| | | 1 | | using System.Collections.Immutable; |
| | | 2 | | using Microsoft.CodeAnalysis; |
| | | 3 | | using Microsoft.CodeAnalysis.Diagnostics; |
| | | 4 | | using Microsoft.CodeAnalysis.Operations; |
| | | 5 | | |
| | | 6 | | namespace AsiBackbone.Analyzers; |
| | | 7 | | |
| | | 8 | | [DiagnosticAnalyzer(LanguageNames.CSharp)] |
| | | 9 | | public sealed class LocalDevelopmentSigningProductionAnalyzer : DiagnosticAnalyzer |
| | | 10 | | { |
| | | 11 | | public const string DiagnosticId = "ASIB002"; |
| | | 12 | | |
| | | 13 | | private const string LocalDevelopmentNamespace = "AsiBackbone.Signing.LocalDevelopment"; |
| | | 14 | | |
| | 2 | 15 | | private static readonly DiagnosticDescriptor Rule = new( |
| | 2 | 16 | | DiagnosticId, |
| | 2 | 17 | | "Do not wire local-development signing in production branches", |
| | 2 | 18 | | "Local-development signing type '{0}' is used inside a production environment branch; use a host-owned productio |
| | 2 | 19 | | "AsiBackbone.ProductionSafety", |
| | 2 | 20 | | DiagnosticSeverity.Warning, |
| | 2 | 21 | | isEnabledByDefault: true, |
| | 2 | 22 | | description: "LocalDevelopment signing providers generate in-process keys for tests, samples, and local proof pa |
| | | 23 | | |
| | 12 | 24 | | public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => [Rule]; |
| | | 25 | | |
| | | 26 | | public override void Initialize(AnalysisContext context) |
| | | 27 | | { |
| | 12 | 28 | | context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None); |
| | 12 | 29 | | context.EnableConcurrentExecution(); |
| | 12 | 30 | | context.RegisterOperationAction(AnalyzeInvocation, OperationKind.Invocation); |
| | 12 | 31 | | context.RegisterOperationAction(AnalyzeObjectCreation, OperationKind.ObjectCreation); |
| | 12 | 32 | | } |
| | | 33 | | |
| | | 34 | | private static void AnalyzeInvocation(OperationAnalysisContext context) |
| | | 35 | | { |
| | 22 | 36 | | var invocation = (IInvocationOperation)context.Operation; |
| | | 37 | | |
| | 22 | 38 | | if (IsSuppressedByHostMarker(context.ContainingSymbol) |
| | 22 | 39 | | || !IsInsideProductionBranch(invocation) |
| | 22 | 40 | | || IsNestedInsideInvocationThatAlreadyReferencesLocalDevelopment(invocation)) |
| | | 41 | | { |
| | 10 | 42 | | return; |
| | | 43 | | } |
| | | 44 | | |
| | 12 | 45 | | ITypeSymbol? localDevelopmentType = FindReferencedLocalDevelopmentType(invocation); |
| | 12 | 46 | | if (localDevelopmentType is null) |
| | | 47 | | { |
| | 6 | 48 | | return; |
| | | 49 | | } |
| | | 50 | | |
| | 6 | 51 | | context.ReportDiagnostic( |
| | 6 | 52 | | Diagnostic.Create( |
| | 6 | 53 | | Rule, |
| | 6 | 54 | | invocation.Syntax.GetLocation(), |
| | 6 | 55 | | localDevelopmentType.ToDisplayString(SymbolDisplayFormat.CSharpErrorMessageFormat))); |
| | 6 | 56 | | } |
| | | 57 | | |
| | | 58 | | private static void AnalyzeObjectCreation(OperationAnalysisContext context) |
| | | 59 | | { |
| | 28 | 60 | | var objectCreation = (IObjectCreationOperation)context.Operation; |
| | | 61 | | |
| | 28 | 62 | | if (IsSuppressedByHostMarker(context.ContainingSymbol) || !IsInsideProductionBranch(objectCreation)) |
| | | 63 | | { |
| | 26 | 64 | | return; |
| | | 65 | | } |
| | | 66 | | |
| | 2 | 67 | | ITypeSymbol? localDevelopmentType = FindLocalDevelopmentType(objectCreation.Type); |
| | 2 | 68 | | if (localDevelopmentType is null) |
| | | 69 | | { |
| | 0 | 70 | | return; |
| | | 71 | | } |
| | | 72 | | |
| | 2 | 73 | | context.ReportDiagnostic( |
| | 2 | 74 | | Diagnostic.Create( |
| | 2 | 75 | | Rule, |
| | 2 | 76 | | objectCreation.Syntax.GetLocation(), |
| | 2 | 77 | | localDevelopmentType.ToDisplayString(SymbolDisplayFormat.CSharpErrorMessageFormat))); |
| | 2 | 78 | | } |
| | | 79 | | |
| | | 80 | | private static bool IsNestedInsideInvocationThatAlreadyReferencesLocalDevelopment(IInvocationOperation invocation) |
| | | 81 | | { |
| | 14 | 82 | | return invocation.Parent is IArgumentOperation { Parent: IInvocationOperation parentInvocation } |
| | 14 | 83 | | && FindReferencedLocalDevelopmentType(parentInvocation) is not null; |
| | | 84 | | } |
| | | 85 | | |
| | | 86 | | private static ITypeSymbol? FindReferencedLocalDevelopmentType(IInvocationOperation invocation) |
| | | 87 | | { |
| | 14 | 88 | | ITypeSymbol? containingType = FindLocalDevelopmentType(invocation.TargetMethod.ContainingType); |
| | 14 | 89 | | if (containingType is not null) |
| | | 90 | | { |
| | 0 | 91 | | return containingType; |
| | | 92 | | } |
| | | 93 | | |
| | 36 | 94 | | foreach (ITypeSymbol typeArgument in invocation.TargetMethod.TypeArguments) |
| | | 95 | | { |
| | 8 | 96 | | ITypeSymbol? localDevelopmentType = FindLocalDevelopmentType(typeArgument); |
| | 8 | 97 | | if (localDevelopmentType is not null) |
| | | 98 | | { |
| | 8 | 99 | | return localDevelopmentType; |
| | | 100 | | } |
| | | 101 | | } |
| | | 102 | | |
| | 24 | 103 | | foreach (IArgumentOperation argument in invocation.Arguments) |
| | | 104 | | { |
| | 6 | 105 | | ITypeSymbol? localDevelopmentType = FindLocalDevelopmentType(argument.Value.Type); |
| | 6 | 106 | | if (localDevelopmentType is not null) |
| | | 107 | | { |
| | 0 | 108 | | return localDevelopmentType; |
| | | 109 | | } |
| | | 110 | | } |
| | | 111 | | |
| | 6 | 112 | | return FindLocalDevelopmentType(invocation.Type); |
| | | 113 | | } |
| | | 114 | | |
| | | 115 | | private static ITypeSymbol? FindLocalDevelopmentType(ITypeSymbol? type) |
| | | 116 | | { |
| | 36 | 117 | | if (type is null) |
| | | 118 | | { |
| | 0 | 119 | | return null; |
| | | 120 | | } |
| | | 121 | | |
| | 36 | 122 | | if (type is INamedTypeSymbol namedType && namedType.IsGenericType) |
| | | 123 | | { |
| | 0 | 124 | | foreach (ITypeSymbol typeArgument in namedType.TypeArguments) |
| | | 125 | | { |
| | 0 | 126 | | ITypeSymbol? localDevelopmentType = FindLocalDevelopmentType(typeArgument); |
| | 0 | 127 | | if (localDevelopmentType is not null) |
| | | 128 | | { |
| | 0 | 129 | | return localDevelopmentType; |
| | | 130 | | } |
| | | 131 | | } |
| | | 132 | | } |
| | | 133 | | |
| | 36 | 134 | | string namespaceName = type.ContainingNamespace?.ToDisplayString(SymbolDisplayFormat.CSharpErrorMessageFormat) ? |
| | 36 | 135 | | return namespaceName.Equals(LocalDevelopmentNamespace, StringComparison.Ordinal) |
| | 36 | 136 | | ? type |
| | 36 | 137 | | : null; |
| | | 138 | | } |
| | | 139 | | |
| | | 140 | | private static bool IsInsideProductionBranch(IOperation operation) |
| | | 141 | | { |
| | 292 | 142 | | for (IOperation? current = operation.Parent; current is not null; current = current.Parent) |
| | | 143 | | { |
| | 118 | 144 | | if (current is IConditionalOperation conditionalOperation |
| | 118 | 145 | | && IsProductionLikeCondition(conditionalOperation.Condition)) |
| | | 146 | | { |
| | 16 | 147 | | return true; |
| | | 148 | | } |
| | | 149 | | } |
| | | 150 | | |
| | 28 | 151 | | return false; |
| | | 152 | | } |
| | | 153 | | |
| | | 154 | | private static bool IsProductionLikeCondition(IOperation operation) |
| | | 155 | | { |
| | 20 | 156 | | operation = Unwrap(operation); |
| | | 157 | | |
| | 20 | 158 | | return operation switch |
| | 20 | 159 | | { |
| | 18 | 160 | | IInvocationOperation invocationOperation => IsProductionInvocation(invocationOperation) |
| | 18 | 161 | | || InvocationComparesEnvironmentNameToProduction(invocationOperation), |
| | 2 | 162 | | IBinaryOperation binaryOperation => BinaryComparesEnvironmentNameToProduction(binaryOperation), |
| | 0 | 163 | | _ => false |
| | 20 | 164 | | }; |
| | | 165 | | } |
| | | 166 | | |
| | | 167 | | private static bool IsProductionInvocation(IInvocationOperation invocation) |
| | | 168 | | { |
| | 18 | 169 | | IMethodSymbol method = invocation.TargetMethod.ReducedFrom ?? invocation.TargetMethod; |
| | 18 | 170 | | string namespaceName = method.ContainingNamespace?.ToDisplayString(SymbolDisplayFormat.CSharpErrorMessageFormat) |
| | | 171 | | |
| | 18 | 172 | | return method.Name.Equals("IsProduction", StringComparison.Ordinal) |
| | 18 | 173 | | && namespaceName.Equals("Microsoft.Extensions.Hosting", StringComparison.Ordinal); |
| | | 174 | | } |
| | | 175 | | |
| | | 176 | | private static bool InvocationComparesEnvironmentNameToProduction(IInvocationOperation invocation) |
| | | 177 | | { |
| | 4 | 178 | | if (!invocation.TargetMethod.Name.Equals("Equals", StringComparison.Ordinal)) |
| | | 179 | | { |
| | 4 | 180 | | return false; |
| | | 181 | | } |
| | | 182 | | |
| | 0 | 183 | | bool hasEnvironmentName = IsEnvironmentNameReference(invocation.Instance); |
| | 0 | 184 | | bool hasProductionConstant = false; |
| | | 185 | | |
| | 0 | 186 | | foreach (IArgumentOperation argument in invocation.Arguments) |
| | | 187 | | { |
| | 0 | 188 | | IOperation value = Unwrap(argument.Value); |
| | 0 | 189 | | hasEnvironmentName = hasEnvironmentName || IsEnvironmentNameReference(value); |
| | 0 | 190 | | hasProductionConstant = hasProductionConstant || IsProductionConstant(value); |
| | | 191 | | } |
| | | 192 | | |
| | 0 | 193 | | return hasEnvironmentName && hasProductionConstant; |
| | | 194 | | } |
| | | 195 | | |
| | | 196 | | private static bool BinaryComparesEnvironmentNameToProduction(IBinaryOperation binaryOperation) |
| | | 197 | | { |
| | 2 | 198 | | if (binaryOperation.OperatorKind != BinaryOperatorKind.Equals) |
| | | 199 | | { |
| | 0 | 200 | | return false; |
| | | 201 | | } |
| | | 202 | | |
| | 2 | 203 | | IOperation left = Unwrap(binaryOperation.LeftOperand); |
| | 2 | 204 | | IOperation right = Unwrap(binaryOperation.RightOperand); |
| | | 205 | | |
| | 2 | 206 | | return (IsEnvironmentNameReference(left) && IsProductionConstant(right)) |
| | 2 | 207 | | || (IsEnvironmentNameReference(right) && IsProductionConstant(left)); |
| | | 208 | | } |
| | | 209 | | |
| | | 210 | | private static bool IsEnvironmentNameReference(IOperation? operation) |
| | | 211 | | { |
| | 2 | 212 | | operation = operation is null ? null : Unwrap(operation); |
| | | 213 | | |
| | 2 | 214 | | return operation is IPropertyReferenceOperation propertyReference |
| | 2 | 215 | | && propertyReference.Property.Name.Equals("EnvironmentName", StringComparison.Ordinal); |
| | | 216 | | } |
| | | 217 | | |
| | | 218 | | private static bool IsProductionConstant(IOperation operation) |
| | | 219 | | { |
| | 2 | 220 | | return operation.ConstantValue.HasValue |
| | 2 | 221 | | && operation.ConstantValue.Value is string value |
| | 2 | 222 | | && value.Equals("Production", StringComparison.OrdinalIgnoreCase); |
| | | 223 | | } |
| | | 224 | | |
| | | 225 | | private static IOperation Unwrap(IOperation operation) |
| | | 226 | | { |
| | 26 | 227 | | while (operation is IConversionOperation conversionOperation) |
| | | 228 | | { |
| | 0 | 229 | | operation = conversionOperation.Operand; |
| | 0 | 230 | | } |
| | | 231 | | |
| | 26 | 232 | | return operation; |
| | | 233 | | } |
| | | 234 | | |
| | | 235 | | private static bool IsSuppressedByHostMarker(ISymbol? symbol) |
| | | 236 | | { |
| | 164 | 237 | | for (ISymbol? current = symbol; current is not null; current = current.ContainingSymbol) |
| | | 238 | | { |
| | 194 | 239 | | foreach (AttributeData attribute in current.GetAttributes()) |
| | | 240 | | { |
| | 18 | 241 | | string? attributeName = attribute.AttributeClass?.Name; |
| | 18 | 242 | | if (attributeName is "AsiBackboneProductionConfigurationReviewed" or "AsiBackboneProductionConfiguration |
| | | 243 | | { |
| | 6 | 244 | | return true; |
| | | 245 | | } |
| | | 246 | | } |
| | | 247 | | |
| | 76 | 248 | | if (current is INamedTypeSymbol) |
| | | 249 | | { |
| | | 250 | | break; |
| | | 251 | | } |
| | | 252 | | } |
| | | 253 | | |
| | 44 | 254 | | return false; |
| | | 255 | | } |
| | | 256 | | } |