Replace AddWithValue in symbol lookups

changelog.d/unreleased/4057.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 4057
+affected:
+  - src/CodeIndex/Database/DbSymbolReader.cs
+  - tests/CodeIndex.Tests/DbReaderTests.cs
+---
+
+## English
+
+- **Symbol line lookups now use explicit SQLite parameter binding (#4057)** — `AnalyzeFileLine` no longer relies on `AddWithValue` inside symbol lookup queries, so the dotnet risk audit stays aligned with the repository SQLite command policy.
+
+## 日本語
+
+- **シンボル行 lookup が明示的な SQLite parameter binding を使うようになりました (#4057)** — `AnalyzeFileLine` のシンボル lookup query 内で `AddWithValue` に依存しなくなり、dotnet risk audit がリポジトリの SQLite command policy と揃うようになりました。

src/CodeIndex/Database/DbSymbolReader.cs

@@ -1821,13 +1821,13 @@ AND @line BETWEEN {bodyStartLineSql} AND {bodyEndLineSql}
             LIMIT @limit";
 
         cmd.CommandText = sql;
-        cmd.Parameters.AddWithValue("@path", path);
-        cmd.Parameters.AddWithValue("@line", line);
-        cmd.Parameters.AddWithValue("@limit", limit);
+        SqliteCommandPolicy.Add(cmd, "@path", path);
+        SqliteCommandPolicy.Add(cmd, "@line", line);
+        SqliteCommandPolicy.Add(cmd, "@limit", limit);
         if (kind != null)
-            cmd.Parameters.AddWithValue("@kind", kind);
+            SqliteCommandPolicy.Add(cmd, "@kind", kind);
         if (lang != null)
-            cmd.Parameters.AddWithValue("@lang", lang);
+            SqliteCommandPolicy.Add(cmd, "@lang", lang);
 
         var results = new List<SymbolResult>();
         using var reader = cmd.ExecuteTrackedReader();

tests/CodeIndex.Tests/DbReaderTests.cs

@@ -2570,6 +2570,36 @@ public void SearchSymbols_BreaksSameLineTiesByStartColumn()
         Assert.Equal(["early SameLine()", "late SameLine()"], results.Select(result => result.Signature).ToArray());
     }
 
+    [Fact]
+    public void AnalyzeFileLine_WithKindAndLanguageFilters_ReturnsSymbolAtLine_Issue4057()
+    {
+        InsertIndexedFile(
+            "src/issue4057/LineLookup.cs",
+            "csharp",
+            """
+            public class LineLookup
+            {
+                public void Outside() { }
+                public void Target()
+                {
+                }
+            }
+            """);
+
+        var analysis = _reader.AnalyzeFileLine(
+            "src/issue4057/LineLookup.cs",
+            line: 5,
+            limit: 5,
+            lang: "csharp",
+            kind: "function");
+
+        var definition = Assert.Single(analysis.Definitions);
+        Assert.Equal("Target", definition.Name);
+        Assert.Equal("function", definition.Kind);
+        Assert.Equal("csharp", definition.Lang);
+        Assert.Equal("src/issue4057/LineLookup.cs", definition.Path);
+    }
+
     [Fact]
     public void SearchSymbols_CSharpOperatorsConversionsAndIndexersUseNavigableNames()
     {