConnection(ConnectionStrings.MainApp))
        {
            sqlCommand.Connection.Open();
            sqlCommand.ExecuteNonQueryTryCatch();

            if (prmLoginID.Value != DBNull.Value) LoginID = Convert.ToInt32(prmLoginID.Value);
        }
    }
}

I have another function that to me looks no different but does not have a CA2000 warning associated to it. Here's that function:

public static bool IsAvailable(string username)
        {
            using (var sqlCommand = new SqlCommand())
            {
                sqlCommand.SetCommand("usp_UsernameIsAvailable");

                var prmUsername = new SqlParameter();
                prmUsername.ParameterName = "@username";
                prmUsername.Direction = ParameterDirection.Input;
                prmUsername.SqlDbType = SqlDbType.VarChar;
                prmUsername.Size = 32;
                prmUsername.SetValue(username);

                var prmReturnValue = new SqlParameter();
                prmReturnValue.ParameterName = "@returnValue";
                prmReturnValue.Direction = ParameterDirection.ReturnValue;
                prmReturnValue.SqlDbType = SqlDbType.Bit;

                sqlCommand.Parameters.Add(prmUsername);
                sqlCommand.Parameters.Add(prmReturnValue);

                using (sqlCommand.Connection = new SqlConnection(ConnectionStrings.ComplianceApps))
                {
                    sqlCommand.Connection.Open();
                    sqlCommand.ExecuteNonQueryTryCatch();

                    return Convert.ToBoolean(prmReturnValue.Value);
                }
            }
        }

I don't understand what's going on here and what I need to do to fix it.

What is SessionID, out of curiosity? Is that just a string property of the class this method is from? — Erik Dietrich, Mar 10 '12 at 23:21
I don't get a warning for your code with code analysis 'Microsoft All Rules'. — Phil, Mar 10 '12 at 23:50
SessionID is the generated ID from the session the user opens when hitting the application. It's a reference to the user's actual session. — Hungry Beast, Mar 11 '12 at 00:07
I cannot reproduce the CA2000 violation on the first method. Could you please provide the code for all three of the extension methods (SetCommand, SetValue, and ExecuteNonQueryTryCatch) invoked from your first sample method? — Nicole Calinoiu, Mar 12 '12 at 13:32

score 3 · Accepted Answer · answered Mar 12 '12 at 08:01

The CA2000 warning is notorious for causing false positives. One of the things it does is when it finds more than 16 possible locations that can throw an exception, it just stops looking and flags the CA warning.

A very similar question with a response from Microsoft can be found here: http://social.msdn.microsoft.com/Forums/en-US/vstscode/thread/90f993a3-6bdf-4b62-9982-9247a655406d/

Connect bug tracking this issue: https://connect.microsoft.com/VisualStudio/feedback/details/725836/warning-ca2000-is-fired-on-a-sqlcommand-with-many-sqlparameters#details

C# Code Analysis CA2000

1 Answers1

Linked