| | | 1 | | using System.Collections.Immutable; |
| | | 2 | | using Microsoft.CodeAnalysis; |
| | | 3 | | using Microsoft.CodeAnalysis.Diagnostics; |
| | | 4 | | using Microsoft.CodeAnalysis.Operations; |
| | | 5 | | |
| | | 6 | | namespace AsiBackbone.Analyzers; |
| | | 7 | | |
| | | 8 | | [DiagnosticAnalyzer(LanguageNames.CSharp)] |
| | | 9 | | public sealed class LocalDevelopmentSigningProductionAnalyzer : DiagnosticAnalyzer |
| | | 10 | | { |
| | | 11 | | public const string DiagnosticId = "ASIB002"; |
| | | 12 | | |
| | | 13 | | /// <summary> |
| | | 14 | | /// Reports local-development signing wired with no environment guard at all. |
| | | 15 | | /// </summary> |
| | | 16 | | public const string UnguardedDiagnosticId = "ASIB003"; |
| | | 17 | | |
| | | 18 | | private const string LocalDevelopmentNamespace = "AsiBackbone.Signing.LocalDevelopment"; |
| | | 19 | | |
| | 1 | 20 | | private static readonly DiagnosticDescriptor Rule = new( |
| | 1 | 21 | | DiagnosticId, |
| | 1 | 22 | | "Do not wire local-development signing in production branches", |
| | 1 | 23 | | "Local-development signing type '{0}' is used inside a production environment branch; use a host-owned productio |
| | 1 | 24 | | "AsiBackbone.ProductionSafety", |
| | 1 | 25 | | DiagnosticSeverity.Warning, |
| | 1 | 26 | | isEnabledByDefault: true, |
| | 1 | 27 | | description: "LocalDevelopment signing providers generate in-process keys for tests, samples, and local proof pa |
| | | 28 | | |
| | | 29 | | /// <remarks> |
| | | 30 | | /// <see cref="Rule" /> only fires on a call the analyzer can see inside a production branch, so an unconditional |
| | | 31 | | /// registration — the shape that actually reaches production — was never reported. The runtime guard in |
| | | 32 | | /// <c>UseLocalDevelopmentSigning</c> throws in Production; this rule surfaces the same problem at build time. |
| | | 33 | | /// </remarks> |
| | 1 | 34 | | private static readonly DiagnosticDescriptor UnguardedRule = new( |
| | 1 | 35 | | UnguardedDiagnosticId, |
| | 1 | 36 | | "Guard local-development signing by environment", |
| | 1 | 37 | | "Local-development signing type '{0}' is wired without an environment guard; it will be registered in whichever |
| | 1 | 38 | | "AsiBackbone.ProductionSafety", |
| | 1 | 39 | | DiagnosticSeverity.Warning, |
| | 1 | 40 | | isEnabledByDefault: true, |
| | 1 | 41 | | description: "LocalDevelopment signing providers generate an in-process key that is never persisted, so artifact |
| | | 42 | | |
| | 9 | 43 | | public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => [Rule, UnguardedRule]; |
| | | 44 | | |
| | | 45 | | public override void Initialize(AnalysisContext context) |
| | | 46 | | { |
| | 9 | 47 | | context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None); |
| | 9 | 48 | | context.EnableConcurrentExecution(); |
| | 9 | 49 | | context.RegisterOperationAction(AnalyzeInvocation, OperationKind.Invocation); |
| | 9 | 50 | | context.RegisterOperationAction(AnalyzeObjectCreation, OperationKind.ObjectCreation); |
| | 9 | 51 | | } |
| | | 52 | | |
| | | 53 | | private static void AnalyzeInvocation(OperationAnalysisContext context) |
| | | 54 | | { |
| | 15 | 55 | | var invocation = (IInvocationOperation)context.Operation; |
| | | 56 | | |
| | 15 | 57 | | if (IsSuppressedByHostMarker(context.ContainingSymbol) |
| | 15 | 58 | | || IsNestedInsideInvocationThatAlreadyReferencesLocalDevelopment(invocation)) |
| | | 59 | | { |
| | 4 | 60 | | return; |
| | | 61 | | } |
| | | 62 | | |
| | 11 | 63 | | bool insideProductionBranch = IsInsideProductionBranch(invocation); |
| | | 64 | | |
| | 11 | 65 | | if (!insideProductionBranch && IsInsideEnvironmentConditional(invocation)) |
| | | 66 | | { |
| | 4 | 67 | | return; |
| | | 68 | | } |
| | | 69 | | |
| | 7 | 70 | | ITypeSymbol? localDevelopmentType = FindReferencedLocalDevelopmentType(invocation); |
| | 7 | 71 | | if (localDevelopmentType is null) |
| | | 72 | | { |
| | 3 | 73 | | return; |
| | | 74 | | } |
| | | 75 | | |
| | 4 | 76 | | context.ReportDiagnostic( |
| | 4 | 77 | | Diagnostic.Create( |
| | 4 | 78 | | insideProductionBranch ? Rule : UnguardedRule, |
| | 4 | 79 | | invocation.Syntax.GetLocation(), |
| | 4 | 80 | | localDevelopmentType.ToDisplayString(SymbolDisplayFormat.CSharpErrorMessageFormat))); |
| | 4 | 81 | | } |
| | | 82 | | |
| | | 83 | | private static void AnalyzeObjectCreation(OperationAnalysisContext context) |
| | | 84 | | { |
| | 21 | 85 | | var objectCreation = (IObjectCreationOperation)context.Operation; |
| | | 86 | | |
| | 21 | 87 | | if (IsSuppressedByHostMarker(context.ContainingSymbol) || !IsInsideProductionBranch(objectCreation)) |
| | | 88 | | { |
| | 20 | 89 | | return; |
| | | 90 | | } |
| | | 91 | | |
| | 1 | 92 | | ITypeSymbol? localDevelopmentType = FindLocalDevelopmentType(objectCreation.Type); |
| | 1 | 93 | | if (localDevelopmentType is null) |
| | | 94 | | { |
| | 0 | 95 | | return; |
| | | 96 | | } |
| | | 97 | | |
| | 1 | 98 | | context.ReportDiagnostic( |
| | 1 | 99 | | Diagnostic.Create( |
| | 1 | 100 | | Rule, |
| | 1 | 101 | | objectCreation.Syntax.GetLocation(), |
| | 1 | 102 | | localDevelopmentType.ToDisplayString(SymbolDisplayFormat.CSharpErrorMessageFormat))); |
| | 1 | 103 | | } |
| | | 104 | | |
| | | 105 | | private static bool IsNestedInsideInvocationThatAlreadyReferencesLocalDevelopment(IInvocationOperation invocation) |
| | | 106 | | { |
| | 12 | 107 | | return invocation.Parent is IArgumentOperation { Parent: IInvocationOperation parentInvocation } |
| | 12 | 108 | | && FindReferencedLocalDevelopmentType(parentInvocation) is not null; |
| | | 109 | | } |
| | | 110 | | |
| | | 111 | | private static ITypeSymbol? FindReferencedLocalDevelopmentType(IInvocationOperation invocation) |
| | | 112 | | { |
| | 8 | 113 | | ITypeSymbol? containingType = FindLocalDevelopmentType(invocation.TargetMethod.ContainingType); |
| | 8 | 114 | | if (containingType is not null) |
| | | 115 | | { |
| | 0 | 116 | | return containingType; |
| | | 117 | | } |
| | | 118 | | |
| | 21 | 119 | | foreach (ITypeSymbol typeArgument in invocation.TargetMethod.TypeArguments) |
| | | 120 | | { |
| | 5 | 121 | | ITypeSymbol? localDevelopmentType = FindLocalDevelopmentType(typeArgument); |
| | 5 | 122 | | if (localDevelopmentType is not null) |
| | | 123 | | { |
| | 5 | 124 | | return localDevelopmentType; |
| | | 125 | | } |
| | | 126 | | } |
| | | 127 | | |
| | 12 | 128 | | foreach (IArgumentOperation argument in invocation.Arguments) |
| | | 129 | | { |
| | 3 | 130 | | ITypeSymbol? localDevelopmentType = FindLocalDevelopmentType(argument.Value.Type); |
| | 3 | 131 | | if (localDevelopmentType is not null) |
| | | 132 | | { |
| | 0 | 133 | | return localDevelopmentType; |
| | | 134 | | } |
| | | 135 | | } |
| | | 136 | | |
| | 3 | 137 | | return FindLocalDevelopmentType(invocation.Type); |
| | | 138 | | } |
| | | 139 | | |
| | | 140 | | private static ITypeSymbol? FindLocalDevelopmentType(ITypeSymbol? type) |
| | | 141 | | { |
| | 20 | 142 | | if (type is null) |
| | | 143 | | { |
| | 0 | 144 | | return null; |
| | | 145 | | } |
| | | 146 | | |
| | 20 | 147 | | if (type is INamedTypeSymbol namedType && namedType.IsGenericType) |
| | | 148 | | { |
| | 0 | 149 | | foreach (ITypeSymbol typeArgument in namedType.TypeArguments) |
| | | 150 | | { |
| | 0 | 151 | | ITypeSymbol? localDevelopmentType = FindLocalDevelopmentType(typeArgument); |
| | 0 | 152 | | if (localDevelopmentType is not null) |
| | | 153 | | { |
| | 0 | 154 | | return localDevelopmentType; |
| | | 155 | | } |
| | | 156 | | } |
| | | 157 | | } |
| | | 158 | | |
| | 20 | 159 | | string namespaceName = type.ContainingNamespace?.ToDisplayString(SymbolDisplayFormat.CSharpErrorMessageFormat) ? |
| | 20 | 160 | | return namespaceName.Equals(LocalDevelopmentNamespace, StringComparison.Ordinal) |
| | 20 | 161 | | ? type |
| | 20 | 162 | | : null; |
| | | 163 | | } |
| | | 164 | | |
| | | 165 | | private static bool IsInsideProductionBranch(IOperation operation) |
| | | 166 | | { |
| | 206 | 167 | | for (IOperation? current = operation.Parent; current is not null; current = current.Parent) |
| | | 168 | | { |
| | 80 | 169 | | if (current is IConditionalOperation conditionalOperation |
| | 80 | 170 | | && IsProductionLikeCondition(conditionalOperation.Condition)) |
| | | 171 | | { |
| | 7 | 172 | | return true; |
| | | 173 | | } |
| | | 174 | | } |
| | | 175 | | |
| | 23 | 176 | | return false; |
| | | 177 | | } |
| | | 178 | | |
| | | 179 | | /// <summary> |
| | | 180 | | /// Determines whether the operation sits inside any conditional that tests the host environment. |
| | | 181 | | /// </summary> |
| | | 182 | | /// <remarks> |
| | | 183 | | /// A registration guarded by an environment check — for either the production or the non-production side — is a |
| | | 184 | | /// deliberate choice the host has already made. Only registrations with no environment check at all are reported by |
| | | 185 | | /// <see cref="UnguardedRule" />. |
| | | 186 | | /// </remarks> |
| | | 187 | | private static bool IsInsideEnvironmentConditional(IOperation operation) |
| | | 188 | | { |
| | 24 | 189 | | for (IOperation? current = operation.Parent; current is not null; current = current.Parent) |
| | | 190 | | { |
| | 11 | 191 | | if (current is IConditionalOperation conditionalOperation |
| | 11 | 192 | | && ConditionReferencesEnvironment(conditionalOperation.Condition)) |
| | | 193 | | { |
| | 4 | 194 | | return true; |
| | | 195 | | } |
| | | 196 | | } |
| | | 197 | | |
| | 1 | 198 | | return false; |
| | | 199 | | } |
| | | 200 | | |
| | | 201 | | private static bool ConditionReferencesEnvironment(IOperation operation) |
| | | 202 | | { |
| | 4 | 203 | | operation = Unwrap(operation); |
| | | 204 | | |
| | 4 | 205 | | if (IsEnvironmentNameReference(operation)) |
| | | 206 | | { |
| | 0 | 207 | | return true; |
| | | 208 | | } |
| | | 209 | | |
| | | 210 | | switch (operation) |
| | | 211 | | { |
| | | 212 | | case IInvocationOperation invocationOperation: |
| | 4 | 213 | | IMethodSymbol method = invocationOperation.TargetMethod.ReducedFrom ?? invocationOperation.TargetMethod; |
| | 4 | 214 | | string namespaceName = method.ContainingNamespace?.ToDisplayString(SymbolDisplayFormat.CSharpErrorMessag |
| | | 215 | | |
| | 4 | 216 | | return namespaceName.Equals("Microsoft.Extensions.Hosting", StringComparison.Ordinal) |
| | 4 | 217 | | || InvocationComparesEnvironmentNameToProduction(invocationOperation) |
| | 4 | 218 | | || IsEnvironmentNameReference(invocationOperation.Instance); |
| | | 219 | | |
| | | 220 | | case IBinaryOperation binaryOperation: |
| | 0 | 221 | | return ConditionReferencesEnvironment(binaryOperation.LeftOperand) |
| | 0 | 222 | | || ConditionReferencesEnvironment(binaryOperation.RightOperand); |
| | | 223 | | |
| | | 224 | | case IUnaryOperation unaryOperation: |
| | 0 | 225 | | return ConditionReferencesEnvironment(unaryOperation.Operand); |
| | | 226 | | |
| | | 227 | | case IPropertyReferenceOperation propertyReference: |
| | 0 | 228 | | return propertyReference.Property.Name.Contains("Environment", StringComparison.Ordinal); |
| | | 229 | | |
| | | 230 | | default: |
| | 0 | 231 | | return false; |
| | | 232 | | } |
| | | 233 | | } |
| | | 234 | | |
| | | 235 | | private static bool IsProductionLikeCondition(IOperation operation) |
| | | 236 | | { |
| | 11 | 237 | | operation = Unwrap(operation); |
| | | 238 | | |
| | 11 | 239 | | return operation switch |
| | 11 | 240 | | { |
| | 10 | 241 | | IInvocationOperation invocationOperation => IsProductionInvocation(invocationOperation) |
| | 10 | 242 | | || InvocationComparesEnvironmentNameToProduction(invocationOperation), |
| | 1 | 243 | | IBinaryOperation binaryOperation => BinaryComparesEnvironmentNameToProduction(binaryOperation), |
| | 0 | 244 | | _ => false |
| | 11 | 245 | | }; |
| | | 246 | | } |
| | | 247 | | |
| | | 248 | | private static bool IsProductionInvocation(IInvocationOperation invocation) |
| | | 249 | | { |
| | 10 | 250 | | IMethodSymbol method = invocation.TargetMethod.ReducedFrom ?? invocation.TargetMethod; |
| | 10 | 251 | | string namespaceName = method.ContainingNamespace?.ToDisplayString(SymbolDisplayFormat.CSharpErrorMessageFormat) |
| | | 252 | | |
| | 10 | 253 | | return method.Name.Equals("IsProduction", StringComparison.Ordinal) |
| | 10 | 254 | | && namespaceName.Equals("Microsoft.Extensions.Hosting", StringComparison.Ordinal); |
| | | 255 | | } |
| | | 256 | | |
| | | 257 | | private static bool InvocationComparesEnvironmentNameToProduction(IInvocationOperation invocation) |
| | | 258 | | { |
| | 4 | 259 | | if (!invocation.TargetMethod.Name.Equals("Equals", StringComparison.Ordinal)) |
| | | 260 | | { |
| | 4 | 261 | | return false; |
| | | 262 | | } |
| | | 263 | | |
| | 0 | 264 | | bool hasEnvironmentName = IsEnvironmentNameReference(invocation.Instance); |
| | 0 | 265 | | bool hasProductionConstant = false; |
| | | 266 | | |
| | 0 | 267 | | foreach (IArgumentOperation argument in invocation.Arguments) |
| | | 268 | | { |
| | 0 | 269 | | IOperation value = Unwrap(argument.Value); |
| | 0 | 270 | | hasEnvironmentName = hasEnvironmentName || IsEnvironmentNameReference(value); |
| | 0 | 271 | | hasProductionConstant = hasProductionConstant || IsProductionConstant(value); |
| | | 272 | | } |
| | | 273 | | |
| | 0 | 274 | | return hasEnvironmentName && hasProductionConstant; |
| | | 275 | | } |
| | | 276 | | |
| | | 277 | | private static bool BinaryComparesEnvironmentNameToProduction(IBinaryOperation binaryOperation) |
| | | 278 | | { |
| | 1 | 279 | | if (binaryOperation.OperatorKind != BinaryOperatorKind.Equals) |
| | | 280 | | { |
| | 0 | 281 | | return false; |
| | | 282 | | } |
| | | 283 | | |
| | 1 | 284 | | IOperation left = Unwrap(binaryOperation.LeftOperand); |
| | 1 | 285 | | IOperation right = Unwrap(binaryOperation.RightOperand); |
| | | 286 | | |
| | 1 | 287 | | return (IsEnvironmentNameReference(left) && IsProductionConstant(right)) |
| | 1 | 288 | | || (IsEnvironmentNameReference(right) && IsProductionConstant(left)); |
| | | 289 | | } |
| | | 290 | | |
| | | 291 | | private static bool IsEnvironmentNameReference(IOperation? operation) |
| | | 292 | | { |
| | 5 | 293 | | operation = operation is null ? null : Unwrap(operation); |
| | | 294 | | |
| | 5 | 295 | | return operation is IPropertyReferenceOperation propertyReference |
| | 5 | 296 | | && propertyReference.Property.Name.Equals("EnvironmentName", StringComparison.Ordinal); |
| | | 297 | | } |
| | | 298 | | |
| | | 299 | | private static bool IsProductionConstant(IOperation operation) |
| | | 300 | | { |
| | 1 | 301 | | return operation.ConstantValue.HasValue |
| | 1 | 302 | | && operation.ConstantValue.Value is string value |
| | 1 | 303 | | && value.Equals("Production", StringComparison.OrdinalIgnoreCase); |
| | | 304 | | } |
| | | 305 | | |
| | | 306 | | private static IOperation Unwrap(IOperation operation) |
| | | 307 | | { |
| | 22 | 308 | | while (operation is IConversionOperation conversionOperation) |
| | | 309 | | { |
| | 0 | 310 | | operation = conversionOperation.Operand; |
| | 0 | 311 | | } |
| | | 312 | | |
| | 22 | 313 | | return operation; |
| | | 314 | | } |
| | | 315 | | |
| | | 316 | | private static bool IsSuppressedByHostMarker(ISymbol? symbol) |
| | | 317 | | { |
| | 116 | 318 | | for (ISymbol? current = symbol; current is not null; current = current.ContainingSymbol) |
| | | 319 | | { |
| | 139 | 320 | | foreach (AttributeData attribute in current.GetAttributes()) |
| | | 321 | | { |
| | 14 | 322 | | string? attributeName = attribute.AttributeClass?.Name; |
| | 14 | 323 | | if (attributeName is "AsiBackboneProductionConfigurationReviewed" or "AsiBackboneProductionConfiguration |
| | | 324 | | { |
| | 5 | 325 | | return true; |
| | | 326 | | } |
| | | 327 | | } |
| | | 328 | | |
| | 53 | 329 | | if (current is INamedTypeSymbol) |
| | | 330 | | { |
| | | 331 | | break; |
| | | 332 | | } |
| | | 333 | | } |
| | | 334 | | |
| | 31 | 335 | | return false; |
| | | 336 | | } |
| | | 337 | | } |