The SVACE static analyzer identified a potential handle leak in the IIS StartupHook class where a PhysicalFileProvider was created but not properly disposed.

Problem

In src/Servers/IIS/IIS/src/StartupHook.cs, the unhandled exception handler creates a PhysicalFileProvider to generate error page content but doesn't dispose it:

var model = ErrorPageModelBuilder.CreateErrorPageModel(
    new PhysicalFileProvider(contentRoot), // ❌ Not disposed
    logger: null,
    showDetailedErrors: true,
    exception);

Since PhysicalFileProvider implements IDisposable and manages file system resources, this could lead to handle leaks.

Solution

Wrapped the PhysicalFileProvider creation in a using statement to ensure proper disposal:

using var fileProvider = new PhysicalFileProvider(contentRoot);

var model = ErrorPageModelBuilder.CreateErrorPageModel(
    fileProvider, // ✅ Properly disposed at end of scope
    logger: null,
    showDetailedErrors: true,
    exception);

This approach follows existing patterns in the codebase where PhysicalFileProvider is used with using statements in similar scenarios (e.g., in diagnostic and static file middleware tests).

The fix is safe because ErrorPageModelBuilder.CreateErrorPageModel() only uses the file provider during its execution and doesn't retain any references to it.

Fixes #59524.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.