C#: Make a complete replacement of the default nuget.org feed in case private registries with replaces-base: true is set.

Author: michaelnebel

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FeedManager.cs

@@ -10,13 +10,17 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
 {
     internal sealed partial class FeedManager : IDisposable
     {
-        internal const string PublicNugetOrgFeed = "https://api.nuget.org/v3/index.json";
+        private const string PublicNugetOrg = "nuget.org";
+        private const string PublicDotNugetOrg = $".{PublicNugetOrg}";
+        internal const string PublicApiNugetOrgFeed = $"https://api{PublicDotNugetOrg}/v3/index.json";
 
         private readonly ILogger logger;
         private readonly IDotNet dotnet;
         private readonly IFileProvider fileProvider;
         private readonly DependencyDirectory emptyPackageDirectory;
         private readonly ImmutableHashSet<string> privateRegistryFeeds;
+        private readonly bool hasPrivateRegistryBaseFeeds;
+        private readonly ImmutableHashSet<string> privateRegistryBaseFeeds;
         private readonly IFeedManagerIO feedManagerIo;
 
         /// <summary>
@@ -93,9 +97,12 @@ public FeedManager(ILogger logger, IDotNet dotnet, IDependabotProxy? dependabotP
             this.feedManagerIo = feedManagerIo;
             privateRegistryFeeds = dependabotProxy?.RegistryURLs ?? [];
             HasPrivateRegistryFeeds = privateRegistryFeeds.Count > 0;
-            DefaultFeeds = dependabotProxy?.RegistryBaseURLs.Any() == true
-                ? dependabotProxy.RegistryBaseURLs
-                : [PublicNugetOrgFeed];
+            privateRegistryBaseFeeds = dependabotProxy?.RegistryBaseURLs ?? [];
+            hasPrivateRegistryBaseFeeds = privateRegistryBaseFeeds.Count > 0;
+
+            DefaultFeeds = hasPrivateRegistryBaseFeeds
+                ? privateRegistryBaseFeeds
+                : [PublicApiNugetOrgFeed];
             emptyPackageDirectory = new DependencyDirectory("empty", "empty package", logger);
 
             lazyExplicitFeeds = new Lazy<ImmutableHashSet<string>>(GetExplicitFeeds);
@@ -120,6 +127,20 @@ public FeedManager(ILogger logger, IDotNet dotnet, IDependabotProxy? dependabotP
         {
         }
 
+        private bool IsNugetOrgFeed(string url)
+        {
+            try
+            {
+                var uri = new Uri(url);
+                return uri.Host.EndsWith(PublicDotNugetOrg, StringComparison.InvariantCultureIgnoreCase) ||
+                    string.Equals(uri.Host, PublicNugetOrg, StringComparison.InvariantCultureIgnoreCase);
+            }
+            catch (UriFormatException)
+            {
+                return false;
+            }
+        }
+
         private IEnumerable<string> GetFeeds(Func<IList<string>> getNugetFeeds)
         {
             var results = getNugetFeeds();
@@ -141,6 +162,17 @@ private IEnumerable<string> GetFeeds(Func<IList<string>> getNugetFeeds)
                     continue;
                 }
 
+                if (hasPrivateRegistryBaseFeeds && IsNugetOrgFeed(url))
+                {
+                    // Use private registry base feeds.
+                    foreach (var feed in privateRegistryBaseFeeds)
+                    {
+                        logger.LogDebug($"Using private registry base feed '{feed}'.");
+                        yield return feed;
+                    }
+                    continue;
+                }
+
                 yield return url;
             }
         }

csharp/extractor/Semmle.Extraction.Tests/FeedManager.cs

@@ -246,5 +246,62 @@ public void TestDefaultFeeds2()
                 "https://example.com/base2"
             ], reachableFallback);
         }
+
+        [Fact]
+        public void TestNugetOrg()
+        {
+            // Setup
+            var logger = new LoggerStub();
+            var dotnet = new DotNetStub([], [], [], ["E https://api.nuget.org/v3/index.json"]);
+            var dependabotProxy = new DependabotProxyStub();
+            var fileProvider = new FileProviderStub();
+            var feedManagerIo = new FeedManagerIOStub(["https://example.com/registry2", "https://example.com/base1"]);
+            var feedManager = new FeedManager(logger, dotnet, dependabotProxy, fileProvider, feedManagerIo);
+
+            // Execute
+            var explicitFeeds = feedManager.ExplicitFeeds;
+            var allFeeds = feedManager.AllFeeds;
+
+            // Verify
+            Assert.Equal([
+                "https://example.com/registry1",
+                "https://example.com/registry2",
+            ], explicitFeeds);
+            Assert.Equal([
+                "https://example.com/registry1",
+                "https://example.com/registry2",
+                "https://api.nuget.org/v3/index.json"
+            ], allFeeds);
+
+        }
+        [Fact]
+        public void TestNugetOrgReplacement()
+        {
+            // Setup
+            var logger = new LoggerStub();
+            var dotnet = new DotNetStub([], [], ["E https://api.nuget.org/v3/index.json"], ["E https://api.nuget.org/v3/index.json"]);
+            var dependabotProxy = new DependabotProxyStubWithBaseUrls();
+            var fileProvider = new FileProviderStub();
+            var feedManagerIo = new FeedManagerIOStub(["https://example.com/registry2", "https://example.com/base1"]);
+            var feedManager = new FeedManager(logger, dotnet, dependabotProxy, fileProvider, feedManagerIo);
+
+            // Execute
+            var explicitFeeds = feedManager.ExplicitFeeds;
+            var allFeeds = feedManager.AllFeeds;
+
+            // Verify
+            Assert.Equal([
+                "https://example.com/base1",
+                "https://example.com/base2",
+                "https://example.com/registry1",
+                "https://example.com/registry2"
+            ], explicitFeeds);
+            Assert.Equal([
+                "https://example.com/base1",
+                "https://example.com/base2",
+                "https://example.com/registry1",
+                "https://example.com/registry2",
+            ], allFeeds);
+        }
     }
 }