feat: support DbCommand command-text via constructor string sql query parse

src/Dapper.AOT.Analyzers/CodeAnalysis/DapperAnalyzer.cs

@@ -2,6 +2,7 @@
 using Dapper.Internal.Roslyn;
 using Dapper.SqlAnalysis;
 using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
 using Microsoft.CodeAnalysis.Diagnostics;
 using Microsoft.CodeAnalysis.Operations;
 using System;
@@ -35,8 +36,11 @@
         // per-run state (in particular, so we can have "first time only" diagnostics)
         var state = new AnalyzerState(context);
 
-        // respond to method usages
-        context.RegisterOperationAction(state.OnOperation, OperationKind.Invocation, OperationKind.SimpleAssignment);
+        context.RegisterOperationAction(state.OnOperation, 
+            OperationKind.Invocation, // for Dapper method invocations
+            OperationKind.SimpleAssignment, // for assignments of query
+            OperationKind.VariableDeclaration // for instantiating Command objects
+        );
 
         // final actions
         context.RegisterCompilationEndAction(state.OnCompilationEndAction);
@@ -111,8 +115,9 @@
             try
             {
                 // we'll look for:
-                // method calls with a parameter called "sql" or marked [Sql]
-                // property assignments to "CommandText"
+                // - method calls with a parameter called "sql" or marked [Sql]
+                // - property assignments to "CommandText"
+                // - allocation of SqlCommand (i.e. `new SqlCommand(queryString, ...)` )
                 switch (ctx.Operation.Kind)
                 {
                     case OperationKind.Invocation when ctx.Operation is IInvocationOperation invoke:
@@ -155,6 +160,39 @@
                                 ValidatePropertyUsage(ctx, assignment.Value, false);
                             }
                         }
+                        break;
+                    case OperationKind.VariableDeclaration when ctx.Operation is IVariableDeclarationOperation variableDeclarationOperation
+                        && variableDeclarationOperation.Declarators.FirstOrDefault() is { } declarator
+                        && declarator.Initializer?.Value is IObjectCreationOperation objectCreationOperation:
+
+                        var ctor = objectCreationOperation.Constructor;
+                        var receiverType = ctor?.ReceiverType;
+
+                        if (ctor is not null && receiverType is
+                            {
+                                Name: "SqlCommand",
+                                ContainingNamespace:
+                                {
+                                    Name: "SqlClient",
+                                    ContainingNamespace:
+                                    {
+                                        Name: "Data",
+                                        ContainingNamespace:
+                                        {
+                                            Name: "Microsoft",
+                                            ContainingNamespace.IsGlobalNamespace: true
+                                        }
+                                    }
+                                }
+                            })
+                        {
+                            var sqlParam = ctor.Parameters.FirstOrDefault();
+                            if (sqlParam is not null && sqlParam.Type.SpecialType == SpecialType.System_String && sqlParam.Name == "cmdText")
+                            {
+                                ValidateParameterUsage(ctx, objectCreationOperation.Arguments.First(), sqlUsage: objectCreationOperation);
+                            }
+                        }
+
                         break;
                 }
             }
@@ -327,11 +365,11 @@
             }
         }
 
-        private void ValidateParameterUsage(in OperationAnalysisContext ctx, IOperation sqlSource)
+        private void ValidateParameterUsage(in OperationAnalysisContext ctx, IOperation sqlSource, IOperation sqlUsage = null)
         {
             // TODO: check other parameters for special markers like command type?
             var flags = SqlParseInputFlags.None;
-            ValidateSql(ctx, sqlSource, flags, SqlParameters.None);
+            ValidateSql(ctx, sqlSource, flags, SqlParameters.None, sqlUsageOperation: sqlUsage);
         }
 
         private void ValidatePropertyUsage(in OperationAnalysisContext ctx, IOperation sqlSource, bool isCommand)
@@ -372,12 +410,12 @@
         }
 
         private void ValidateSql(in OperationAnalysisContext ctx, IOperation sqlSource, SqlParseInputFlags flags,
-            ImmutableArray<SqlParameter> parameters, Location? location = null)
+            ImmutableArray<SqlParameter> parameters, Location? location = null, IOperation sqlUsageOperation = null)
         {
             var parseState = new ParseState(ctx);
 
             // should we consider this as a syntax we can handle?
-            var syntax = IdentifySqlSyntax(parseState, ctx.Operation, out var caseSensitive) ?? DefaultSqlSyntax ?? SqlSyntax.General;
+            var syntax = IdentifySqlSyntax(parseState, sqlUsageOperation ?? ctx.Operation, out var caseSensitive) ?? DefaultSqlSyntax ?? SqlSyntax.General;
             switch (syntax)
             {
                 case SqlSyntax.SqlServer:

src/Dapper.AOT.Analyzers/Internal/Inspection.cs

@@ -1432,6 +1432,26 @@ internal static bool IsCommand(INamedTypeSymbol type)
                 }
             }
         }
+        else if (op is IObjectCreationOperation objectCreationOp)
+        {
+            var ctorTypeNamespace = objectCreationOp.Type?.ContainingNamespace;
+            var ctorTypeName = objectCreationOp.Type?.Name;
+
+            if (ctorTypeNamespace is not null && ctorTypeName is not null)
+            {
+                foreach (var candidate in KnownConnectionTypes)
+                {
+                    var current = ctorTypeNamespace;
+                    if (ctorTypeName == candidate.Command
+                        && AssertAndAscend(ref current, candidate.Namespace0)
+                        && AssertAndAscend(ref current, candidate.Namespace1)
+                        && AssertAndAscend(ref current, candidate.Namespace2))
+                    {
+                        return candidate.Syntax;
+                    }
+                }
+            }
+        }
 
         return null;
 

src/Dapper.AOT.Analyzers/Internal/Roslyn/LanguageHelper.cs

@@ -110,7 +110,7 @@ internal virtual bool IsGlobalStatement(SyntaxNode syntax, out SyntaxNode? entry
 
     internal virtual StringSyntaxKind? TryDetectOperationStringSyntaxKind(IOperation operation)
     {
-        if (operation is null) return null;
+        if (operation is null || operation is ILiteralOperation) return null;
         if (operation is IBinaryOperation)
         {
             return StringSyntaxKind.ConcatenatedString;

test/Dapper.AOT.Test/Verifiers/SqlDetection.cs

@@ -184,7 +184,7 @@ static class Program
         {
             static void Main()
             {
-        using var conn = new SqlConnection("my connection string here");
+                using var conn = new SqlConnection("my connection string here");
         string name = "abc";
         conn.{|#0:Execute|}("""
             select Id, Name, Age
@@ -200,7 +200,7 @@ from Users
             age = 24,
         });
 
-        using var cmd = new SqlCommand("should ' verify this too", conn);
+        using var cmd = new SqlCommand("should {|#3:|}' verify this too", conn);
         cmd.CommandText = """
             select Id, Name, Age
             from Users
@@ -217,6 +217,7 @@ from Users
         Diagnostic(DapperAnalyzer.Diagnostics.ExecuteCommandWithQuery).WithLocation(0),
         Diagnostic(DapperAnalyzer.Diagnostics.NullLiteralComparison).WithLocation(1),
         Diagnostic(DapperAnalyzer.Diagnostics.NullLiteralComparison).WithLocation(2),
+        Diagnostic(DapperAnalyzer.Diagnostics.ParseError).WithLocation(3).WithArguments(46030, "Expected but did not find a closing quotation mark after the character string ' verify this too.")
     ], SqlSyntax.General, refDapperAot: false);
 
     [Fact]