Potential fix for code scanning alert no. 87: String concatenation in loop

[vb2ae]

Potential fix for https://github.com/Caliburn-Micro/Caliburn.Micro/security/code-scanning/87

To fix the problem, replace the string concatenation in the loop with a StringBuilder. Specifically, in the region where message is built up by appending parameter names and commas, instantiate a StringBuilder, append the method name, and then append each parameter name and comma inside the loop. After the loop, remove the trailing comma and append the closing parenthesis. Finally, convert the StringBuilder to a string and assign it to message. This change should be made in the block starting at line 179, where message is constructed. You will need to add using System.Text; at the top of the file if it is not already present.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a code scanning alert by replacing inefficient string concatenation in a loop with a StringBuilder. The change optimizes the performance of message construction when building method signatures for logging purposes.

Key Changes

• Replaces string concatenation with StringBuilder for building method signatures
• Adds proper using System.Text; import statement
• Improves performance by avoiding repeated string allocations in loops

[Copilot]

The variable message is declared inside the if block but used outside of it at line 204. This will cause a compilation error because message is not in scope when parameters.Length is 0. Move the declaration outside the if block or ensure it's accessible in all code paths.

Suggested change

	var message = messageBuilder.ToString();
	}
	}
	message = messageBuilder.ToString();

[Copilot]

This condition check is redundant since this code is already inside a block that only executes when parameters.Length > 0 (line 183). The condition will always be true and can be removed.

Suggested change

	if (parameters.Length > 0)
	messageBuilder.Length -= 1;
	messageBuilder.Length -= 1;

To fix the problem, replace the string-based type comparison (vmType.FullName == "Microsoft.Expression.DesignModel.InstanceBuilders.DesignInstanceExtension") with a direct type comparison using == typeof(...). This ensures that the check is robust and not vulnerable to spoofing by types with the same name in different assemblies. The change should be made only in the relevant region (line 249) of src/Caliburn.Micro.Platform/ViewModelBinder.cs. No new imports are needed, as typeof is a built-in C# operator.

---