MA0028: Detect StringBuilder.AppendFormat with no-placeholder format strings

[Copilot]

MA0028 didn't cover StringBuilder.AppendFormat calls where the format string has no {n} placeholders, making any extra arguments dead weight.

Changes

• Analyzer — Detects AppendFormat(format, args...) and AppendFormat(provider, format, args...) when the format string is a compile-time constant with no placeholders
• Fixer — Replaces the call with Append(formatString), dropping unused arguments and the optional IFormatProvider
• Common — Added HasFormatPlaceholders helper (handles escaped braces {{}}, alignment {0,10}, format specifiers {0:D2})

Example

// Before — args are never used
sb.AppendFormat("NO PLACEHOLDERS", arg1, arg2);
sb.AppendFormat(provider, "NO PLACEHOLDERS", arg1);

// After
sb.Append("NO PLACEHOLDERS");
sb.Append("NO PLACEHOLDERS");

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 1s1vsblobprodcus386.vsblob.vsassets.io
  • Triggering command: /usr/share/dotnet/dotnet dotnet restore --no-dependencies /home/REDACTED/work/Meziantou.Analyzer/Meziantou.Analyzer/Meziantou.Analyzer.slnx --packages /home/REDACTED/work/Meziantou.Analyzer/.codeql-scratch/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/home/REDACTED/work/Meziantou.Analyzer/.codeql-scratch/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/home/REDACTED/work/Meziantou.Analyzer/.codeql-scratch/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true (dns block)
• pdfvsblobprodcus380.vsblob.vsassets.io
  • Triggering command: /usr/share/dotnet/dotnet dotnet restore --no-dependencies /home/REDACTED/work/Meziantou.Analyzer/Meziantou.Analyzer/Meziantou.Analyzer.slnx --packages /home/REDACTED/work/Meziantou.Analyzer/.codeql-scratch/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/home/REDACTED/work/Meziantou.Analyzer/.codeql-scratch/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/home/REDACTED/work/Meziantou.Analyzer/.codeql-scratch/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true (dns block)
• st8vsblobprodcus339.vsblob.vsassets.io
  • Triggering command: /usr/share/dotnet/dotnet dotnet restore --no-dependencies /home/REDACTED/work/Meziantou.Analyzer/Meziantou.Analyzer/Meziantou.Analyzer.slnx --packages /home/REDACTED/work/Meziantou.Analyzer/.codeql-scratch/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/home/REDACTED/work/Meziantou.Analyzer/.codeql-scratch/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/home/REDACTED/work/Meziantou.Analyzer/.codeql-scratch/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>MA0183 only reports string.Format invocations</issue_title>
<issue_description>### Version of the Meziantou.Analyzer NuGet package

3.0.10

Rule Identifier

MA0183

Target Framework

.NET 10.0

C# Language version

C# 14

Description

In it's current state, MA0183 is a partial duplicate of S3457 and CA2241.

• MA00183 and S3457 report diagnostics for use of String.Format(....) without placeholders and no arguments.
• MA00183, S3457 and CA2241 report diagnostic for use of String.Format(....) without placeholders and one or more arguments.
• S3457 and CA2241 also report diagnostics for other methods (eg. Console.Write(...), StringBuilder.AppendFormat(...)). CA2241 appears to have a whitelist of classes/methods that it reports diagnostics for and can be configured to scan additional methods or automatically detect formatting methods. Not sure about S3457, and since the documentation is no longer available ...

I propose to either:

• Explicitly consider the following additional overloads as formatting methods:
  • System.Console.Write(string format, object arg0)
  • System.Console.Write(string format, object arg0, object arg1)
  • System.Console.Write(string format, object arg0, object arg1, object arg2)
  • System.Console.Write(string format, params object[] arg)
  • System.Console.WriteLine(string format, object arg0)
  • System.Console.WriteLine(string format, object arg0, object arg1)
  • System.Console.WriteLine(string format, object arg0, object arg1, object arg2)
  • System.Console.WriteLine(string format, params object[] arg)
  • System.Text.StringBuilder.AppendFormat(string format, object arg0)
  • System.Text.StringBuilder.AppendFormat(string format, object arg0, object arg1)
  • System.Text.StringBuilder.AppendFormat(string format, object arg0, object arg1, object arg2)
  • System.Text.StringBuilder.AppendFormat(string format, params object[] args)
  • System.Text.StringBuilder.AppendFormat(IFormatProvider provider, string format, object arg0)
  • System.Text.StringBuilder.AppendFormat(IFormatProvider provider, string format, object arg0, object arg1)
  • System.Text.StringBuilder.AppendFormat(IFormatProvider provider, string format, object arg0, object arg1, object arg2)
  • System.Text.StringBuilder.AppendFormat(IFormatProvider provider, string format, params object[] args)
• Automatically consider methods as formatting methods if they have a string argument named format (preceded by zero of more other arguments) following by either one or more object arguments or one params object[] argument.
• Combination of both but opt-in to automatic detection of formatting methods.

Reproduction Steps

Minimal code:

_ = string.Format("ABC"); // NOK, reported by S3457 and MA0183
_ = string.Format("ABC", true); // NOK, reported by S3457, CA2241 and MA0183

Console.WriteLine("NO PLACEHOLDERS"); // OK
Console.WriteLine("NO PLACEHOLDERS", true); // NOK, reported by S3457 and CA2241
Console.WriteLine("NO PLACEHOLDERS", true, true); // NOK, reported by S3457 and CA2241
Console.WriteLine("NO PLACEHOLDERS", true, true, true); // NOK, reported by S3457 and CA2241
Console.WriteLine("NO PLACEHOLDERS", true, true, true, true); // NOK, reported by S3457 and CA2241

var sb = new StringBuilder();
sb.AppendFormat("NO PLACEHOLDERS"); // NOK, reported by S3457
sb.AppendFormat("NO PLACEHOLDERS", true); // NOK, reported by S3457 and CA2241
sb.AppendFormat("NO PLACEHOLDERS", true, true); // NOK, reported by S3457 and CA2241
sb.AppendFormat("NO PLACEHOLDERS", true, true, true); // NOK, reported by S3457 and CA2241
sb.AppendFormat("NO PLACEHOLDERS", true, true, true, true); // NOK, reported by S3457 and CA2241

CustomWrite("NO PLACEHOLDER"); // OK ?; not reported by any analyzer
CustomWrite("NO PLACEHOLDER", true); // NOK; not reported by any analyzer
CustomWrite("NO PLACEHOLDER", true, false); // NOK; reported by CA2241 when opting in to automatic detection of formatting methods

CustomWrite2("NO PLACEHOLDER"); // OK
CustomWrite2("NO PLACEHOLDER", true); // NOK; reported by CA2241 when opting in to automatic detection of formatting methods

private static void CustomWrite(string format, object arg0)
{
    Console.WriteLine(format, arg0);
}

private static void CustomWrite(string format, params object?[] args)
{
    Console.WriteLine(format, args);
}

private static void CustomWrite2(string message)
{
    Console.WriteLine(message);
}

private static void CustomWrite2(string format, params object?[] args)
{
    Console.WriteLine(format, args);
}

Other information

No response</issue_description>

<agent_instructions>For

sb.AppendFormat("NO PLACEHOLDERS"); // NOK, reported by S3457
sb.AppendFormat("NO PLACEHOLDERS", true); // NOK, reported by S3457 and CA2241
sb.AppendFormat("NO ...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

- Contributes to meziantou/Meziantou.Analyzer#1029

<!-- START COPILOT CODING AGENT TIPS -->
---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. [Learn more about Advanced Security.](https://gh.io/cca-advanced-security)