Added input sanitization for deprecatedMessage values from service models before they are emitted into generated C# code.

generator/ServiceClientGeneratorLib/GeneratorHelpers.cs

@@ -452,6 +452,22 @@ public static string SanitizeQuotes(this string s)
             return s.Replace("\"", "\"\"");
         }
 
+        /// <summary>
+        /// Sanitizes a deprecation message by removing or replacing characters that could
+        /// break generated code (e.g. newlines, HTML tags, quotes in [Obsolete("...")] attributes).
+        /// </summary>
+        public static string SanitizeDeprecationMessage(this string s)
+        {
+            return s
+                .Replace("\r", string.Empty)
+                .Replace("\n", string.Empty)
+                .Replace("\"", "'")
+                .Replace("<p>", string.Empty)
+                .Replace("</p>", string.Empty)
+                .Replace("<code>", "<c>")
+                .Replace("</code>", "</c>");
+        }
+
         public static string ToVariableName(this string s)
         {
             return s.Replace("-", "_");

generator/ServiceClientGeneratorLib/Member.cs

@@ -1057,7 +1057,7 @@ public string DeprecationMessage
                 if (message == null)
                     throw new Exception(string.Format("The 'message' property of the 'deprecated' trait is missing for member {0}.{1}.\nFor example: \"MemberName\":{{ ... \"deprecated\":true, \"deprecatedMessage\":\"This property is deprecated, use XXX instead.\"}}", this.OwningShape.Name, this._name));
 
-                return message ?? "";
+                return (message ?? "").SanitizeDeprecationMessage();
             }
         }
 

generator/ServiceClientGeneratorLib/Operation.cs

@@ -115,7 +115,7 @@ public string DeprecationMessage
                 if (message == null)
                     throw new Exception(string.Format("The 'message' property of the 'deprecated' trait is missing for operation {0}.\nFor example: \"OperationName\":{{\"name\":\"OperationName\", ... \"deprecated\":true, \"deprecatedMessage\":\"This operation is deprecated\"}}", this.name));          
 
-                return message;
+                return message.SanitizeDeprecationMessage();
             }
         }
 

generator/ServiceClientGeneratorLib/Shape.cs

@@ -792,7 +792,7 @@ public string DeprecationMessage
                 if (message == null)
                     throw new Exception(string.Format("The 'message' property of the 'deprecated' trait is missing for shape {0}.\nFor example: \"ShapeName\":{{ ... \"members\":{{ ... }}, \"deprecated\":true, \"deprecatedMessage\":\"This type is deprecated\"}}", this._name));
 
-                return message ?? "";
+                return (message ?? "").SanitizeDeprecationMessage();
             }
         }
 

generator/ServiceClientGeneratorLib/SimpleModels.cs

@@ -121,6 +121,7 @@ public string XmlNamespacePrefix
                 return string.Empty;
             }
         }
+
     }
 
     #endregion

generator/ServiceClientGeneratorTests/Content/TestModelDeprecated.json

@@ -0,0 +1,43 @@
+{
+  "version": "1.0",
+  "metadata": {
+    "apiVersion": "2020-6-25",
+    "serviceAbbreviation": "TestService",
+    "serviceFullName": "TestService",
+    "signatureVersion": "v4",
+    "serviceId": "TestService"
+  },
+  "operations": {
+    "DeprecatedOperation": {
+      "name": "DeprecatedOperation",
+      "input": { "shape": "DeprecatedOperationInput" },
+      "output": { "shape": "DeprecatedOperationOutput" },
+      "documentation": "a deprecated operation",
+      "deprecated": true,
+      "deprecatedMessage": "This operation is deprecated.\nUse <code>NewOperation</code> instead.\r\nSee \"docs\" for <p>details</p>."
+    }
+  },
+  "shapes": {
+    "DeprecatedOperationInput": {
+      "type": "structure",
+      "members": {
+        "OldField": {
+          "shape": "OldFieldShape",
+          "deprecated": true,
+          "deprecatedMessage": "This field is deprecated.\nUse <code>NewField</code> instead.\r\nSee \"docs\" for <p>details</p>."
+        }
+      }
+    },
+    "DeprecatedOperationOutput": {
+      "type": "structure",
+      "members": {}
+    },
+    "OldFieldShape": { "type": "string" },
+    "DeprecatedShape": {
+      "type": "structure",
+      "members": {},
+      "deprecated": true,
+      "deprecatedMessage": "This shape is deprecated.\nUse <code>NewShape</code> instead.\r\nSee \"docs\" for <p>details</p>."
+    }
+  }
+}

generator/ServiceClientGeneratorTests/UnitTests.cs

@@ -103,5 +103,75 @@ public void TestExampleShapes(string shapeType, object value, string expectedTex
             var printedText = sb.ToString();
             Assert.Equal(expectedText, printedText);
         }
+
+        #region Deprecation Message Sanitization Tests
+
+        private const string _deprecatedModelsPath = "../../Content/TestModelDeprecated.json";
+
+        // The expected sanitized message after removing \r, \n, replacing " with ',
+        // removing <p></p>, and replacing <code></code> with <c></c>.
+        private const string _expectedSanitizedMessage = "This operation is deprecated.Use <c>NewOperation</c> instead.See 'docs' for details.";
+        private const string _expectedSanitizedMemberMessage = "This field is deprecated.Use <c>NewField</c> instead.See 'docs' for details.";
+        private const string _expectedSanitizedShapeMessage = "This shape is deprecated.Use <c>NewShape</c> instead.See 'docs' for details.";
+
+        [Fact]
+        public void OperationDeprecationMessageIsSanitized()
+        {
+            var model = new ServiceModel(_deprecatedModelsPath, null);
+            var operation = model.Operations.Single(x => x.Name.Equals("DeprecatedOperation"));
+
+            Assert.True(operation.IsDeprecated);
+            var message = operation.DeprecationMessage;
+
+            Assert.DoesNotContain("\n", message);
+            Assert.DoesNotContain("\r", message);
+            Assert.DoesNotContain("\"", message);
+            Assert.DoesNotContain("<p>", message);
+            Assert.DoesNotContain("</p>", message);
+            Assert.DoesNotContain("<code>", message);
+            Assert.DoesNotContain("</code>", message);
+            Assert.Equal(_expectedSanitizedMessage, message);
+        }
+
+        [Fact]
+        public void ShapeDeprecationMessageIsSanitized()
+        {
+            var model = new ServiceModel(_deprecatedModelsPath, null);
+            var shape = model.Shapes.Single(x => x.Name.Equals("DeprecatedShape"));
+
+            Assert.True(shape.IsDeprecated);
+            var message = shape.DeprecationMessage;
+
+            Assert.DoesNotContain("\n", message);
+            Assert.DoesNotContain("\r", message);
+            Assert.DoesNotContain("\"", message);
+            Assert.DoesNotContain("<p>", message);
+            Assert.DoesNotContain("</p>", message);
+            Assert.DoesNotContain("<code>", message);
+            Assert.DoesNotContain("</code>", message);
+            Assert.Equal(_expectedSanitizedShapeMessage, message);
+        }
+
+        [Fact]
+        public void MemberDeprecationMessageIsSanitized()
+        {
+            var model = new ServiceModel(_deprecatedModelsPath, null);
+            var shape = model.Shapes.Single(x => x.Name.Equals("DeprecatedOperationInput"));
+            var member = shape.Members.Single(x => x.ModeledName.Equals("OldField"));
+
+            Assert.True(member.IsDeprecated);
+            var message = member.DeprecationMessage;
+
+            Assert.DoesNotContain("\n", message);
+            Assert.DoesNotContain("\r", message);
+            Assert.DoesNotContain("\"", message);
+            Assert.DoesNotContain("<p>", message);
+            Assert.DoesNotContain("</p>", message);
+            Assert.DoesNotContain("<code>", message);
+            Assert.DoesNotContain("</code>", message);
+            Assert.Equal(_expectedSanitizedMemberMessage, message);
+        }
+
+        #endregion
     }
 }