class Analyzer::CSharp::Cli

Overview

Surfaces the command-line attack surface of C# programs as cli:// endpoints: one endpoint per (sub)command with named options (param_type "flag"), positional arguments ("argument") and consumed environment variables ("env"). Covers Main(string[] args) / GetCommandLineArgs / GetEnvironmentVariable plus System.CommandLine, CommandLineParser, CliFx, Spectre.Console.Cli, McMaster.Extensions.CommandLineUtils and Cocona.

Line-scan analyzer (Go/Ruby/Rust CLI house style) merging endpoints by URL. Subclasses Analyzer directly (there is no C# engine) and reuses Common.csharp_test_path? to skip test files.

Included Modules

Defined in:

analyzer/analyzers/csharp/cli.cr

Constant Summary

ADD_ARG_RECV = /(\w+)\s*\.\s*AddArgument\s*\(\s*new\s+Argument(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/
ADD_COMMAND = /\.AddCommand(?:<[^>]+>)?\s*\(\s*@?"([^"]+)"/
ADD_OPTION_RECV = /(\w+)\s*\.\s*Add(?:Global)?Option\s*\(\s*new\s+Option(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/
ARGUMENT_ATTR = /\[\s*Argument\s*(?:\(([^\]]*)\))?\s*\]/

McMaster / Cocona: [Argument(0)] / [Argument(0, "name")] / bare [Argument] (Cocona lambda params). Body may hold an explicit quoted name; when absent we fall back to the annotated property or parameter name (same line or the line right below).

CLI_LIB_MARKERS = /System\.CommandLine|CliFx|Spectre\.Console\.Cli|McMaster\.Extensions\.CommandLineUtils/

Marker strings must not substring-match unrelated code: a bare "CommandLine" would also hit Environment.GetCommandLineArgs (or any comment), qualifying a web app as a framework CLI and leaking its env reads. CommandLineParser is matched via its using CommandLine / CommandLine.Parser namespace forms instead (same shape the cs_cli detector uses). Cocona is matched via its using Cocona / CoconaApp.* forms for the same reason ("Cocona" alone is specific enough as a substring, but we keep the same regex shape for consistency).

CLP_NAMESPACE = /\busing\s+CommandLine\b|\bCommandLine\.Parser\b|\bParser\.Default\.ParseArguments\b/
COCONA_NAMESPACE = /\busing\s+Cocona\b|\bCoconaApp\.(?:Create|Run)\b/
COMMAND_VAR = /(\w+)\s*=\s*new\s+Command\s*\(\s*@?"([^"]+)"/
GET_CMD_ARGS = /\bEnvironment\.GetCommandLineArgs\s*\(/
GET_ENV = /\bEnvironment\.GetEnvironmentVariable\s*\(\s*@?"([^"]+)"/

builtin.

MAIN_ARGS = /\bstatic\s+(?:async\s+)?(?:int|void|Task(?:<int>)?)\s+Main\s*\(\s*string\s*\[\s*\]\s+(\w+)\s*\)/
NEW_ARGUMENT = /\bnew\s+Argument(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/
NEW_COMMAND = /\bnew\s+Command\s*\(\s*@?"([^"]+)"/
NEW_OPTION = /\bnew\s+Option(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/
OPTION_ATTR = /\[\s*(?:Option|CommandOption)\s*(?:\(([^\]]*)\))?\s*\]/

Parenthesized body is optional so a bare [Option] (McMaster/Cocona, name taken from the annotated member) is matched too.

PARAM_ATTR = /\[\s*CommandParameter\s*\(([^\]]*)\)/
PROPERTY_NEXTLINE = /\A\s*(?:public\s+)?\S+\s+(\w+)\s*[{;,)]/
PROPERTY_TRAILING = /\A\s*\]?\s*(?:public\s+)?\S+\s+(\w+)/

Trailing "type name" right after a matched attribute's tail (an optional leftover "]" is skipped first since Option/Argument attr regexes above don't always consume it).

ROOT_COMMAND = /\bnew\s+RootCommand\b/

System.CommandLine (builder). Variable-mapped: a command/option binds to its receiver variable, so root options declared after a subcommand aren't mis-attributed to the subcommand.

ROOT_VAR = /(\w+)\s*=\s*new\s+RootCommand\b/
VERB_ATTR = /\[\s*(?:Verb|Command)\s*\(\s*@?"([^"]+)"/

Attribute-driven libs (CommandLineParser / CliFx / Spectre / airline-ish / McMaster.Extensions.CommandLineUtils / Cocona).

WEB_HOST_RE = /\bWebApplication\.(?:Create(?:Builder|SlimBuilder|EmptyBuilder)?|CreateDefault)\b|\bnew\s+HttpListener\b|\.MapGet\s*\(|\.MapControllers\s*\(|\[\s*ApiController\s*\]|:\s*ControllerBase\b|\bHost\.CreateDefaultBuilder\b/

Class Method Summary

Instance Method Summary

Class methods inherited from module Analyzer::CSharp::Common

aspnet_core_source?(content : String) : Bool aspnet_core_source?, aspnet_framework_source?(content : String) : Bool aspnet_framework_source?, carter_module_source?(content : String) : Bool carter_module_source?, csharp_service_type?(type_name : String) : Bool csharp_service_type?, csharp_test_path?(relative_path : String) : Bool csharp_test_path?, explicit_binding_name(param_def : String) : String | Nil explicit_binding_name, project_root_for(path : String, roots : Array(String)) : String | Nil project_root_for, project_roots(csproj_paths : Array(String)) : Array(String) project_roots, route_placeholder_name(raw : String) : String route_placeholder_name

Instance methods inherited from class Analyzer

analyze analyze, base_path : String base_path, base_paths : Array(String) base_paths, base_relative_path(path : String) : String base_relative_path, callees_needed? : Bool callees_needed?, content_matches?(content : String, markers : Regex) : Bool content_matches?, http_header_name(name : String) : String | Nil http_header_name, line_number_for_index(content : String, char_index : Int32) : Int32 line_number_for_index, logger : NoirLogger logger, parallel_analyze(files : Array(String), &block : String -> Nil) parallel_analyze, read_file_content(path : String) : String read_file_content, result : Array(Endpoint) result, tech : String tech, unique_params(params : Array(Param)) : Array(Param) unique_params, url : String url, web_root_path(path : String, markers : Array(String)) : String web_root_path

Constructor methods inherited from class Analyzer

new(options : Hash(String, YAML::Any)) new

Macros inherited from class Analyzer

analyzer_for(tech) analyzer_for

Instance methods inherited from module FileHelper

all_files : Array(String) all_files, get_files_by_basename(basename : String) : Array(String) get_files_by_basename, get_files_by_extension(extension : String) : Array(String) get_files_by_extension, get_files_by_extensions(extensions : Array(String)) : Array(String) get_files_by_extensions, get_files_by_prefix(prefix : String) : Array(String) get_files_by_prefix, get_files_by_prefix_and_extension(prefix : String, extension : String) : Array(String) get_files_by_prefix_and_extension, get_files_by_relative_path(relative_path : String, root : String = "") : Array(String) get_files_by_relative_path, get_public_dir_files(base_path : String, folder : String) : Array(String) get_public_dir_files, get_public_files(base_path : String, anchors : Array(String) = ["shard.yml", "Gemfile"]) : Array(String) get_public_files, walked_path(expanded : String) : String walked_path

Class Method Detail

def self.tech_name : String #

[View source]

Instance Method Detail

def analyze #

[View source]
def tech : String #

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.


[View source]