[http-client-csharp] Bounds check dynamic model collection paths

[JoshLove-msft]

Summary

• bounds-check generated dynamic model collection indexes before accessing list or array elements
• apply the guard to both PropagateGet and PropagateSet, including nested collections
• add generated-output coverage and end-to-end regression tests for JsonPatch.TryGetValue and JsonPatch.Set

Fixes #11616

Validation

• npm run build
• npm test
• npm run cop
• dotnet test Microsoft.TypeSpec.Generator.ClientModel.Tests.csproj (1,560 passed)

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@typespec/http-client-csharp@11632

commit: 9beef24

[github-actions]

No changes needing a change description found.

[Copilot]

Pull request overview

Updates the http-client-csharp generator to prevent out-of-range indexing when traversing dynamic-model collection properties via JsonPatch propagation, ensuring TryGetValue/Set follow their non-throwing contract for invalid paths.

Changes:

• Emit bounds checks for collection index segments in generated PropagateGet and PropagateSet, including nested collection paths.
• Update generator golden-output test data to reflect the new guards.
• Add end-to-end regression tests validating out-of-range indexed paths return false (for TryGetValue) and do not throw (for Set) in the Sample_TypeSpec test project.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/http-client-csharp/generator/Microsoft.TypeSpec.Generator.ClientModel/src/Providers/MrwSerializationTypeDefinition.Dynamic.cs	Adds generator logic to emit index >= (Count/Length) guards before indexing into lists/arrays during propagation.
packages/http-client-csharp/generator/TestProjects/Local/Sample-TypeSpec/src/Generated/Models/DynamicModel.Serialization.cs	Updates sample generated output to include the new bounds checks in PropagateGet/PropagateSet across multiple collection shapes.
packages/http-client-csharp/generator/Microsoft.TypeSpec.Generator.ClientModel/test/Providers/MrwSerializationTypeDefinitions/TestData/DynamicModelSerializationTests/PropagateModelListProperty.cs	Updates expected generated output to include bounds checking for list index access.
packages/http-client-csharp/generator/Microsoft.TypeSpec.Generator.ClientModel/test/Providers/MrwSerializationTypeDefinitions/TestData/DynamicModelSerializationTests/PropagateMultipleDynamicProperties.cs	Updates expected generated output to include bounds checks for multiple and nested collection propagations.
packages/http-client-csharp/generator/Microsoft.TypeSpec.Generator.ClientModel/test/Providers/MrwSerializationTypeDefinitions/TestData/DynamicModelSerializationTests/PropagateCustomizedDynamicListProperty.cs	Updates expected output to include bounds checks for customized dynamic list propagation.
packages/http-client-csharp/generator/Microsoft.TypeSpec.Generator.ClientModel/test/Providers/MrwSerializationTypeDefinitions/TestData/DynamicModelSerializationTests/PropagateCustomizedDynamicListPropertyMixed.cs	Updates expected output to include bounds checks for mixed customized dynamic list propagation.
packages/http-client-csharp/generator/Microsoft.TypeSpec.Generator.ClientModel/test/ModelReaderWriterValidation/TestProjects/Sample_TypeSpec/DynamicModelTests.cs	Adds E2E regression tests covering out-of-range collection paths for JsonPatch.TryGetValue and JsonPatch.Set.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.