class Analyzer::CSharp::Cli

Overview

Surfaces the command-line attack surface of C# programs as cli:// endpoints: one endpoint per (sub)command with named options (param_type "flag"), positional arguments ("argument") and consumed environment variables ("env"). Covers Main(string[] args) / GetCommandLineArgs / GetEnvironmentVariable plus System.CommandLine, CommandLineParser, CliFx, Spectre.Console.Cli, McMaster.Extensions.CommandLineUtils and Cocona.

Line-scan analyzer (Go/Ruby/Rust CLI house style) merging endpoints by URL. Subclasses Analyzer directly (there is no C# engine) and reuses Common.csharp_test_path? to skip test files.

Included Modules

Defined in:

analyzer/analyzers/csharp/cli.cr

Constant Summary

ADD_ARG_RECV = /(\w+)\s*\.\s*AddArgument\s*\(\s*new\s+Argument(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/
ADD_COMMAND = /\.AddCommand(?:<[^>]+>)?\s*\(\s*@?"([^"]+)"/
ADD_OPTION_RECV = /(\w+)\s*\.\s*Add(?:Global)?Option\s*\(\s*new\s+Option(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/
ARGUMENT_ATTR = /\[\s*Argument\s*(?:\(([^\]]*)\))?\s*\]/

McMaster / Cocona: [Argument(0)] / [Argument(0, "name")] / bare [Argument] (Cocona lambda params). Body may hold an explicit quoted name; when absent we fall back to the annotated property or parameter name (same line or the line right below).

CLI_LIB_MARKERS = ["System.CommandLine", "CliFx", "Spectre.Console.Cli", "McMaster.Extensions.CommandLineUtils"]

Marker strings must not substring-match unrelated code: a bare "CommandLine" would also hit Environment.GetCommandLineArgs (or any comment), qualifying a web app as a framework CLI and leaking its env reads. CommandLineParser is matched via its using CommandLine / CommandLine.Parser namespace forms instead (same shape the cs_cli detector uses). Cocona is matched via its using Cocona / CoconaApp.* forms for the same reason ("Cocona" alone is specific enough as a substring, but we keep the same regex shape for consistency).

CLP_NAMESPACE = /\busing\s+CommandLine\b|\bCommandLine\.Parser\b|\bParser\.Default\.ParseArguments\b/
COCONA_NAMESPACE = /\busing\s+Cocona\b|\bCoconaApp\.(?:Create|Run)\b/
COMMAND_VAR = /(\w+)\s*=\s*new\s+Command\s*\(\s*@?"([^"]+)"/
GET_CMD_ARGS = /\bEnvironment\.GetCommandLineArgs\s*\(/
GET_ENV = /\bEnvironment\.GetEnvironmentVariable\s*\(\s*@?"([^"]+)"/

builtin.

MAIN_ARGS = /\bstatic\s+(?:async\s+)?(?:int|void|Task(?:<int>)?)\s+Main\s*\(\s*string\s*\[\s*\]\s+(\w+)\s*\)/
NEW_ARGUMENT = /\bnew\s+Argument(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/
NEW_COMMAND = /\bnew\s+Command\s*\(\s*@?"([^"]+)"/
NEW_OPTION = /\bnew\s+Option(?:<[^>]*>)?\s*\(\s*@?"([^"]+)"/
OPTION_ATTR = /\[\s*(?:Option|CommandOption)\s*(?:\(([^\]]*)\))?\s*\]/

Parenthesized body is optional so a bare [Option] (McMaster/Cocona, name taken from the annotated member) is matched too.

PARAM_ATTR = /\[\s*CommandParameter\s*\(([^\]]*)\)/
PROPERTY_NEXTLINE = /\A\s*(?:public\s+)?\S+\s+(\w+)\s*[{;,)]/
PROPERTY_TRAILING = /\A\s*\]?\s*(?:public\s+)?\S+\s+(\w+)/

Trailing "type name" right after a matched attribute's tail (an optional leftover "]" is skipped first since Option/Argument attr regexes above don't always consume it).

ROOT_COMMAND = /\bnew\s+RootCommand\b/

System.CommandLine (builder). Variable-mapped: a command/option binds to its receiver variable, so root options declared after a subcommand aren't mis-attributed to the subcommand.

ROOT_VAR = /(\w+)\s*=\s*new\s+RootCommand\b/
VERB_ATTR = /\[\s*(?:Verb|Command)\s*\(\s*@?"([^"]+)"/

Attribute-driven libs (CommandLineParser / CliFx / Spectre / airline-ish / McMaster.Extensions.CommandLineUtils / Cocona).

WEB_HOST_RE = /\bWebApplication\.(?:Create(?:Builder|SlimBuilder|EmptyBuilder)?|CreateDefault)\b|\bnew\s+HttpListener\b|\.MapGet\s*\(|\.MapControllers\s*\(|\[\s*ApiController\s*\]|:\s*ControllerBase\b|\bHost\.CreateDefaultBuilder\b/

Instance Method Summary

Class methods inherited from module Analyzer::CSharp::Common

csharp_service_type?(type_name : String) : Bool csharp_service_type?, csharp_test_path?(path : String) : Bool csharp_test_path?

Instance methods inherited from class Analyzer

analyze analyze, base_path : String base_path, base_paths : Array(String) base_paths, callees_needed? : Bool callees_needed?, http_header_name(name : String) : String | Nil http_header_name, line_number_for_index(content : String, char_index : Int32) : Int32 line_number_for_index, logger : NoirLogger logger, parallel_analyze(files : Array(String), &block : String -> Nil) parallel_analyze, read_file_content(path : String) : String read_file_content, result : Array(Endpoint) result, unique_params(params : Array(Param)) : Array(Param) unique_params, url : String url, web_root_path(path : String, markers : Array(String)) : String web_root_path

Constructor methods inherited from class Analyzer

new(options : Hash(String, YAML::Any)) new

Instance methods inherited from module FileHelper

all_files : Array(String) all_files, get_files_by_extension(extension : String) : Array(String) get_files_by_extension, get_files_by_extensions(extensions : Array(String)) : Array(String) get_files_by_extensions, get_files_by_prefix(prefix : String) : Array(String) get_files_by_prefix, get_files_by_prefix_and_extension(prefix : String, extension : String) : Array(String) get_files_by_prefix_and_extension, get_public_dir_files(base_path : String, folder : String) : Array(String) get_public_dir_files, get_public_files(base_path : String, anchors : Array(String) = ["shard.yml", "Gemfile"]) : Array(String) get_public_files

Instance Method Detail

def analyze #

[View source]