[BUG] C# engine loses cipher settings when the object is used through a second variable

[n1ckl0sk0rtge]

Summary

The C# engine links a crypto object to its settings by comparing plain variable names. If the object is used through a second variable, the link breaks and the settings are lost.

In engine/src/main/java/com/ibm/engine/language/csharp/CSharpDetectionEngine.java:

• :420 — return invocation.getObjectTypeName().equals(sym.getName());
• :439 — return assignedId.equals(sym.getName());

This is the C# form of #8.

The fix from #390 cannot be ported here. That PR walks Symbol.declaration() in Java and Symbol.usages() in Python. C# has neither. CSharpSymbol holds only a name string, and its own javadoc says the ANTLR4 grammar gives no semantic resolution. So C# needs a different solution: track assignments while building the tree in CSharpTreeConverter, or build a small symbol table for the file.

Steps to reproduce

csharp/src/test/files/rules/detection/dotnet/ProbeCSharpAliasTestFile.cs:

using System.Security.Cryptography;

public class ProbeCSharpAlias
{
    public void TestViaAlias()
    {
        var aes = Aes.Create();
        var alias = aes;
        alias.Mode = CipherMode.CBC;
        alias.KeySize = 256;
    }
}

Run it through the C# TestBase with CSharpVerifier.

Actual behaviour

finding=0
  value=AES
  children=3
  node=AES

The three property stores are created, but they carry no detected values. Mode and key size never reach the model. The CBOM entry is a bare AES.

Expected behaviour

The same result as the direct form, which already works. DotNetAESPropertyTestFile.cs uses aes directly and DotNetAESPropertyTest asserts:

node.asString() == "AES-256-CBC-PKCS7"

With the alias, the expected result is AES-256-CBC.

Severity and frequency

• Severity: medium. The data is missing, not wrong. Unlike the Go problem in [BUG] Go engine ignores the trace symbol, so detections mix up values from different variables #510, C# under-reports instead of reporting something false. A cipher shows up without its mode or key length, so the CBOM looks weaker than the code really is.
• Frequency: medium. Aliasing is normal in C#: passing an object to a helper, storing it in a field, or using var x = y;.

Acceptance criteria

• A C# object used through a second variable keeps its property settings
• The repro file above produces AES-256-CBC
• A regression test is added that fails without the change
• The existing csharp module tests still pass

Notes

Related work:

• Problem with handling detections of sub-rules #8 — the original report
• fix: resolve intermediary variable detection in Java and Python engines #390 — fixes Java and Python. C# was left out on purpose, and that was the right call, because the approach does not carry over.
• [BUG] Go engine ignores the trace symbol, so detections mix up values from different variables #510 — the Go gap, which is a different problem again (no variable filtering at all)