Skip to content

Commit d0aa8f8

Browse files
michaelnebelmichaelnebel
authored
Merge pull request #22364 from michaelnebel/csharp/tspreportbadfeeds
C#: TSP note and compilation info for unreachable feeds.
2 parents 68f4039 + 9446394 commit d0aa8f8

18 files changed

Lines changed: 217 additions & 234 deletions

File tree

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs‎

Lines changed: 35 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -127,8 +127,8 @@ public HashSet<AssemblyLookupLocation> Restore()
127127
compilationInfoContainer.CompilationInfos.Add(("Inherited NuGet feed count", inheritedFeeds.Count.ToString()));
128128
}
129129

130-
var allExplicitReachable = explicitFeeds.Count == feedManager.ReachableExplicitFeeds.Count;
131-
EmitUnreachableFeedsDiagnostics(allExplicitReachable);
130+
var unreachableExplicitFeeds = explicitFeeds.Except(feedManager.ReachableExplicitFeeds).ToImmutableHashSet();
131+
EmitFeedReachabilityDiagnostics(unreachableExplicitFeeds);
132132
}
133133

134134
try
@@ -535,26 +535,51 @@ private void TryChangeProjectFile(DirectoryInfo projectDir, Regex pattern, strin
535535
}
536536
}
537537

538+
private string SanitizeFeedForLogging(string feed)
539+
{
540+
541+
try
542+
{
543+
// If the feed is a URL, log only the scheme, host, port, and absolute path to avoid logging sensitive information such as credentials or tokens.
544+
var uri = new Uri(feed);
545+
var port = uri.IsDefaultPort ? string.Empty : $":{uri.Port}";
546+
return $"{uri.Scheme}://{uri.Host}{port}{uri.AbsolutePath}";
547+
}
548+
catch
549+
{
550+
return feed;
551+
}
552+
}
553+
538554
/// <summary>
539-
/// If <paramref name="allFeedsReachable"/> is `false`, logs this and emits a diagnostic.
555+
/// If <paramref name="unreachableFeeds"/> is not empty, logs this and emits a diagnostic.
540556
/// Adds a `CompilationInfos` entry either way.
541557
/// </summary>
542-
/// <param name="allFeedsReachable">Whether all feeds were reachable or not.</param>
543-
private void EmitUnreachableFeedsDiagnostics(bool allFeedsReachable)
558+
/// <param name="unreachableFeeds">The feeds that were not reachable.</param>
559+
private void EmitFeedReachabilityDiagnostics(ImmutableHashSet<string> unreachableFeeds)
544560
{
545-
if (!allFeedsReachable)
561+
if (unreachableFeeds.Count > 0)
546562
{
547-
logger.LogWarning("Found unreachable NuGet feed in C# analysis with build-mode 'none'. This may cause missing dependencies in the analysis.");
563+
var orderedUnreachableFeeds = unreachableFeeds
564+
.Select(SanitizeFeedForLogging)
565+
.OrderBy(feed => feed)
566+
.ToList();
567+
var unreachableFeedList = string.Join(", ", orderedUnreachableFeeds);
568+
logger.LogWarning($"Found unreachable NuGet feeds in C# analysis with build-mode 'none': {unreachableFeedList}. This may cause missing dependencies in the analysis.");
569+
compilationInfoContainer.CompilationInfos.Add(("Unreachable NuGet feeds", unreachableFeedList));
548570
diagnosticsWriter.AddEntry(new DiagnosticMessage(
549571
Language.CSharp,
550572
"buildless/unreachable-feed",
551-
"Found unreachable NuGet feed in C# analysis with build-mode 'none'",
573+
"Found unreachable NuGet feeds in C# analysis with build-mode 'none'",
552574
visibility: new DiagnosticMessage.TspVisibility(statusPage: true, cliSummaryTable: true, telemetry: true),
553-
markdownMessage: "Found unreachable NuGet feed in C# analysis with build-mode 'none'. This may cause missing dependencies in the analysis.",
575+
markdownMessage: string.Format(
576+
"Found unreachable NuGet feeds in C# analysis with build-mode 'none':\n\n{0}\n\nThis may cause missing dependencies in the analysis.",
577+
string.Join("\n", orderedUnreachableFeeds.Select(feed => $"- `{feed}`"))
578+
),
554579
severity: DiagnosticMessage.TspSeverity.Note
555580
));
556581
}
557-
compilationInfoContainer.CompilationInfos.Add(("All NuGet feeds reachable", allFeedsReachable ? "1" : "0"));
582+
compilationInfoContainer.CompilationInfos.Add(("All NuGet feeds reachable", unreachableFeeds.Count == 0 ? "1" : "0"));
558583
}
559584

560585
private void EmitNugetConfigDiagnostics()

‎csharp/ql/integration-tests/all-platforms/standalone_resx/CompilationInfo.expected‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
1-
| All NuGet feeds reachable | 1.0 |
2-
| Failed project restore with missing package error | 0.0 |
3-
| Failed project restore with package source error | 0.0 |
4-
| Failed solution restore with missing package error | 0.0 |
5-
| Failed solution restore with package source error | 0.0 |
6-
| Inherited NuGet feed count | 1.0 |
7-
| NuGet feed responsiveness checked | 1.0 |
8-
| Project files on filesystem | 1.0 |
9-
| Reachable fallback NuGet feed count | 1.0 |
10-
| Resource extraction enabled | 1.0 |
11-
| Restored .NET framework variants | 1.0 |
12-
| Restored projects through solution files | 0.0 |
13-
| Solution files on filesystem | 0.0 |
14-
| Source files generated | 2.0 |
15-
| Source files on filesystem | 1.0 |
16-
| Successfully restored project files | 1.0 |
17-
| Successfully restored solution files | 0.0 |
18-
| Unresolved references | 0.0 |
19-
| UseWPF set | 0.0 |
20-
| UseWindowsForms set | 0.0 |
21-
| WebView extraction enabled | 1.0 |
1+
| All NuGet feeds reachable | 1 |
2+
| Failed project restore with missing package error | 0 |
3+
| Failed project restore with package source error | 0 |
4+
| Failed solution restore with missing package error | 0 |
5+
| Failed solution restore with package source error | 0 |
6+
| Inherited NuGet feed count | 1 |
7+
| NuGet feed responsiveness checked | 1 |
8+
| Project files on filesystem | 1 |
9+
| Reachable fallback NuGet feed count | 1 |
10+
| Resource extraction enabled | 1 |
11+
| Restored .NET framework variants | 1 |
12+
| Restored projects through solution files | 0 |
13+
| Solution files on filesystem | 0 |
14+
| Source files generated | 2 |
15+
| Source files on filesystem | 1 |
16+
| Successfully restored project files | 1 |
17+
| Successfully restored solution files | 0 |
18+
| Unresolved references | 0 |
19+
| UseWPF set | 0 |
20+
| UseWindowsForms set | 0 |
21+
| WebView extraction enabled | 1 |

‎csharp/ql/integration-tests/all-platforms/standalone_resx/CompilationInfo.ql‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,9 @@
11
import csharp
22
import semmle.code.csharp.commons.Diagnostics
33

4-
query predicate compilationInfo(string key, float value) {
4+
query predicate compilationInfo(string key, string value) {
55
key != "Resolved references" and
66
key != "Resolved assembly conflicts" and
77
not key.matches("Compiler diagnostic count for%") and
8-
exists(Compilation c, string infoKey, string infoValue | infoValue = c.getInfo(infoKey) |
9-
key = infoKey and
10-
value = infoValue.toFloat()
11-
or
12-
not exists(infoValue.toFloat()) and
13-
key = infoKey + ": " + infoValue and
14-
value = 1
15-
)
8+
value = any(Compilation c).getInfo(key)
169
}

‎csharp/ql/integration-tests/all-platforms/standalone_slnx/CompilationInfo.expected‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
1-
| All NuGet feeds reachable | 1.0 |
2-
| Failed project restore with missing package error | 0.0 |
3-
| Failed project restore with package source error | 0.0 |
4-
| Failed solution restore with missing package error | 0.0 |
5-
| Failed solution restore with package source error | 0.0 |
6-
| Inherited NuGet feed count | 1.0 |
7-
| NuGet feed responsiveness checked | 1.0 |
8-
| Project files on filesystem | 2.0 |
9-
| Reachable fallback NuGet feed count | 1.0 |
10-
| Resource extraction enabled | 0.0 |
11-
| Restored .NET framework variants | 1.0 |
12-
| Restored projects through solution files | 2.0 |
13-
| Solution files on filesystem | 1.0 |
14-
| Source files generated | 1.0 |
15-
| Source files on filesystem | 2.0 |
16-
| Successfully restored project files | 0.0 |
17-
| Successfully restored solution files | 1.0 |
18-
| Unresolved references | 0.0 |
19-
| UseWPF set | 0.0 |
20-
| UseWindowsForms set | 0.0 |
21-
| WebView extraction enabled | 1.0 |
1+
| All NuGet feeds reachable | 1 |
2+
| Failed project restore with missing package error | 0 |
3+
| Failed project restore with package source error | 0 |
4+
| Failed solution restore with missing package error | 0 |
5+
| Failed solution restore with package source error | 0 |
6+
| Inherited NuGet feed count | 1 |
7+
| NuGet feed responsiveness checked | 1 |
8+
| Project files on filesystem | 2 |
9+
| Reachable fallback NuGet feed count | 1 |
10+
| Resource extraction enabled | 0 |
11+
| Restored .NET framework variants | 1 |
12+
| Restored projects through solution files | 2 |
13+
| Solution files on filesystem | 1 |
14+
| Source files generated | 1 |
15+
| Source files on filesystem | 2 |
16+
| Successfully restored project files | 0 |
17+
| Successfully restored solution files | 1 |
18+
| Unresolved references | 0 |
19+
| UseWPF set | 0 |
20+
| UseWindowsForms set | 0 |
21+
| WebView extraction enabled | 1 |

‎csharp/ql/integration-tests/all-platforms/standalone_slnx/CompilationInfo.ql‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,9 @@
11
import csharp
22
import semmle.code.csharp.commons.Diagnostics
33

4-
query predicate compilationInfo(string key, float value) {
4+
query predicate compilationInfo(string key, string value) {
55
key != "Resolved references" and
66
key != "Resolved assembly conflicts" and
77
not key.matches(["Compiler diagnostic count for%", "Extractor message count for group%"]) and
8-
exists(Compilation c, string infoKey, string infoValue | infoValue = c.getInfo(infoKey) |
9-
key = infoKey and
10-
value = infoValue.toFloat()
11-
or
12-
not exists(infoValue.toFloat()) and
13-
key = infoKey + ": " + infoValue and
14-
value = 1
15-
)
8+
value = any(Compilation c).getInfo(key)
169
}

‎csharp/ql/integration-tests/all-platforms/standalone_winforms/CompilationInfo.expected‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
1-
| All NuGet feeds reachable | 1.0 |
2-
| Failed project restore with missing package error | 0.0 |
3-
| Failed project restore with package source error | 0.0 |
4-
| Failed solution restore with missing package error | 0.0 |
5-
| Failed solution restore with package source error | 0.0 |
6-
| Inherited NuGet feed count | 1.0 |
7-
| NuGet feed responsiveness checked | 1.0 |
8-
| Project files on filesystem | 1.0 |
9-
| Reachable fallback NuGet feed count | 1.0 |
10-
| Resource extraction enabled | 0.0 |
11-
| Restored .NET framework variants | 1.0 |
12-
| Restored projects through solution files | 0.0 |
13-
| Solution files on filesystem | 0.0 |
14-
| Source files generated | 1.0 |
15-
| Source files on filesystem | 3.0 |
16-
| Successfully restored project files | 1.0 |
17-
| Successfully restored solution files | 0.0 |
18-
| Unresolved references | 0.0 |
19-
| UseWPF set | 0.0 |
20-
| UseWindowsForms set | 1.0 |
21-
| WebView extraction enabled | 1.0 |
1+
| All NuGet feeds reachable | 1 |
2+
| Failed project restore with missing package error | 0 |
3+
| Failed project restore with package source error | 0 |
4+
| Failed solution restore with missing package error | 0 |
5+
| Failed solution restore with package source error | 0 |
6+
| Inherited NuGet feed count | 1 |
7+
| NuGet feed responsiveness checked | 1 |
8+
| Project files on filesystem | 1 |
9+
| Reachable fallback NuGet feed count | 1 |
10+
| Resource extraction enabled | 0 |
11+
| Restored .NET framework variants | 1 |
12+
| Restored projects through solution files | 0 |
13+
| Solution files on filesystem | 0 |
14+
| Source files generated | 1 |
15+
| Source files on filesystem | 3 |
16+
| Successfully restored project files | 1 |
17+
| Successfully restored solution files | 0 |
18+
| Unresolved references | 0 |
19+
| UseWPF set | 0 |
20+
| UseWindowsForms set | 1 |
21+
| WebView extraction enabled | 1 |

‎csharp/ql/integration-tests/all-platforms/standalone_winforms/CompilationInfo.ql‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,9 @@
11
import csharp
22
import semmle.code.csharp.commons.Diagnostics
33

4-
query predicate compilationInfo(string key, float value) {
4+
query predicate compilationInfo(string key, string value) {
55
key != "Resolved references" and
66
key != "Resolved assembly conflicts" and
77
not key.matches(["Compiler diagnostic count for%", "Extractor message count for group%"]) and
8-
exists(Compilation c, string infoKey, string infoValue | infoValue = c.getInfo(infoKey) |
9-
key = infoKey and
10-
value = infoValue.toFloat()
11-
or
12-
not exists(infoValue.toFloat()) and
13-
key = infoKey + ": " + infoValue and
14-
value = 1
15-
)
8+
value = any(Compilation c).getInfo(key)
169
}

‎csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/CompilationInfo.expected‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
1-
| All NuGet feeds reachable | 1.0 |
2-
| Failed project restore with missing package error | 0.0 |
3-
| Failed project restore with package source error | 0.0 |
4-
| Failed solution restore with missing package error | 0.0 |
5-
| Failed solution restore with package source error | 0.0 |
6-
| Inherited NuGet feed count | 1.0 |
7-
| NuGet feed responsiveness checked | 1.0 |
8-
| Project files on filesystem | 1.0 |
9-
| Reachable fallback NuGet feed count | 1.0 |
10-
| Resolved assembly conflicts | 0.0 |
11-
| Resource extraction enabled | 0.0 |
12-
| Restored .NET framework variants | 1.0 |
13-
| Restored projects through solution files | 0.0 |
14-
| Solution files on filesystem | 0.0 |
15-
| Source files generated | 0.0 |
16-
| Source files on filesystem | 1.0 |
17-
| Successfully restored project files | 1.0 |
18-
| Successfully restored solution files | 0.0 |
19-
| Unresolved references | 0.0 |
20-
| UseWPF set | 0.0 |
21-
| UseWindowsForms set | 0.0 |
22-
| WebView extraction enabled | 1.0 |
1+
| All NuGet feeds reachable | 1 |
2+
| Failed project restore with missing package error | 0 |
3+
| Failed project restore with package source error | 0 |
4+
| Failed solution restore with missing package error | 0 |
5+
| Failed solution restore with package source error | 0 |
6+
| Inherited NuGet feed count | 1 |
7+
| NuGet feed responsiveness checked | 1 |
8+
| Project files on filesystem | 1 |
9+
| Reachable fallback NuGet feed count | 1 |
10+
| Resolved assembly conflicts | 0 |
11+
| Resource extraction enabled | 0 |
12+
| Restored .NET framework variants | 1 |
13+
| Restored projects through solution files | 0 |
14+
| Solution files on filesystem | 0 |
15+
| Source files generated | 0 |
16+
| Source files on filesystem | 1 |
17+
| Successfully restored project files | 1 |
18+
| Successfully restored solution files | 0 |
19+
| Unresolved references | 0 |
20+
| UseWPF set | 0 |
21+
| UseWindowsForms set | 0 |
22+
| WebView extraction enabled | 1 |

‎csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/CompilationInfo.ql‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,8 @@
11
import csharp
22
import semmle.code.csharp.commons.Diagnostics
33

4-
query predicate compilationInfo(string key, float value) {
4+
query predicate compilationInfo(string key, string value) {
55
key != "Resolved references" and
66
not key.matches("Compiler diagnostic count for%") and
7-
exists(Compilation c, string infoKey, string infoValue | infoValue = c.getInfo(infoKey) |
8-
key = infoKey and
9-
value = infoValue.toFloat()
10-
or
11-
not exists(infoValue.toFloat()) and
12-
key = infoKey + ": " + infoValue and
13-
value = 1
14-
)
7+
value = any(Compilation c).getInfo(key)
158
}

‎csharp/ql/integration-tests/posix/standalone_dependencies_nuget_config_error/CompilationInfo.expected‎

Lines changed: 25 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,25 @@
1-
| All NuGet feeds reachable | 0.0 |
2-
| Failed project restore with missing package error | 1.0 |
3-
| Failed project restore with package source error | 0.0 |
4-
| Failed solution restore with missing package error | 0.0 |
5-
| Failed solution restore with package source error | 0.0 |
6-
| Fallback nuget restore | 1.0 |
7-
| Inherited NuGet feed count | 1.0 |
8-
| NuGet feed responsiveness checked | 1.0 |
9-
| Project files on filesystem | 1.0 |
10-
| Reachable fallback NuGet feed count | 1.0 |
11-
| Resolved assembly conflicts | 7.0 |
12-
| Resource extraction enabled | 0.0 |
13-
| Restored .NET framework variants | 0.0 |
14-
| Restored projects through solution files | 0.0 |
15-
| Solution files on filesystem | 1.0 |
16-
| Source files generated | 0.0 |
17-
| Source files on filesystem | 1.0 |
18-
| Successfully ran fallback nuget restore | 1.0 |
19-
| Successfully restored project files | 0.0 |
20-
| Successfully restored solution files | 1.0 |
21-
| Unresolved references | 0.0 |
22-
| UseWPF set | 0.0 |
23-
| UseWindowsForms set | 0.0 |
24-
| WebView extraction enabled | 1.0 |
1+
| All NuGet feeds reachable | 0 |
2+
| Failed project restore with missing package error | 1 |
3+
| Failed project restore with package source error | 0 |
4+
| Failed solution restore with missing package error | 0 |
5+
| Failed solution restore with package source error | 0 |
6+
| Fallback nuget restore | 1 |
7+
| Inherited NuGet feed count | 1 |
8+
| NuGet feed responsiveness checked | 1 |
9+
| Project files on filesystem | 1 |
10+
| Reachable fallback NuGet feed count | 1 |
11+
| Resolved assembly conflicts | 7 |
12+
| Resource extraction enabled | 0 |
13+
| Restored .NET framework variants | 0 |
14+
| Restored projects through solution files | 0 |
15+
| Solution files on filesystem | 1 |
16+
| Source files generated | 0 |
17+
| Source files on filesystem | 1 |
18+
| Successfully ran fallback nuget restore | 1 |
19+
| Successfully restored project files | 0 |
20+
| Successfully restored solution files | 1 |
21+
| Unreachable NuGet feeds | https://abc.abc/packages/ |
22+
| Unresolved references | 0 |
23+
| UseWPF set | 0 |
24+
| UseWindowsForms set | 0 |
25+
| WebView extraction enabled | 1 |

0 commit comments

Comments
 (0)