diff --git a/TESTING_GUIDE.md b/TESTING_GUIDE.md index c8f25ac3f..8589b5282 100644 --- a/TESTING_GUIDE.md +++ b/TESTING_GUIDE.md @@ -196,6 +196,7 @@ Use `docs/test-doc-maintenance-plan.md` before moving oversized suites or adding YAML `outline` integration coverage must assert nested sequence paths, mapping-parent depth, unchanged source ranges and symbol counts, deterministic sorting, and cursor replay across a page boundary. CLI parsing, command execution, and installer behavior. Index command coverage is split by run mode or feature area, and query command coverage is split by command family with partial test classes so shared console and fixture helpers stay centralized. Keep repeated query-result fixtures, such as overlapping chunk content used by multiple search deduplication tests, in narrow class-level helpers instead of duplicating local builders. `ProgramCliTests.cs` covers top-level entrypoint behavior that must be exercised through a subprocess, while `InstallScriptTests.cs` runs focused bash snippets against `install.sh` in library mode to lock in release-installer regressions without performing real network installs. Installer bundle-generation tests must also verify that `install.sh` is marked generated while every canonical `install_modules/` source remains unmarked. Status-explain coverage must enumerate the source-generated `StatusResult` serializer properties and require every serialized top-level key to succeed without opening a database. Keep major readiness/trust/extension/maintenance/cap-hit metadata assertions, dotted-member resolution, bounded valid unknown candidates, and redaction of hostile field input in the same focused fixture so serialization and explainability cannot drift independently. Keep every structured explain response key registered for status `--fields` projection, and exercise the response through a bounded JSON projection that proves the outer envelope also omits runtime and path metadata. + Safety-recipe semantic coverage must keep safe and unsafe controls in separate indexed files: assert that `Regex.Escape` / `Regex.Unescape` and literal `UseShellExecute=false` are absent, while matching, source-defined, or unresolved Regex members, literal `true`, and propagated shell-policy values remain with classification evidence. Include alias trivia, alias-like comments and strings, a qualified BCL call in a file with a bare `BoundedRegex` alias, a line break before literal `false`, and computed continuations after block and line comments. Also retain a bare receiver from a legacy index without current reference identity, add enough safe helpers to saturate the normal result envelope, keep count output aligned with full JSON, and retain a separate `new Regex` construction positive. Graph snippet-length validation uses one command/format matrix across `references`, `callers`, and `callees`. Keep explicit `--snippet-lines` fail-fast without `--body`, reject location-only and count output even when `--body` is present, preserve the zero/range errors, and retain successful text/JSON body excerpts through the accepted maximum. Also cover option-like literals supplied through `--query` and `--`, plus two-page bounded body projection with clean stderr, correct total counts, and cursor continuation. Top-level compact aliases must validate the original arguments before database access, and bounded count replay must preserve snippet-like query literals. Search-to-find recovery coverage must exercise `--regex` and `--all` in human and JSON modes, option-shaped and shell-sensitive query values, normalized path/language/exclusion/limit arguments, and explicit non-equivalent or unsafe cases. Assert typed argv plus POSIX-shell and PowerShell displays, absence of implicit workspace defaults, and the no-execution markers; an unmappable request must return no alternative command. C# `unused` partial-family coverage must reuse one multi-file fixture across regular JSON, compact, `--by-bucket`, and `--actionable`; include top-level and nested partial types, genuinely unused private members, an unrelated same-named family, a containing-type generic-arity collision, and a family-external occurrence in a matched peer file so semantic membership cannot regress into name-only, flattened-qualified-name, or whole-file evidence sharing. @@ -1150,6 +1151,7 @@ dotnet test --filter "FullyQualifiedName~GitHelperTests" YAML `outline` の integration coverage では、入れ子 sequence path、mapping parent の depth、不変な source range と symbol count、決定的な sort、page 境界を越える cursor replay を検証してください。 CLI の引数解析、コマンド実行、installer 挙動のテスト。Index command coverage は run mode または機能領域ごとの partial suite に分割し、Query command coverage は command family ごとの partial test class に分割して、共有 console / fixture helper は一箇所に保ちます。`ProgramCliTests.cs` はグローバル引数の解釈や完全な CLI 起動フローのように subprocess 経由で確認すべき Program エントリポイント挙動を扱い、`InstallScriptTests.cs` は `install.sh` を library mode で source した bash snippet を実行して、実ネットワーク install を行わずに release installer の回帰を固定する。installer bundle 生成テストでは、`install.sh` が generated と判定される一方、canonical な `install_modules/` source はすべて unmarked のままであることも検証してください。 status explain の coverage は source-generated `StatusResult` serializer property を列挙し、database を開かずに serialized top-level key がすべて成功することを必須にします。主要な readiness / trust / extension / maintenance / cap-hit metadata、dot 区切り member resolution、unknown key に対する上限付きの有効な candidate、悪意ある field input の redaction を同じ focused fixture に置き、serialization と explainability が独立して drift しないようにしてください。structured explain response の全 key を status の `--fields` projection に登録し、outer envelope からも runtime / path metadata が省略されることを上限付き JSON projection で固定してください。 + safety recipe の意味論 coverage では、安全側と危険側の control を別々の indexed file に置いてください。`Regex.Escape` / `Regex.Unescape` と literal `UseShellExecute=false` が除外され、matching、source-defined、または解決不能な Regex member、literal `true`、伝播された shell-policy 値が classification evidence 付きで残ることを検証します。alias の trivia、alias に見える comment / string、bare `BoundedRegex` alias と完全修飾 BCL call が同居する file、literal `false` の前の改行、block / line comment の後に続く計算式を含めます。また、現行 reference identity を持たない legacy index の bare receiver を残すこと、通常の result envelope を埋める数の safe helper、count 出力と full JSON の一致、別の `new Regex` construction 正例も維持してください。 graph の snippet 長 validation は、`references`、`callers`、`callees` を横断する1つの command / format matrix で検証します。明示した `--snippet-lines` は `--body` なしで fail-fast し、`--body` があっても location-only / count 出力では拒否すること、zero / range error を維持すること、受理上限まで text / JSON の body excerpt が成功することを固定してください。さらに、`--query` と `--` で渡した option 風 literal、および stderr が空で total count と cursor continuation が正しい2ページの bounded body projection も検証してください。top-level compact alias は database access より前に原引数を検証し、bounded count replay は snippet 風の query literal を維持しなければなりません。 search から find への recovery coverage では、human / JSON mode の `--regex` と `--all`、option 風および shell-sensitive な query 値、正規化した path / language / exclude / limit 引数、明示的に非等価または unsafe な case を検証してください。型付き argv と POSIX shell / PowerShell 表示、暗黙の workspace default が含まれないこと、未実行 marker を固定し、対応不能な request が代替 command を返さないことを必須にします。 C# `unused` の partial-family coverage では、通常の JSON、compact、`--by-bucket`、`--actionable` で1つの multi-file fixture を共有してください。top-level / nested partial type、本当に未使用の private member、無関係な同名 family、containing type の generic-arity collision、matched peer file 内の family 外 occurrence を含め、semantic membership が name-only、平坦化された qualified name、または file 全体の evidence 共有へ戻らないことを固定します。 diff --git a/USER_GUIDE.md b/USER_GUIDE.md index 74b0ca22a..42adcdbf2 100644 --- a/USER_GUIDE.md +++ b/USER_GUIDE.md @@ -1410,15 +1410,24 @@ issue-draft export and downstream triage tools can keep the reviewer guidance next to the evidence path. For example, `classifiers` describe the triage dimensions that downstream tools should use, such as `source_origin`, `guard_evidence`, `secret_origin`, -`parser_guard_evidence`, `process_launch_boundary`, `cancellation_intent`, -`task_result_intent`, `active_skip_governance`, `broad_catch_boundary`, and -`diagnostic_redaction`; each classifier lists categories, evidence fields, and -guidance so noisy audit terms can be separated before filing. +`parser_guard_evidence`, `process_launch_boundary`, `regex_operation_semantics`, +`shell_execute_polarity`, `cancellation_intent`, `task_result_intent`, +`active_skip_governance`, `broad_catch_boundary`, and `diagnostic_redaction`; +each classifier lists categories, evidence fields, and guidance so noisy audit +terms can be separated before filing. `dogfood-risk-patterns` includes process-launch boundary child queries for `ProcessStartInfo`, `Process.Start`, `ArgumentList`, `UseShellExecute`, working-directory choices, stdout/stderr redirection, waits, termination, shared launch/environment policies, and broad plugin/hook/trust-override discovery terms. +The `static-regex-api*` children inspect the matched code-origin `Regex` member: +exact `Escape` / `Unescape` helpers on a receiver proven to be the BCL type are +suppressed, while matching operations and unresolved or source-defined +receiver/member evidence remain findings. `process-shell-execute` similarly +suppresses only a matched direct literal `UseShellExecute=false` assignment; +literal `true` and propagated or otherwise unresolved values remain findings +with semantic classification evidence. Nearby comments and string literals do +not change either semantic decision. `risky-code/broad-exception-catch` includes broad-catch boundary categories and expected diagnostic behaviors so users can distinguish intentional top-level, cleanup, probe, diagnostic-sanitization, and worker boundaries from catches that @@ -4801,14 +4810,21 @@ facet の短い一覧です。recipe run の JSON は各 matching result にも issue-draft export や下流の triage tool が evidence path の近くに reviewer guidance を 保持できます。`classifiers` は下流 tool が使うべき triage の軸を表し、 `source_origin`、`guard_evidence`、`secret_origin`、`parser_guard_evidence`、 -`process_launch_boundary`、`cancellation_intent`、`task_result_intent`、 -`active_skip_governance`、`broad_catch_boundary`、`diagnostic_redaction` などの -classifier が category、evidence field、guidance を持つため、ノイズの多い audit term を -起票前に切り分けられます。 +`process_launch_boundary`、`regex_operation_semantics`、`shell_execute_polarity`、 +`cancellation_intent`、`task_result_intent`、`active_skip_governance`、 +`broad_catch_boundary`、`diagnostic_redaction` などの classifier が category、 +evidence field、guidance を持つため、ノイズの多い audit term を起票前に切り分けられます。 `dogfood-risk-patterns` は `ProcessStartInfo`、`Process.Start`、`ArgumentList`、 `UseShellExecute`、working-directory 選択、stdout/stderr redirection、wait、 termination、共有 launch/environment policy、広めの plugin/hook/trust-override discovery 用語を process-launch boundary の child query として含みます。 +`static-regex-api*` child は一致した code-origin の `Regex` member を判定し、BCL type と +証明できる receiver 上の厳密な `Escape` / `Unescape` helper を除外する一方、matching +operation、解決不能または source-defined の receiver/member evidence は finding として +残します。`process-shell-execute` も、一致した直接の literal `UseShellExecute=false` 代入だけを +除外します。literal `true` と、伝播またはその他の理由で解決できない値は、意味論的な分類 +evidence を伴う finding として残ります。周辺の comment や string literal は、どちらの意味 +判定も変更しません。 たとえば `risky-code/broad-exception-catch` は broad catch の境界カテゴリと期待される diagnostic behavior を含めるため、意図的な top-level、cleanup、probe、diagnostic-sanitization、worker 境界と、narrowing または diff --git a/changelog.d/unreleased/4911.fixed.md b/changelog.d/unreleased/4911.fixed.md new file mode 100644 index 000000000..4258f0078 --- /dev/null +++ b/changelog.d/unreleased/4911.fixed.md @@ -0,0 +1,19 @@ +--- +category: fixed +issues: + - 4911 +affected: + - src/CodeIndex/Cli/SearchAuditRecipes.cs + - src/CodeIndex/Cli/QueryCommandRunner.SearchRecipes.cs + - tests/CodeIndex.Tests/QueryCommandRunnerSearchTests.cs + - USER_GUIDE.md + - TESTING_GUIDE.md +--- + +## English + +- **Safety audits now distinguish safe helper operations and negative policy values (#4911)** — the dogfood static-Regex audit suppresses exact BCL `Regex.Escape` / `Regex.Unescape` helpers without hiding pattern execution, source-defined receivers, or unresolved members, while the shell-execution audit suppresses direct literal `UseShellExecute=false` assignments and retains `true` or propagated values. The decisions follow matched code evidence rather than nearby comments, and retained findings include semantic classification evidence for the matched operation or value. + +## 日本語 + +- **安全性 audit が安全な helper 操作と否定 policy 値を区別するようになりました (#4911)** — dogfood の static Regex audit は厳密な BCL `Regex.Escape` / `Regex.Unescape` helper を除外しつつ、pattern 実行、source-defined receiver、解決不能な member を検出に残します。shell-execution audit は直接の literal `UseShellExecute=false` 代入を除外し、`true` または伝播された値を残します。判定は周辺 comment ではなく一致した code evidence に従い、残った finding には一致した操作または値の意味論的な分類 evidence が含まれます。 diff --git a/src/CodeIndex/Cli/QueryCommandRunner.SearchRecipes.cs b/src/CodeIndex/Cli/QueryCommandRunner.SearchRecipes.cs index 9cbeeaa51..950c76ee3 100644 --- a/src/CodeIndex/Cli/QueryCommandRunner.SearchRecipes.cs +++ b/src/CodeIndex/Cli/QueryCommandRunner.SearchRecipes.cs @@ -1925,7 +1925,7 @@ private static List CollectSearchRecipeQueryR var queryScope = BuildSearchRecipeQueryScope(scope, recipeQuery); var resultLimit = GetSearchRecipeEffectiveResultLimit(options, total); var guardFilters = BuildSearchRecipeGuardFilters(options, recipeQuery); - var fetchLimit = GetSearchRecipeFetchLimit(options, resultLimit); + var fetchLimit = GetSearchRecipeFetchLimit(options, resultLimit, recipeQuery); var results = reader.Search( recipeQuery.Query, fetchLimit, @@ -1953,6 +1953,7 @@ private static List CollectSearchRecipeQueryR fetchLimit); results = ApplySearchRecipeFileRejectQueries(reader, results, options, recipeQuery); var rows = BuildSearchDisplayRows(results, options, exact, recipeQuery.Query, rawFtsOverride: false, recipeQuery: recipeQuery); + rows = ApplySearchRecipeSemanticFilter(reader, options, recipeQuery, rows); var outputSelection = ApplySearchOutputSelection(rows, options, resultLimit, sourceTotalAuthoritative); rows = outputSelection.Rows; ApplySearchRecipeAuditClassifications(recipeQuery, rows); @@ -2026,7 +2027,7 @@ private static List CollectSearchRecip var queryScope = BuildSearchRecipeQueryScope(scope, recipeQuery); var resultLimit = GetSearchRecipeEffectiveResultLimit(options, total); var guardFilters = BuildSearchRecipeGuardFilters(options, recipeQuery); - var fetchLimit = GetSearchRecipeFetchLimit(options, resultLimit); + var fetchLimit = GetSearchRecipeFetchLimit(options, resultLimit, recipeQuery); var results = reader.Search( recipeQuery.Query, fetchLimit, @@ -2054,6 +2055,7 @@ private static List CollectSearchRecip fetchLimit); results = ApplySearchRecipeFileRejectQueries(reader, results, options, recipeQuery); var rows = BuildSearchDisplayRows(results, options, exact, recipeQuery.Query, recipeQuery: recipeQuery); + rows = ApplySearchRecipeSemanticFilter(reader, options, recipeQuery, rows); var outputSelection = ApplySearchOutputSelection(rows, options, resultLimit, sourceTotalAuthoritative); rows = outputSelection.Rows; ApplySearchRecipeAuditClassifications(recipeQuery, rows); @@ -2129,11 +2131,18 @@ private static bool IsSearchRecipeSourceTotalAuthoritative( int fetchLimit) => guardFilters.Count == 0 && recipeQuery.RejectFileQueries.Count == 0 + && recipeQuery.SemanticFilter == SearchRecipeSemanticFilter.None && !HasSearchOriginFilters(BuildSearchDisplayFacetFilters(options, recipeQuery)) && resultCount < fetchLimit; - private static int GetSearchRecipeFetchLimit(QueryCommandOptions options, int resultLimit) + private static int GetSearchRecipeFetchLimit( + QueryCommandOptions options, + int resultLimit, + SearchAuditRecipeQuery? recipeQuery = null) { + if (recipeQuery is { SemanticFilter: not SearchRecipeSemanticFilter.None }) + return int.MaxValue; + var selectionTarget = resultLimit > 0 && options.SampleSize.HasValue ? Math.Max(resultLimit, options.SampleSize.Value) : resultLimit; @@ -2177,6 +2186,7 @@ private static List CountSearchRecipeQueryResu requiredPathPatterns: GetSearchRecipeRequiredPathPatterns(options, recipeQuery)); results = ApplySearchRecipeFileRejectQueries(reader, results, options, recipeQuery); var rows = BuildSearchDisplayRows(results, options, exact, recipeQuery.Query, rawFtsOverride: false, recipeQuery: recipeQuery); + rows = ApplySearchRecipeSemanticFilter(reader, options, recipeQuery, rows); ApplySearchRecipeAuditClassifications(recipeQuery, rows); var count = rows.Count; var fileCountForQuery = rows.Select(row => row.Result.Path).Distinct(StringComparer.Ordinal).Count(); @@ -2221,6 +2231,442 @@ private static void ApplySearchRecipeAuditClassifications(SearchAuditRecipeQuery } } + private static List ApplySearchRecipeSemanticFilter( + DbReader reader, + QueryCommandOptions options, + SearchAuditRecipeQuery recipeQuery, + List rows) + { + if (recipeQuery.SemanticFilter == SearchRecipeSemanticFilter.None) + return rows; + + var classifierName = recipeQuery.SemanticFilter switch + { + SearchRecipeSemanticFilter.RegexStaticMember => "regex_operation_semantics", + SearchRecipeSemanticFilter.ShellExecuteAssignment => "shell_execute_polarity", + _ => null, + }; + var classifier = classifierName == null + ? null + : recipeQuery.Classifiers.FirstOrDefault(candidate => string.Equals(candidate.Name, classifierName, StringComparison.Ordinal)); + if (classifier == null) + return rows; + + var retained = new List(rows.Count); + var regexBindingPaths = recipeQuery.SemanticFilter == SearchRecipeSemanticFilter.RegexStaticMember + ? BuildRegexBareReceiverContexts(reader, options, rows) + : new Dictionary(StringComparer.Ordinal); + foreach (var row in rows) + { + var evidence = recipeQuery.SemanticFilter switch + { + SearchRecipeSemanticFilter.RegexStaticMember => GetRegexOperationEvidence( + reader, + row, + regexBindingPaths), + SearchRecipeSemanticFilter.ShellExecuteAssignment => GetShellExecuteAssignmentEvidence(row), + _ => null, + }; + if (evidence?.Suppress == true) + continue; + + if (evidence != null) + { + var classification = BuildSearchRecipeSemanticClassification(classifier, evidence, row); + if (classification != null) + { + row.Compact.AuditClassifications ??= []; + row.Compact.AuditClassifications.Add(classification); + } + } + + retained.Add(row); + } + + return retained; + } + + private static SearchAuditClassificationJsonResult? BuildSearchRecipeSemanticClassification( + SearchRecipeClassifierJsonResult classifier, + SearchRecipeSemanticEvidence evidence, + SearchDisplayRow row) + { + var categoryMetadata = classifier.Categories + .FirstOrDefault(category => string.Equals(category.Name, evidence.Category, StringComparison.Ordinal)); + if (categoryMetadata == null) + return null; + + var details = new List + { + $"reason:{evidence.Reason}", + }; + if (!string.IsNullOrWhiteSpace(evidence.Operation)) + details.Add($"operation:{evidence.Operation}"); + if (!string.IsNullOrWhiteSpace(evidence.Value)) + details.Add($"value:{evidence.Value}"); + if (evidence.Line.HasValue) + details.Add($"line:{evidence.Line.Value.ToString(CultureInfo.InvariantCulture)}"); + if (!string.IsNullOrWhiteSpace(row.Compact.EnclosingSymbolName)) + details.Add($"enclosing_symbol_name:{row.Compact.EnclosingSymbolName}"); + if (!string.IsNullOrWhiteSpace(row.Compact.EnclosingSymbolKind)) + details.Add($"enclosing_symbol_kind:{row.Compact.EnclosingSymbolKind}"); + + return new SearchAuditClassificationJsonResult( + classifier.Name, + categoryMetadata.Name, + categoryMetadata.Description, + categoryMetadata.ReviewGuidance, + details); + } + + private static SearchRecipeSemanticEvidence GetRegexOperationEvidence( + DbReader reader, + SearchDisplayRow row, + Dictionary bindingPaths) + { + var operations = new List(); + int? firstLine = null; + var foundRiskOperation = false; + var foundUnresolvedOperation = false; + var foundSafeOperation = false; + + foreach (var match in GetSemanticEvidenceMatches(row, "Regex.")) + { + var searchFrom = match.MarkerIndex + "Regex.".Length; + firstLine ??= match.Line; + + var receiver = ExtractRegexReceiver(match.Text, match.MarkerIndex); + var member = ExtractIdentifier(match.Text, searchFrom); + operations.Add(string.IsNullOrWhiteSpace(member) ? receiver : $"{receiver}.{member}"); + if (!IsProvenSystemRegexReceiver( + reader, + row.Result.Path, + receiver, + match.Line, + match.MarkerIndex, + bindingPaths) + || string.IsNullOrWhiteSpace(member)) + { + foundUnresolvedOperation = true; + continue; + } + + if (member is "Escape" or "Unescape") + { + foundSafeOperation = true; + continue; + } + + if (member is "IsMatch" or "Match" or "Matches" or "Replace" or "Split" or "EnumerateMatches" or "Count") + foundRiskOperation = true; + else + foundUnresolvedOperation = true; + } + + var operation = string.Join(",", operations.Distinct(StringComparer.Ordinal)); + if (foundRiskOperation) + return new SearchRecipeSemanticEvidence(false, "regex_pattern_operation", "matched_pattern_operation", operation, null, firstLine); + if (foundUnresolvedOperation || !foundSafeOperation) + return new SearchRecipeSemanticEvidence(false, "regex_operation_unresolved", "receiver_or_member_not_proven_safe", operation, null, firstLine); + return new SearchRecipeSemanticEvidence(true, "safe_escape_helper", "escape_helper_does_not_execute_pattern", operation, null, firstLine); + } + + private static string ExtractRegexReceiver(string text, int regexIndex) + { + var start = regexIndex; + while (start > 0 && IsQualifiedIdentifierCharacter(text[start - 1])) + start--; + return text[start..(regexIndex + "Regex".Length)].Trim('.'); + } + + private static bool IsProvenSystemRegexReceiver( + DbReader reader, + string path, + string receiver, + int line, + int regexIndex, + Dictionary bindingPaths) + { + if (string.Equals(receiver, "System.Text.RegularExpressions.Regex", StringComparison.Ordinal) + || string.Equals(receiver, "global::System.Text.RegularExpressions.Regex", StringComparison.Ordinal)) + { + return true; + } + if (!string.Equals(receiver, "Regex", StringComparison.Ordinal)) + return false; + + if (!bindingPaths.TryGetValue(path, out var binding) + || !binding.HasSystemNamespaceImport + || binding.HasAliasDeclaration) + { + return false; + } + + var resolution = reader.GetReferencePositionResolution(path, "Regex", line, regexIndex + 1, maxCandidates: 1); + return resolution.IdentityAvailable + && !resolution.CandidatesTruncated + && resolution.Candidates.Count == 0; + } + + private static Dictionary BuildRegexBareReceiverContexts( + DbReader reader, + QueryCommandOptions options, + IReadOnlyCollection rows) + { + var paths = rows + .Select(row => row.Result.Path) + .Distinct(StringComparer.Ordinal) + .ToArray(); + var contexts = paths.ToDictionary( + path => path, + _ => new RegexBareReceiverContext(false, false), + StringComparer.Ordinal); + foreach (var pathBatch in paths.Chunk(100)) + { + var usingResults = reader.Search( + "using", + int.MaxValue, + options.Lang, + rawQuery: false, + pathPatterns: pathBatch, + excludePathPatterns: null, + excludeTests: false, + deduplicate: false, + since: options.Since, + exact: true, + prefix: false, + visibilityRank: false); + foreach (var result in usingResults) + { + if (!contexts.TryGetValue(result.Path, out var context)) + continue; + + foreach (var match in GetCodeSemanticMatches(result, "using")) + { + var directive = ParseRegexUsingDirective(match.ContinuationText, match.MarkerIndex); + context = new RegexBareReceiverContext( + context.HasSystemNamespaceImport || directive.HasSystemNamespaceImport, + context.HasAliasDeclaration || directive.HasAliasDeclaration); + } + + contexts[result.Path] = context; + } + } + + return contexts; + } + + private static RegexBareReceiverContext ParseRegexUsingDirective(string content, int usingIndex) + { + var cursor = usingIndex + "using".Length; + if ((usingIndex > 0 && IsIdentifierCharacter(content[usingIndex - 1])) + || (cursor < content.Length && IsIdentifierCharacter(content[cursor]))) + { + return new RegexBareReceiverContext(false, false); + } + + cursor = SkipCSharpTrivia(content, cursor); + var firstIdentifier = ExtractIdentifier(content, cursor); + if (string.Equals(firstIdentifier, "Regex", StringComparison.Ordinal)) + { + cursor = SkipCSharpTrivia(content, cursor + firstIdentifier.Length); + return new RegexBareReceiverContext(false, cursor < content.Length && content[cursor] == '='); + } + + foreach (var identifier in new[] { "System", "Text", "RegularExpressions" }) + { + var actual = ExtractIdentifier(content, cursor); + if (!string.Equals(actual, identifier, StringComparison.Ordinal)) + return new RegexBareReceiverContext(false, false); + cursor = SkipCSharpTrivia(content, cursor + actual.Length); + if (!string.Equals(identifier, "RegularExpressions", StringComparison.Ordinal)) + { + if (cursor >= content.Length || content[cursor] != '.') + return new RegexBareReceiverContext(false, false); + cursor = SkipCSharpTrivia(content, cursor + 1); + } + } + + return new RegexBareReceiverContext( + cursor < content.Length && content[cursor] == ';', + false); + } + + private static int SkipCSharpTrivia(string text, int start) + { + var cursor = start; + while (cursor < text.Length) + { + if (char.IsWhiteSpace(text[cursor])) + { + cursor++; + continue; + } + if (cursor + 1 < text.Length && text[cursor] == '/' && text[cursor + 1] == '/') + { + cursor += 2; + while (cursor < text.Length && text[cursor] is not '\r' and not '\n') + cursor++; + continue; + } + if (cursor + 1 < text.Length && text[cursor] == '/' && text[cursor + 1] == '*') + { + var commentEnd = text.IndexOf("*/", cursor + 2, StringComparison.Ordinal); + if (commentEnd < 0) + return text.Length; + cursor = commentEnd + 2; + continue; + } + + break; + } + + return cursor; + } + + private static bool IsIdentifierCharacter(char value) + => char.IsLetterOrDigit(value) || value == '_'; + + private static bool IsQualifiedIdentifierCharacter(char value) + => char.IsLetterOrDigit(value) || value is '_' or '.' or ':'; + + private static string ExtractIdentifier(string text, int start) + { + var end = start; + while (end < text.Length && (char.IsLetterOrDigit(text[end]) || text[end] == '_')) + end++; + return text[start..end]; + } + + private static SearchRecipeSemanticEvidence GetShellExecuteAssignmentEvidence(SearchDisplayRow row) + { + var values = new List(); + int? firstLine = null; + var foundFalse = false; + var foundTrue = false; + var foundUnresolved = false; + + foreach (var match in GetSemanticEvidenceMatches(row, "UseShellExecute")) + { + var searchFrom = match.MarkerIndex + "UseShellExecute".Length; + firstLine ??= match.Line; + var value = ExtractAssignedBooleanLiteral(match.ContinuationText, searchFrom); + values.Add(value ?? "unresolved"); + if (string.Equals(value, "false", StringComparison.Ordinal)) + foundFalse = true; + else if (string.Equals(value, "true", StringComparison.Ordinal)) + foundTrue = true; + else + foundUnresolved = true; + } + + var valueEvidence = string.Join(",", values.Distinct(StringComparer.Ordinal)); + if (foundTrue) + return new SearchRecipeSemanticEvidence(false, "shell_explicitly_enabled", "literal_true_enables_shell", "UseShellExecute", valueEvidence, firstLine); + if (foundUnresolved || !foundFalse) + return new SearchRecipeSemanticEvidence(false, "shell_policy_unresolved", "assigned_value_not_literal_boolean", "UseShellExecute", valueEvidence, firstLine); + return new SearchRecipeSemanticEvidence(true, "shell_explicitly_disabled", "literal_false_disables_shell", "UseShellExecute", valueEvidence, firstLine); + } + + private static string? ExtractAssignedBooleanLiteral(string text, int start) + { + var cursor = start; + while (cursor < text.Length && char.IsWhiteSpace(text[cursor])) + cursor++; + if (cursor >= text.Length || (text[cursor] != '=' && text[cursor] != ':')) + return null; + if (text[cursor] == '=' && cursor + 1 < text.Length && text[cursor + 1] is '=' or '>') + return null; + + cursor++; + while (cursor < text.Length && char.IsWhiteSpace(text[cursor])) + cursor++; + var value = ExtractIdentifier(text, cursor); + if (value is not ("false" or "true")) + return null; + + cursor += value.Length; + cursor = SkipCSharpTrivia(text, cursor); + if (cursor == text.Length || text[cursor] is ',' or ';' or '}' or ')' or ']') + return value; + return null; + } + + private static IEnumerable GetSemanticEvidenceMatches(SearchDisplayRow row, string marker) + { + var contentLines = row.Result.Content.Split('\n', StringSplitOptions.None); + var matches = new List(); + var seen = new HashSet<(int Line, int MarkerIndex)>(); + foreach (var facet in row.Compact.MatchFacets + .Where(facet => string.Equals(facet.Origin, SearchMatchClassifier.Code, StringComparison.Ordinal)) + .OrderBy(facet => facet.Line) + .ThenBy(facet => facet.Column)) + { + if (facet.Line < row.Result.StartLine || facet.Line - row.Result.StartLine >= contentLines.Length) + continue; + + var contentLineIndex = facet.Line - row.Result.StartLine; + var text = contentLines[contentLineIndex].TrimEnd('\r'); + var continuationText = string.Join('\n', contentLines.Skip(contentLineIndex)); + var facetStart = Math.Max(0, facet.Column - 1); + var facetEnd = facetStart + Math.Max(1, facet.Length); + for (var searchFrom = 0; searchFrom < text.Length;) + { + var markerIndex = text.IndexOf(marker, searchFrom, StringComparison.Ordinal); + if (markerIndex < 0) + break; + searchFrom = markerIndex + marker.Length; + var markerEnd = markerIndex + marker.Length; + if (markerIndex >= facetEnd || facetStart >= markerEnd || !seen.Add((facet.Line, markerIndex))) + continue; + + matches.Add(new SearchRecipeSemanticMatch(text, continuationText, facet.Line, markerIndex)); + } + } + + return matches; + } + + private static IEnumerable GetCodeSemanticMatches(SearchResult result, string marker) + { + var contentLines = result.Content.Split('\n', StringSplitOptions.None); + for (var contentLineIndex = 0; contentLineIndex < contentLines.Length; contentLineIndex++) + { + var text = contentLines[contentLineIndex].TrimEnd('\r'); + var continuationText = string.Join('\n', contentLines.Skip(contentLineIndex)); + for (var searchFrom = 0; searchFrom < text.Length;) + { + var markerIndex = text.IndexOf(marker, searchFrom, StringComparison.Ordinal); + if (markerIndex < 0) + break; + searchFrom = markerIndex + marker.Length; + var line = result.StartLine + contentLineIndex; + var facet = SearchMatchClassifier.Classify( + result.Path, + result.Lang, + line, + text, + markerIndex + 1, + marker.Length, + result.EnclosingSymbolKind); + if (string.Equals(facet.Origin, SearchMatchClassifier.Code, StringComparison.Ordinal)) + yield return new SearchRecipeSemanticMatch(text, continuationText, line, markerIndex); + } + } + } + + private sealed record SearchRecipeSemanticEvidence( + bool Suppress, + string Category, + string Reason, + string Operation, + string? Value, + int? Line); + + private sealed record RegexBareReceiverContext(bool HasSystemNamespaceImport, bool HasAliasDeclaration); + + private sealed record SearchRecipeSemanticMatch(string Text, string ContinuationText, int Line, int MarkerIndex); + private static SearchAuditClassificationJsonResult? TryClassifyTaskResultIntent( SearchRecipeClassifierJsonResult classifier, SearchDisplayRow row) @@ -2460,6 +2906,7 @@ private static List CollectSearchRecipeA requiredPathPatterns: GetSearchRecipeRequiredPathPatterns(options, recipeQuery)); results = ApplySearchRecipeFileRejectQueries(reader, results, options, recipeQuery); var rows = BuildSearchDisplayRows(results, options, exact, recipeQuery.Query, rawFtsOverride: false, recipeQuery: recipeQuery); + rows = ApplySearchRecipeSemanticFilter(reader, options, recipeQuery, rows); foreach (var path in rows.Select(row => row.Result.Path)) paths.Add(path); diff --git a/src/CodeIndex/Cli/SearchAuditRecipes.cs b/src/CodeIndex/Cli/SearchAuditRecipes.cs index 9d866dca6..c1cad729e 100644 --- a/src/CodeIndex/Cli/SearchAuditRecipes.cs +++ b/src/CodeIndex/Cli/SearchAuditRecipes.cs @@ -249,6 +249,26 @@ internal static class SearchAuditRecipes ], ["path", "enclosing_symbol_name", "risk_evidence", "guard_evidence", "guard_checks"], "Treat process-launch results as trust-boundary evidence; prefer ProcessLaunchPolicy/SubprocessEnvironmentPolicy or nearby purpose-specific wrappers."); + private static readonly SearchRecipeClassifierJsonResult RegexOperationClassifier = new( + "regex_operation_semantics", + "Classifies the matched System.Text.RegularExpressions.Regex member by whether it escapes text, executes a pattern, or cannot be resolved conservatively.", + [ + new("safe_escape_helper", "The matched Regex.Escape or Regex.Unescape helper transforms text without executing or compiling a pattern.", "This category is suppressed from audit findings."), + new("regex_pattern_operation", "The matched Regex member performs matching, replacement, splitting, or another pattern operation.", "Review timeout policy, pattern trust, and input bounds."), + new("regex_operation_unresolved", "The matched receiver or member could not be proven to be a safe escaping helper.", "Keep aliases, qualifications, truncated snippets, and unknown members for manual review.") + ], + ["path", "enclosing_symbol_name", "audit_classifications.evidence", "risk_evidence", "match_origins"], + "Only exact Regex.Escape and Regex.Unescape operations are suppressed; execution members and unresolved receiver/member evidence remain findings."); + private static readonly SearchRecipeClassifierJsonResult ShellExecutePolarityClassifier = new( + "shell_execute_polarity", + "Classifies UseShellExecute assignments by their literal boolean polarity while preserving unresolved value flows for review.", + [ + new("shell_explicitly_disabled", "The matched assignment uses the literal false value and explicitly disables shell execution.", "This category is suppressed from audit findings."), + new("shell_explicitly_enabled", "The matched assignment uses the literal true value and enables shell execution.", "Review command, argument, environment, and file-association trust boundaries."), + new("shell_policy_unresolved", "The assigned value is propagated, computed, truncated, or otherwise not a literal boolean.", "Retain the finding until the no-shell policy can be proven at the assignment boundary.") + ], + ["path", "enclosing_symbol_name", "audit_classifications.evidence", "risk_evidence", "match_origins"], + "Only a direct literal false assignment is suppressed; true and unresolved value propagation remain findings."); private static readonly SearchRecipeClassifierJsonResult CancellationIntentClassifier = new( "cancellation_intent", "Classifies cancellation-token hits by compatibility wrapper, short-lived probe, or long-running operation risk.", @@ -483,27 +503,31 @@ private static SearchAuditRecipeQuery StaticRegexApiQuery(string name, string qu MatchOrigins = ["code"], }; - private static SearchAuditRecipeQuery DogfoodStaticRegexApiQuery(string name, string query, string shape) => + private static SearchAuditRecipeQuery DogfoodStaticRegexApiQuery( + string name, + string query, + string shape, + bool rejectBoundedRegexAlias = true) => new( name, query, $"Find raw static Regex API usage candidates with {shape} so bounded instance names are not counted.", ["audit", "performance", "security"], - "False positives include Regex.Escape/Unescape, explicit timeout overloads, generated/precompiled patterns, trusted small inputs, and tests that intentionally exercise raw Regex behavior.") + "Regex.Escape/Unescape are suppressed by matched-member semantics. Review retained execution members and unresolved receiver/member evidence for explicit timeout, generated/precompiled patterns, trusted small inputs, or intentional test behavior.") { - RejectFileQueries = - [ - BoundedRegexAliasUsing - ], + RejectFileQueries = rejectBoundedRegexAlias ? [BoundedRegexAliasUsing] : [], ExcludePaths = [BoundedRegexPath], RiskEvidence = [ "risk: raw System.Text.RegularExpressions.Regex static APIs can run without explicit timeout or shared bounded-regex policy.", "risk: classify each pattern by trust boundary: user input, config/env input, repository-controlled patterns, test fixtures, or generated diagnostics.", - "positive: BoundedRegex aliases and instance names ending in Regex are filtered out; remaining hits should be classified as timeout-backed, generated/precompiled, trusted small input, or non-matching helpers such as Escape." + "positive: exact Regex.Escape and Regex.Unescape helpers do not execute or compile patterns and are suppressed by matched-member semantics.", + "risk: matching/execution members and unresolved alias or qualification evidence remain findings until timeout and trust boundaries are proven." ], GuardFilters = BoundedRegexEvidenceGuardFilters(), MatchOrigins = ["code"], + Classifiers = [RegexOperationClassifier], + SemanticFilter = SearchRecipeSemanticFilter.RegexStaticMember, }; private static readonly string[] TimestampBoundaryRiskEvidence = @@ -1258,6 +1282,11 @@ private static SearchAuditRecipeQuery TimestampBoundaryQuery( "static-regex-api-parenthesized", "(Regex.", "an opening-parenthesis prefix"), + DogfoodStaticRegexApiQuery( + "static-regex-api-qualified", + "RegularExpressions.Regex.", + "a fully qualified System.Text.RegularExpressions receiver", + rejectBoundedRegexAlias: false), new( "relaxed-json-encoder", "UnsafeRelaxedJsonEscaping", @@ -1494,17 +1523,19 @@ private static SearchAuditRecipeQuery TimestampBoundaryQuery( new( "process-shell-execute", "UseShellExecute", - "Find shell-execution toggles that decide whether the platform shell participates in process launch.", + "Find shell-execution toggles whose assigned value enables shell use or cannot be resolved conservatively.", ["audit", "security"], - "False positives include assertions that verify UseShellExecute is false.") + "Literal UseShellExecute=false assignments are suppressed by value-polarity semantics; propagated or computed values remain findings for review.") { RiskEvidence = [ "risk: UseShellExecute=true can reintroduce shell expansion, file association behavior, and inherited shell state.", - "positive: UseShellExecute=false with ArgumentList and redirected stream handling is preferred for subprocess boundaries." + "risk: variable-propagated or computed assignments remain findings until their no-shell value can be proven at the assignment boundary.", + "positive: a direct UseShellExecute=false assignment explicitly disables the shell and is suppressed." ], MatchOrigins = ["code"], - Classifiers = [ProcessLaunchClassifier], + Classifiers = [ProcessLaunchClassifier, ShellExecutePolarityClassifier], + SemanticFilter = SearchRecipeSemanticFilter.ShellExecuteAssignment, }, new( "process-working-directory", @@ -4325,6 +4356,14 @@ internal sealed record SearchAuditRecipeQuery( public SearchRecipeStringComparisonTaxonomyJsonResult? StringComparisonTaxonomy { get; init; } public SearchRecipeBroadCatchTaxonomyJsonResult? BroadCatchTaxonomy { get; init; } public SearchRecipeNullableContractTaxonomyJsonResult? NullableContractTaxonomy { get; init; } + public SearchRecipeSemanticFilter SemanticFilter { get; init; } +} + +internal enum SearchRecipeSemanticFilter +{ + None, + RegexStaticMember, + ShellExecuteAssignment, } internal sealed record SearchRecipeListJsonResult( diff --git a/tests/CodeIndex.Tests/QueryCommandRunnerSearchTests.cs b/tests/CodeIndex.Tests/QueryCommandRunnerSearchTests.cs index e2e67c77f..f56d7419f 100644 --- a/tests/CodeIndex.Tests/QueryCommandRunnerSearchTests.cs +++ b/tests/CodeIndex.Tests/QueryCommandRunnerSearchTests.cs @@ -2644,10 +2644,11 @@ public void RunSearch_ListRecipesJsonIncludesBuiltInAuditMetadata_Issue3144() Assert.Contains(dogfoodTrustOverridesQuery.GetProperty("risk_evidence").EnumerateArray(), evidence => evidence.GetString()!.Contains("sanitized", StringComparison.Ordinal)); Assert.Equal(" Regex.", dogfoodRegexQuery.GetProperty("query").GetString()); Assert.Contains(dogfoodRegexQuery.GetProperty("risk_evidence").EnumerateArray(), evidence => evidence.GetString()!.Contains("raw System.Text.RegularExpressions.Regex static APIs", StringComparison.Ordinal)); - Assert.Contains(dogfoodRegexQuery.GetProperty("risk_evidence").EnumerateArray(), evidence => evidence.GetString()!.Contains("BoundedRegex aliases and instance names ending in Regex are filtered out", StringComparison.Ordinal)); + Assert.Contains(dogfoodRegexQuery.GetProperty("risk_evidence").EnumerateArray(), evidence => evidence.GetString()!.Contains("suppressed by matched-member semantics", StringComparison.Ordinal)); AssertRegexBoundedGuardFilters(dogfoodRegexQuery); Assert.Contains(dogfoodRecipe.GetProperty("queries").EnumerateArray(), item => item.GetProperty("name").GetString() == "static-regex-api-negated"); Assert.Contains(dogfoodRecipe.GetProperty("queries").EnumerateArray(), item => item.GetProperty("name").GetString() == "static-regex-api-parenthesized"); + Assert.Contains(dogfoodRecipe.GetProperty("queries").EnumerateArray(), item => item.GetProperty("name").GetString() == "static-regex-api-qualified"); Assert.Contains(dogfoodSqlQuery.GetProperty("risk_evidence").EnumerateArray(), evidence => evidence.GetString()!.Contains("identifier", StringComparison.OrdinalIgnoreCase)); Assert.Contains(sqlitePolicyCommandTextQuery.GetProperty("risk_evidence").EnumerateArray(), evidence => evidence.GetString()!.Contains("SqliteCommandPolicy", StringComparison.Ordinal)); Assert.Contains(sqlitePolicyPragmaQuery.GetProperty("risk_evidence").EnumerateArray(), evidence => evidence.GetString()!.Contains("cannot bind every pragma value", StringComparison.Ordinal)); @@ -3394,6 +3395,7 @@ public void RunSearch_BuiltInRecipeSnapshotCoversNamesScopesAndQueries_Issue3692 "static-regex-api", "static-regex-api-negated", "static-regex-api-parenthesized", + "static-regex-api-qualified", "relaxed-json-encoder", "temp-file-name", "overwrite-file-move", @@ -4438,6 +4440,425 @@ public sealed class RegexDiagnosticOnly } } + [Fact] + public void RunSearch_SafetyRecipesApplyOperationAndPolaritySemantics_Issue4911() + { + var projectRoot = TestProjectHelper.CreateTempProject("cdidx_search_safety_semantics_4911"); + var overfetchProjectRoot = TestProjectHelper.CreateTempProject("cdidx_search_safety_semantics_overfetch_4911"); + var shadowProjectRoot = TestProjectHelper.CreateTempProject("cdidx_search_safety_semantics_shadow_4911"); + try + { + var dbPath = TestProjectHelper.CreateProjectDb(projectRoot); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-safe.cs", + "csharp", + """ + using System.Text.RegularExpressions; + + public static class RegexSafeHelpers + { + public static string Escape(string input) => Regex.Escape(input); // Regex.IsMatch is deliberately not called. + public static string Unescape(string input) => Regex.Unescape(input); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-risk.cs", + "csharp", + """ + using System.Text.RegularExpressions; + + public static class RegexRisk + { + public static bool Match(string input) => Regex.IsMatch(input, "token"); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-unresolved.cs", + "csharp", + """ + using System.Text.RegularExpressions; + + public static class RegexUnresolved + { + public static object Inspect(string input) => Regex.CustomOperation(input); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-alias.cs", + "csharp", + """ + using System.Text.RegularExpressions; + using Regex = Vendor.Text.Regex; + + public static class RegexAlias + { + public static string Escape(string input) => Regex.Escape(input); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-comment-string-alias.cs", + "csharp", + """ + using System.Text.RegularExpressions; + // using Regex = Vendor.Text.Regex; + + public static class RegexCommentStringAlias + { + private const string Example = "using Regex = Vendor.Text.Regex;"; + public static string Escape(string input) => Regex.Escape(input); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-qualified-safe.cs", + "csharp", + """ + public static class RegexQualifiedSafe + { + public static string Escape(string input) => global::System.Text.RegularExpressions.Regex.Escape(input); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-qualified-risk.cs", + "csharp", + """ + public static class RegexQualifiedRisk + { + public static bool Match(string input) => System.Text.RegularExpressions.Regex.IsMatch(input, "token"); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-qualified-risk-with-alias.cs", + "csharp", + """ + using Regex = CodeIndex.Indexer.BoundedRegex; + + public static class RegexQualifiedRiskWithAlias + { + public static bool Match(string input) => System.Text.RegularExpressions.Regex.IsMatch(input, "token"); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-mixed-chunk.cs", + "csharp", + """ + using System.Text.RegularExpressions; + + public static class RegexMixedChunk + { + public static bool Match(string input) + { + var escaped1 = Regex.Escape(input); + var escaped2 = Regex.Escape(escaped1); + var escaped3 = Regex.Escape(escaped2); + var escaped4 = Regex.Escape(escaped3); + var escaped5 = Regex.Escape(escaped4); + var escaped6 = Regex.Escape(escaped5); + var escaped7 = Regex.Escape(escaped6); + var escaped8 = Regex.Escape(escaped7); + return Regex.IsMatch(escaped8, "token"); + } + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/regex-construction.cs", + "csharp", + """ + using System.Text.RegularExpressions; + + public static class RegexConstruction + { + public static Regex Build(string input) => new Regex("^" + Regex.Escape(input)); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/shell-disabled.cs", + "csharp", + """ + using System.Diagnostics; + + public static class ShellDisabled + { + public static ProcessStartInfo Build() => new() { UseShellExecute = false }; // UseShellExecute must stay false. + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/shell-named-disabled.cs", + "csharp", + """ + public static class ShellNamedDisabled + { + public static object Build() => Launch(UseShellExecute: false); + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/shell-multiline-disabled.cs", + "csharp", + """ + using System.Diagnostics; + + public static class ShellMultilineDisabled + { + public static ProcessStartInfo Build() => new() + { + UseShellExecute = + false + }; + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/shell-enabled.cs", + "csharp", + """ + using System.Diagnostics; + + public static class ShellEnabled + { + public static ProcessStartInfo Build() => new() { UseShellExecute = true }; + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/shell-propagated.cs", + "csharp", + """ + using System.Diagnostics; + + public static class ShellPropagated + { + public static ProcessStartInfo Build(bool useShell) => new() { UseShellExecute = useShell }; + } + """); + TestProjectHelper.InsertIndexedFile( + dbPath, + "src/shell-computed-after-comments.cs", + "csharp", + """ + using System.Diagnostics; + + public static class ShellComputedAfterComments + { + public static ProcessStartInfo BuildBlock(bool enableShell) => new() + { + UseShellExecute = false /* default */ || enableShell + }; + + public static ProcessStartInfo BuildLine(bool enableShell) => new() + { + UseShellExecute = false // default + || enableShell + }; + } + """); + + using (var db = new DbContext(DbOpenIntent.WriteIndex, dbPath)) + { + db.InitializeSchema(); + var writer = new DbWriter(db.Connection); + writer.MarkGraphReady(); + writer.SetMeta( + DbContext.ReferenceIdentityContractVersionMetaKey, + DbContext.ReferenceIdentityContractVersion.ToString(System.Globalization.CultureInfo.InvariantCulture)); + } + + var recipeArgs = new[] + { + "--recipe", "dogfood-risk-patterns", + "--include-query", "static-regex-api,static-regex-api-qualified,process-shell-execute", + "--db", dbPath, + "--json", + "--limit", "20", + "--lang", "csharp" + }; + var (runExitCode, runStdout, runStderr) = CaptureConsole(() => QueryCommandRunner.RunSearch(recipeArgs, _jsonOptions)); + var (countExitCode, countStdout, countStderr) = CaptureConsole(() => QueryCommandRunner.RunSearch( + [.. recipeArgs, "--format", "count"], + _jsonOptions)); + var (constructionExitCode, constructionStdout, constructionStderr) = CaptureConsole(() => QueryCommandRunner.RunSearch( + ["--recipe", "dotnet-risk-patterns/regex-construction", "--db", dbPath, "--json", "--limit", "20", "--lang", "csharp"], + _jsonOptions)); + + Assert.Equal(CommandExitCodes.Success, runExitCode); + Assert.Equal(string.Empty, runStderr); + using (var document = ParseJsonOutput(runStdout)) + { + var queries = document.RootElement.GetProperty("queries").EnumerateArray().ToArray(); + var regexQuery = Assert.Single(queries, query => query.GetProperty("name").GetString() == "static-regex-api"); + var qualifiedRegexQuery = Assert.Single(queries, query => query.GetProperty("name").GetString() == "static-regex-api-qualified"); + var shellQuery = Assert.Single(queries, query => query.GetProperty("name").GetString() == "process-shell-execute"); + + Assert.Equal(4, regexQuery.GetProperty("count").GetInt32()); + Assert.DoesNotContain(regexQuery.GetProperty("results").EnumerateArray(), result => result.GetProperty("path").GetString() == "src/regex-safe.cs"); + Assert.DoesNotContain(regexQuery.GetProperty("results").EnumerateArray(), result => result.GetProperty("path").GetString() == "src/regex-comment-string-alias.cs"); + AssertSemanticClassification(regexQuery, "src/regex-risk.cs", "regex_operation_semantics", "regex_pattern_operation", "operation:Regex.IsMatch"); + AssertSemanticClassification(regexQuery, "src/regex-unresolved.cs", "regex_operation_semantics", "regex_operation_unresolved", "operation:Regex.CustomOperation"); + AssertSemanticClassification(regexQuery, "src/regex-mixed-chunk.cs", "regex_operation_semantics", "regex_pattern_operation", "operation:Regex.IsMatch"); + AssertSemanticClassification(regexQuery, "src/regex-alias.cs", "regex_operation_semantics", "regex_operation_unresolved", "operation:Regex.Escape"); + AssertClassifierCategories(regexQuery, "regex_operation_semantics", "safe_escape_helper", "regex_pattern_operation", "regex_operation_unresolved"); + + Assert.Equal(2, qualifiedRegexQuery.GetProperty("count").GetInt32()); + Assert.DoesNotContain(qualifiedRegexQuery.GetProperty("results").EnumerateArray(), result => result.GetProperty("path").GetString() == "src/regex-qualified-safe.cs"); + AssertSemanticClassification(qualifiedRegexQuery, "src/regex-qualified-risk.cs", "regex_operation_semantics", "regex_pattern_operation", "operation:System.Text.RegularExpressions.Regex.IsMatch"); + AssertSemanticClassification(qualifiedRegexQuery, "src/regex-qualified-risk-with-alias.cs", "regex_operation_semantics", "regex_pattern_operation", "operation:System.Text.RegularExpressions.Regex.IsMatch"); + + Assert.Equal(3, shellQuery.GetProperty("count").GetInt32()); + Assert.DoesNotContain(shellQuery.GetProperty("results").EnumerateArray(), result => result.GetProperty("path").GetString() == "src/shell-disabled.cs"); + Assert.DoesNotContain(shellQuery.GetProperty("results").EnumerateArray(), result => result.GetProperty("path").GetString() == "src/shell-named-disabled.cs"); + Assert.DoesNotContain(shellQuery.GetProperty("results").EnumerateArray(), result => result.GetProperty("path").GetString() == "src/shell-multiline-disabled.cs"); + AssertSemanticClassification(shellQuery, "src/shell-enabled.cs", "shell_execute_polarity", "shell_explicitly_enabled", "value:true"); + AssertSemanticClassification(shellQuery, "src/shell-propagated.cs", "shell_execute_polarity", "shell_policy_unresolved", "value:unresolved"); + AssertSemanticClassification(shellQuery, "src/shell-computed-after-comments.cs", "shell_execute_polarity", "shell_policy_unresolved", "value:unresolved"); + AssertClassifierCategories(shellQuery, "shell_execute_polarity", "shell_explicitly_disabled", "shell_explicitly_enabled", "shell_policy_unresolved"); + } + + Assert.Equal(CommandExitCodes.Success, countExitCode); + Assert.Equal(string.Empty, countStderr); + using (var document = ParseJsonOutput(countStdout)) + { + var queries = document.RootElement.GetProperty("queries").EnumerateArray().ToArray(); + Assert.Equal(4, Assert.Single(queries, query => query.GetProperty("name").GetString() == "static-regex-api").GetProperty("count").GetInt32()); + Assert.Equal(2, Assert.Single(queries, query => query.GetProperty("name").GetString() == "static-regex-api-qualified").GetProperty("count").GetInt32()); + Assert.Equal(3, Assert.Single(queries, query => query.GetProperty("name").GetString() == "process-shell-execute").GetProperty("count").GetInt32()); + } + + Assert.Equal(CommandExitCodes.Success, constructionExitCode); + Assert.Equal(string.Empty, constructionStderr); + using (var document = ParseJsonOutput(constructionStdout)) + { + var query = Assert.Single(document.RootElement.GetProperty("queries").EnumerateArray()); + Assert.Contains(query.GetProperty("results").EnumerateArray(), result => result.GetProperty("path").GetString() == "src/regex-construction.cs"); + } + + var shadowDbPath = TestProjectHelper.CreateProjectDb(shadowProjectRoot); + TestProjectHelper.InsertIndexedFile( + shadowDbPath, + "src/regex-source-shadow.cs", + "csharp", + """ + namespace Vendor; + + public static class Regex + { + public static string Escape(string input) => input; + } + + public static class RegexSourceShadow + { + public static string Escape(string input) => Regex.Escape(input); + } + """); + using (var db = new DbContext(DbOpenIntent.WriteIndex, shadowDbPath)) + { + db.InitializeSchema(); + var writer = new DbWriter(db.Connection); + writer.MarkGraphReady(); + writer.SetMeta( + DbContext.ReferenceIdentityContractVersionMetaKey, + DbContext.ReferenceIdentityContractVersion.ToString(System.Globalization.CultureInfo.InvariantCulture)); + } + var (shadowExitCode, shadowStdout, shadowStderr) = CaptureConsole(() => QueryCommandRunner.RunSearch( + ["--recipe", "dogfood-risk-patterns", "--include-query", "static-regex-api", "--db", shadowDbPath, "--json", "--limit", "20", "--lang", "csharp"], + _jsonOptions)); + Assert.Equal(CommandExitCodes.Success, shadowExitCode); + Assert.Equal(string.Empty, shadowStderr); + using (var document = ParseJsonOutput(shadowStdout)) + { + var query = Assert.Single(document.RootElement.GetProperty("queries").EnumerateArray()); + Assert.Equal(1, query.GetProperty("count").GetInt32()); + AssertSemanticClassification(query, "src/regex-source-shadow.cs", "regex_operation_semantics", "regex_operation_unresolved", "operation:Regex.Escape"); + } + + var overfetchDbPath = TestProjectHelper.CreateProjectDb(overfetchProjectRoot); + TestProjectHelper.InsertIndexedFile( + overfetchDbPath, + "src/a-risk.cs", + "csharp", + "public static class Risk { public static bool Go(string input) => System.Text.RegularExpressions.Regex.IsMatch(input, \"token\"); }"); + for (var index = 1; index <= 250; index++) + { + TestProjectHelper.InsertIndexedFile( + overfetchDbPath, + $"src/z-safe-{index:D3}.cs", + "csharp", + $"public static class Safe{index} {{ public static string Go(string input) => System.Text.RegularExpressions.Regex.Escape(input); }}"); + } + TestProjectHelper.InsertIndexedFile( + overfetchDbPath, + "src/legacy-unresolved.cs", + "csharp", + "using System.Text.RegularExpressions; public static class LegacySafe { public static string Go(string input) => Regex.Escape(input); }"); + + var (overfetchExitCode, overfetchStdout, overfetchStderr) = CaptureConsole(() => QueryCommandRunner.RunSearch( + ["--recipe", "dogfood-risk-patterns", "--include-query", "static-regex-api-qualified", "--db", overfetchDbPath, "--json", "--limit", "1", "--lang", "csharp"], + _jsonOptions)); + Assert.Equal(CommandExitCodes.Success, overfetchExitCode); + Assert.Equal(string.Empty, overfetchStderr); + using (var document = ParseJsonOutput(overfetchStdout)) + { + var query = Assert.Single(document.RootElement.GetProperty("queries").EnumerateArray()); + Assert.Equal(1, query.GetProperty("count").GetInt32()); + AssertSemanticClassification(query, "src/a-risk.cs", "regex_operation_semantics", "regex_pattern_operation", "operation:System.Text.RegularExpressions.Regex.IsMatch"); + } + + var (legacyExitCode, legacyStdout, legacyStderr) = CaptureConsole(() => QueryCommandRunner.RunSearch( + ["--recipe", "dogfood-risk-patterns", "--include-query", "static-regex-api", "--db", overfetchDbPath, "--json", "--limit", "20", "--lang", "csharp"], + _jsonOptions)); + Assert.Equal(CommandExitCodes.Success, legacyExitCode); + Assert.Equal(string.Empty, legacyStderr); + using (var document = ParseJsonOutput(legacyStdout)) + { + var query = Assert.Single(document.RootElement.GetProperty("queries").EnumerateArray()); + Assert.Equal(1, query.GetProperty("count").GetInt32()); + AssertSemanticClassification(query, "src/legacy-unresolved.cs", "regex_operation_semantics", "regex_operation_unresolved", "operation:Regex.Escape"); + } + } + finally + { + TestProjectHelper.DeleteDirectory(projectRoot); + TestProjectHelper.DeleteDirectory(overfetchProjectRoot); + TestProjectHelper.DeleteDirectory(shadowProjectRoot); + } + + static void AssertSemanticClassification( + JsonElement query, + string path, + string expectedClassifier, + string expectedCategory, + string expectedEvidence) + { + var result = Assert.Single(query.GetProperty("results").EnumerateArray(), item => item.GetProperty("path").GetString() == path); + var classification = Assert.Single(result.GetProperty("audit_classifications").EnumerateArray()); + Assert.Equal(expectedClassifier, classification.GetProperty("classifier").GetString()); + Assert.Equal(expectedCategory, classification.GetProperty("category").GetString()); + Assert.Contains(classification.GetProperty("evidence").EnumerateArray(), evidence => evidence.GetString() == expectedEvidence); + } + + static void AssertClassifierCategories(JsonElement query, string name, params string[] expectedCategories) + { + var classifier = Assert.Single( + query.GetProperty("classifiers").EnumerateArray(), + item => item.GetProperty("name").GetString() == name); + var categories = classifier.GetProperty("categories").EnumerateArray() + .Select(category => category.GetProperty("name").GetString()) + .ToArray(); + foreach (var expectedCategory in expectedCategories) + Assert.Contains(expectedCategory, categories); + } + } + [Fact] public void RunSearch_RegexRecipeClassifiesTimeoutAndGeneratedEvidence_Issue4326() { @@ -7166,7 +7587,7 @@ public void Run(Exception ex, DbCommand command, Type pluginType) redirectStandardError: true); SubprocessEnvironmentPolicy.ApplyGitEnvironment(startInfo); startInfo.ArgumentList.Add("--info"); - startInfo.UseShellExecute = false; + startInfo.UseShellExecute = true; startInfo.WorkingDirectory = Environment.CurrentDirectory; startInfo.RedirectStandardOutput = true; startInfo.RedirectStandardError = true;