Open yaakov-h opened 3 years ago
I would suggest that the issue here isn't so much that Exception.Message
is used in a filter, but that a decision is being made based on it. Using ex.Message.Contains(...)
should probably be considered just as bad if it had appeared in the body of the catch block or in some other method.
Agreed, but I thought that may be trickier.
Should we perhaps blacklist certain string methods or extension methods when called on Exception.Message
?
I would suggest blacklisting any string method that returns a bool or int and possibly any regex method.
e.g.
catch (Exception ex) when (ex.Message.Contains("some English string"))