Analyzer to warn against using Exception.Message in an exception filter

[yaakov-h]

e.g. catch (Exception ex) when (ex.Message.Contains("some English string"))

[brian-reichle]

I would suggest that the issue here isn't so much that Exception.Message is used in a filter, but that a decision is being made based on it. Using ex.Message.Contains(...) should probably be considered just as bad if it had appeared in the body of the catch block or in some other method.

[yaakov-h]

Agreed, but I thought that may be trickier.

Should we perhaps blacklist certain string methods or extension methods when called on Exception.Message?

[brian-reichle]

I would suggest blacklisting any string method that returns a bool or int and possibly any regex method.