class
Analyzer::CSharp::Cli
- Analyzer::CSharp::Cli
- Analyzer
- Reference
- Object
Overview
Surfaces the command-line attack surface of C# programs as cli://
endpoints: one endpoint per (sub)command with named options
(param_type "flag"), positional arguments ("argument") and consumed
environment variables ("env"). Covers Main(string[] args) /
GetCommandLineArgs / GetEnvironmentVariable plus System.CommandLine,
CommandLineParser, CliFx, Spectre.Console.Cli,
McMaster.Extensions.CommandLineUtils and Cocona.
Line-scan analyzer (Go/Ruby/Rust CLI house style) merging endpoints by URL. Subclasses Analyzer directly (there is no C# engine) and reuses Common.csharp_test_path? to skip test files.
Included Modules
Defined in:
analyzer/analyzers/csharp/cli.crConstant Summary
-
ADD_ARG_RECV =
/(\w+)\s*\.\s*AddArgument\s*\(\s*new\s+Argument(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/ -
ADD_COMMAND =
/\.AddCommand(?:<[^>]+>)?\s*\(\s*@?"([^"]+)"/ -
ADD_OPTION_RECV =
/(\w+)\s*\.\s*Add(?:Global)?Option\s*\(\s*new\s+Option(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/ -
ARGUMENT_ATTR =
/\[\s*Argument\s*(?:\(([^\]]*)\))?\s*\]/ -
McMaster / Cocona:
[Argument(0)]/[Argument(0, "name")]/ bare[Argument](Cocona lambda params). Body may hold an explicit quoted name; when absent we fall back to the annotated property or parameter name (same line or the line right below). -
CLI_LIB_MARKERS =
["System.CommandLine", "CliFx", "Spectre.Console.Cli", "McMaster.Extensions.CommandLineUtils"] -
Marker strings must not substring-match unrelated code: a bare "CommandLine" would also hit
Environment.GetCommandLineArgs(or any comment), qualifying a web app as a framework CLI and leaking its env reads. CommandLineParser is matched via itsusing CommandLine/CommandLine.Parsernamespace forms instead (same shape the cs_cli detector uses). Cocona is matched via itsusing Cocona/CoconaApp.*forms for the same reason ("Cocona" alone is specific enough as a substring, but we keep the same regex shape for consistency). -
CLP_NAMESPACE =
/\busing\s+CommandLine\b|\bCommandLine\.Parser\b|\bParser\.Default\.ParseArguments\b/ -
COCONA_NAMESPACE =
/\busing\s+Cocona\b|\bCoconaApp\.(?:Create|Run)\b/ -
COMMAND_VAR =
/(\w+)\s*=\s*new\s+Command\s*\(\s*@?"([^"]+)"/ -
GET_CMD_ARGS =
/\bEnvironment\.GetCommandLineArgs\s*\(/ -
GET_ENV =
/\bEnvironment\.GetEnvironmentVariable\s*\(\s*@?"([^"]+)"/ -
builtin.
-
MAIN_ARGS =
/\bstatic\s+(?:async\s+)?(?:int|void|Task(?:<int>)?)\s+Main\s*\(\s*string\s*\[\s*\]\s+(\w+)\s*\)/ -
NEW_ARGUMENT =
/\bnew\s+Argument(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/ -
NEW_COMMAND =
/\bnew\s+Command\s*\(\s*@?"([^"]+)"/ -
NEW_OPTION =
/\bnew\s+Option(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/ -
OPTION_ATTR =
/\[\s*(?:Option|CommandOption)\s*(?:\(([^\]]*)\))?\s*\]/ -
Parenthesized body is optional so a bare
[Option](McMaster/Cocona, name taken from the annotated member) is matched too. -
PARAM_ATTR =
/\[\s*CommandParameter\s*\(([^\]]*)\)/ -
PROPERTY_NEXTLINE =
/\A\s*(?:public\s+)?\S+\s+(\w+)\s*[{;,)]/ -
PROPERTY_TRAILING =
/\A\s*\]?\s*(?:public\s+)?\S+\s+(\w+)/ -
Trailing "type name" right after a matched attribute's tail (an optional leftover "]" is skipped first since Option/Argument attr regexes above don't always consume it).
-
ROOT_COMMAND =
/\bnew\s+RootCommand\b/ -
System.CommandLine (builder). Variable-mapped: a command/option binds to its receiver variable, so root options declared after a subcommand aren't mis-attributed to the subcommand.
-
ROOT_VAR =
/(\w+)\s*=\s*new\s+RootCommand\b/ -
VERB_ATTR =
/\[\s*(?:Verb|Command)\s*\(\s*@?"([^"]+)"/ -
Attribute-driven libs (CommandLineParser / CliFx / Spectre / airline-ish / McMaster.Extensions.CommandLineUtils / Cocona).
-
WEB_HOST_RE =
/\bWebApplication\.(?:Create(?:Builder|SlimBuilder|EmptyBuilder)?|CreateDefault)\b|\bnew\s+HttpListener\b|\.MapGet\s*\(|\.MapControllers\s*\(|\[\s*ApiController\s*\]|:\s*ControllerBase\b|\bHost\.CreateDefaultBuilder\b/