[v2.0 audit][L10] IdentifierUtils.ReservedKeywords incomplete; Sanitize() does not escape keywords
bugpriority:p2audit:v2.0
**Severity:** Low | **Component:** Refitter.Core | **v2.0 audit (since v1.7.3)**
- Missing real reserved keywords: `__arglist`, `__makeref`, `__reftype`, `__refvalue` (rare but real CS1041 sources).
- Contextual keywords aren't included — `record`, `nameof`, `value`, `var`, `dynamic`, `init`, `required`, `file`, `scoped`, `with`, `notnull`, `unmanaged`. `record` as a type name is allowed only in some positions; `file` as a class modifier is reserved at type position in C# 11+.
- `Sanitize()` (used by `OperationNameGenerator` and `SanitizeControllerTag`) does **not** call `EscapeReservedKeyword`. Today this is masked because callers always `CapitalizeFirstCharacter()`, but anything calling `Sanitize()` for a lowercase identifier can still emit a keyword.
### Code
- `src/Refitter.Core/IdentifierUtils.cs:8-87, 124-142`
### Fix
Add the underscore keywords; have `Sanitize()` route through `EscapeReservedKeyword` for safety; consider a small `ReservedTypeKeywords` set (`record`, `file`).
Related: H2, H3.
0 条评论