C#: DependabotProxy now parses replaces-base and exposes a list of URLs to replace the default NuGet feed.

Author: michaelnebel

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependabotProxy.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Collections.Immutable;
 using System.Collections.Generic;
 using System.IO;
 using System.Security.Cryptography.X509Certificates;
@@ -14,13 +15,39 @@ public class DependabotProxy : IDependabotProxy
         /// <summary>
         /// Represents configurations for package registries.
         /// </summary>
-        /// <param name="Type">The type of package registry.</param>
-        /// <param name="URL">The URL of the package registry.</param>
-        public record class RegistryConfig(string Type, string URL);
+        public class RegistryConfig
+        {
+            /// <summary>
+            /// The type of the package registry.
+            /// </summary>
+            public string Type { get; init; } = "";
+
+            /// <summary>
+            /// The URL of the package registry.
+            /// </summary>
+            public string URL { get; init; } = "";
+
+            /// <summary>
+            /// A boolean indicating whether this registry replaces the base registry.
+            /// </summary>
+            [JsonProperty("replaces-base")]
+            public bool ReplacesBase { get; init; } = false;
+        };
 
         public string Address { get; }
 
-        public HashSet<string> RegistryURLs { get; } = [];
+        /// <summary>
+        /// A dictionary mapping registry URLs to a boolean indicating whether they replace the base registry.
+        /// </summary>
+        private readonly Dictionary<string, bool> registryMapping = [];
+
+        private ImmutableHashSet<string>? registryURLs;
+        public ImmutableHashSet<string> RegistryURLs =>
+            registryURLs ??= registryMapping.Keys.ToImmutableHashSet();
+
+        private ImmutableHashSet<string>? registryBaseURLs;
+        public ImmutableHashSet<string> RegistryBaseURLs =>
+            registryBaseURLs ??= registryMapping.Where(kvp => kvp.Value).Select(kvp => kvp.Key).ToImmutableHashSet();
 
         public string? CertificatePath { get; private set; }
 
@@ -65,7 +92,7 @@ private DependabotProxy(IDependabotProxyConfiguration config, ILogger logger, Te
                             }
 
                             logger.LogInfo($"Found private registry at '{registry.URL}'");
-                            RegistryURLs.Add(registry.URL);
+                            registryMapping.AddOrUpdateToLatest(registry.URL, registry.ReplacesBase);
                         }
                     }
                 }

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FeedManager.cs

@@ -78,7 +78,7 @@ public FeedManager(ILogger logger, IDotNet dotnet, IDependabotProxy? dependabotP
             this.dotnet = dotnet;
             this.fileProvider = fileProvider;
             this.feedManagerIo = feedManagerIo;
-            privateRegistryFeeds = dependabotProxy?.RegistryURLs.ToImmutableHashSet() ?? [];
+            privateRegistryFeeds = dependabotProxy?.RegistryURLs ?? [];
             HasPrivateRegistryFeeds = privateRegistryFeeds.Count > 0;
             emptyPackageDirectory = new DependencyDirectory("empty", "empty package", logger);
 

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDependabotProxy.cs

@@ -1,5 +1,5 @@
 using System;
-using System.Collections.Generic;
+using System.Collections.Immutable;
 using System.Security.Cryptography.X509Certificates;
 
 namespace Semmle.Extraction.CSharp.DependencyFetching
@@ -14,7 +14,12 @@ public interface IDependabotProxy : IDisposable
         /// <summary>
         /// The URLs of package registries that are configured for the proxy.
         /// </summary>
-        HashSet<string> RegistryURLs { get; }
+        ImmutableHashSet<string> RegistryURLs { get; }
+
+        /// <summary>
+        /// The URLs of package registries that replace the base registry.
+        /// </summary>
+        ImmutableHashSet<string> RegistryBaseURLs { get; }
 
         /// <summary>
         /// The path to the temporary file where the certificate is stored.

csharp/extractor/Semmle.Extraction.Tests/DependabotProxy.cs

@@ -135,7 +135,8 @@ public void TestDependabotRegistryUrls1()
 
             // Verify
             Assert.NotNull(proxy);
-            Assert.Equal([], proxy.RegistryURLs);
+            Assert.Empty(proxy.RegistryURLs);
+            Assert.Empty(proxy.RegistryBaseURLs);
         }
 
         [Fact]
@@ -158,6 +159,7 @@ public void TestDependabotRegistryUrls2()
             Assert.Equal([
                 "https://nuget.pkg.github.com/org/index.json"
             ], proxy.RegistryURLs);
+            Assert.Empty(proxy.RegistryBaseURLs);
         }
 
         [Fact]
@@ -180,6 +182,33 @@ public void TestDependabotRegistryUrls3()
             Assert.Equal([
                 "https://example.com/org/index.json"
             ], proxy.RegistryURLs);
+            Assert.Empty(proxy.RegistryBaseURLs);
+        }
+
+        [Fact]
+        public void TestDependabotReplacesBase1()
+        {
+            // Setup
+            var config = new DependabotConfigurationStub
+            {
+                Port = "8080",
+                Host = "localhost",
+                RegistryURLs = "[ { \"type\": \"nuget_feed\", \"url\": \"https://example.com/org/index.json\", \"replaces-base\": true }, { \"type\": \"nuget_feed\", \"url\": \"https://example2.com/org/index.json\", \"replaces-base\": false } ]"
+            };
+
+            // Execute
+            using var tempWorkingDirectory = MakeTemporaryDirectory();
+            using var proxy = DependabotProxy.Make(config, new LoggerStub(), new DiagnosticsWriterStub(), tempWorkingDirectory);
+
+            // Verify
+            Assert.NotNull(proxy);
+            Assert.Equal([
+                "https://example.com/org/index.json",
+                "https://example2.com/org/index.json"
+            ], proxy.RegistryURLs);
+            Assert.Equal([
+                "https://example.com/org/index.json",
+            ], proxy.RegistryBaseURLs);
         }
     }
 }

csharp/extractor/Semmle.Extraction.Tests/FeedManager.cs

@@ -4,13 +4,15 @@
 using System.IO;
 using System.Linq;
 using Semmle.Extraction.CSharp.DependencyFetching;
+using System.Collections.Immutable;
 
 namespace Semmle.Extraction.Tests
 {
     public class DependabotProxyStub : IDependabotProxy
     {
         public string Address { get; } = "";
-        public HashSet<string> RegistryURLs { get; } = ["https://example.com/registry1", "https://example.com/registry2"];
+        public ImmutableHashSet<string> RegistryURLs { get; } = ["https://example.com/registry1", "https://example.com/registry2"];
+        public ImmutableHashSet<string> RegistryBaseURLs { get; } = [];
         public string? CertificatePath { get; } = null;
         public System.Security.Cryptography.X509Certificates.X509Certificate2? Certificate { get; } = null;