Handle reference to non-source symbols in UseConcreteTypeAnalyzer

[mavasani]

Fixes #6852

[mavasani]

@carlossanlop @jeffhandley - we may consider this for backporting to 8.0 as this fixes an analyzer exception case.

[codecov]

Codecov Report

Merging #6959 (a6c29fa) into main (1066c7c) will decrease coverage by 0.01%.
The diff coverage is 80.00%.

@@            Coverage Diff             @@
##             main    #6959      +/-   ##
==========================================
- Coverage   96.42%   96.42%   -0.01%     
==========================================
  Files        1398     1398              
  Lines      333549   333552       +3     
  Branches    11036    11038       +2     
==========================================
  Hits       321620   321620              
- Misses       9166     9168       +2     
- Partials     2763     2764       +1     

[buyaa-n]

LGTM, thank you! 💯% supportive of backporting 8.0

[mavasani]

/backport to release/8.0.1xx

[github-actions]

Started backporting to release/8.0.1xx: https://github.com/dotnet/roslyn-analyzers/actions/runs/6265062342

[jeffhandley]

Looks good to me too. I will advocate for the backport to be approved once the issue template is filled out on #6960.

[buyaa-n]

Looks good to me too. I will advocate for the backport to be approved once the issue template is filled out on #6960.

The template is filled

[jeffhandley]

As @artl93 asked on the backport PR:

is there a general pattern in this scenario here we should be considering validating more broadly?

@mavasani / @buyaa-n -- since this fix is isolated to this specific analyzer, should we scout out this category of bug across other analyzers? I don't know how often we have logic similar to this.

[buyaa-n]

Just did a quick check, the API MatchesConfiguredVisibility is used in many analyzers, mostly used for analyzing symbol actions and a few operation block analysis where the symbol is guaranteed to be in source (it is the analyzing symbol or the method of the analyzing operation block), I believe they are safe

Found only one similar case that might cause this issue (CA2234):

roslyn-analyzers/src/NetAnalyzers/Core/Microsoft.CodeQuality.Analyzers/ApiDesignGuidelines/PassSystemUriObjectsInsteadOfStrings.cs

Lines 91 to 95 in 4aefee9

	if (!context.Options.MatchesConfiguredVisibility(Rule, method, context.ContainingSymbol, context.Compilation))
	{
	// only apply to methods that are exposed outside by default
	return;
	}

This is called for an invocation operation that could be referencing a method defined outside of the source:

roslyn-analyzers/src/NetAnalyzers/Core/Microsoft.CodeQuality.Analyzers/ApiDesignGuidelines/PassSystemUriObjectsInsteadOfStrings.cs

Line 54 in 4aefee9

c.RegisterOperationAction(analyzer.Analyze, OperationKind.Invocation);

It might not noticed before because this analyzer is disabled by default