Repository navigation
NET-3543 Fix AD0001: SonarAnalyzer.Rules.CSharp.SymbolicExecutionRunner exception when analyzing pull request on github. #9800
Description
Description
When this Pull Request got run on the current commit in it, the analyzer started throwing exceptions for specific C# code files due to a a nullref caused by some sort of issue somewhere in the analyzer's code (seems to always trip up on MethodDeclarationSyntax).
Reproducer
The code in this pull request can reproduce the exception without problems: Elskom/IDisposableGenerator#48
Product and Version
The latest NuGet analyzer, but also reproduces inside of the Visual Studio extension.
Activity
AraHaan commentedon Mar 31, 2026
cc: @pavel-mikula-sonarsource
Please help me figure out a way to fix this type of problem with the analyzer so that way other people with similar code can still use the analyzer.
mary-georgiou commentedon Apr 1, 2026
Hello @AraHaan .
Could you please provide us with a minimal code reproducer for this issue?
Or if possible give us the logs where the AD0001 happens?
AraHaan commentedon Apr 1, 2026
https://github.com/Elskom/IDisposableGenerator/runs/69302727344 does this link work?
The files it had the issue on:
AraHaan commentedon Apr 1, 2026
Seems to also happen with files in this PR as well: https://github.com/Elskom/IDisposableGenerator/pull/53/changes
mary-georgiou commentedon Apr 2, 2026
@AraHaan one question:
You mention that you are using latest NuGet - latest NuGet does not have SE.
If you do probably you are on an old one - and even if this is fixed you won't have the fix (if not fixed already - we're investigating with @pavel-mikula-sonarsource ).
Maybe you are getting the error via connected mode in your IDE?
Or the analysis in your PR uses SonarQube Server Dev+ versions or SonarQube Cloud?
[-]Fix AD0001: SonarAnalyzer.Rules.CSharp.SymbolicExecutionRunner exception when analyzing pull request on github.[/-][+]NET-3543 Fix AD0001: SonarAnalyzer.Rules.CSharp.SymbolicExecutionRunner exception when analyzing pull request on github.[/+]github-actions commentedon Apr 2, 2026
Internal ticket NET-3543
AraHaan commentedon Apr 2, 2026
I think the "Security Code Scan" action from codacy could be using an outdated SonarAnalyzer version for C# (or outdated SonarQube?) (idk its version) and then it might be publishing the AD0001's on its upload to GitHub's CodeQL step (https://github.com/codacy/codacy-analysis-cli-action specifically).
I guess I could look into seeing if they could update the analyzer as well.
AraHaan commentedon Apr 2, 2026
And filed issue to them as well.
mary-georgiou commentedon Apr 2, 2026
FYI Symbolic Execution since sonar-dotnet 10.0.0 is only available for SonarQube Cloud and SonarQube Team/Develope, Enterprise and Data Center Editions.
it's also not available via the NuGet anymore - so if you have the NuGet updated the issue will be removed because SE won't be running anyways.
pavel-mikula-sonarsource commentedon Apr 2, 2026
Hi,
regarding your request to them to update to the latest - please be aware that 10.2 is the latest version that they can update to, without violating license of the package.
From version 10.3 onwards, the license has changed to SSALv1: https://www.sonarsource.com/license/ssal/
pavel-mikula-sonarsource commentedon Apr 2, 2026
Cross reference: #8811 was the previous topic where we tried to reproduce this.
@mary-georgiou-sonarsource The fact that it reproduces itself in Codacy explains that there's a custom compilation object, which can possibly contain
SyntaxTreeOptionswithnullvalue and your reproducer makes sense.@AraHaan Once we fix this, the fix will reach you only via SonarQube Cloud, or next release of SonarQube Server, or SonarQube for IDE in connected mode connected to one of those. We won't backport it to the older versions, unfortunately.