fix: runtime versions overwriting nuget versions (#228)

snyk · Nov 13, 2024 · f035713 · f035713
1 parent 4863512
commit f035713
Show file tree

Hide file tree

Showing 8 changed files with 814 additions and 4 deletions.
diff --git a/lib/nuget-parser/parsers/dotnet-core-v2-parser.ts b/lib/nuget-parser/parsers/dotnet-core-v2-parser.ts
@@ -110,6 +110,22 @@ function getRestoredProjectName(
   );
 }
 
+export function extractLocalProjects(libs: Record<string, any>): string[] {
+  const localPackages: string[] = [];
+
+  for (const [key, value] of Object.entries(libs)) {
+    if (!key.includes('runtimepack')) {
+      // Local projects (.csproj files) don't have values declared for these two properties.
+      // https://github.com/dotnet/sdk/blob/main/documentation/specs/runtime-configuration-file.md#libraries-section-depsjson
+      if (!value.serviceable && !value.sha512 && value.type === 'project') {
+        localPackages.push(key);
+      }
+    }
+  }
+
+  return localPackages;
+}
+
 function buildGraph(
   projectName: string,
   projectAssets: ProjectAssets,
@@ -162,7 +178,7 @@ function buildGraph(
 
   // Find names and versions of all dependencies of the root package. These are already structured correctly in
   // the deps.json generated by `dotnet publish`.
-  const topLevelDepPackages =
+  const topLevelDepPackages: Record<string, string> =
     publishedProjectDeps.targets[runtimeTarget][restoreProjectName]
       .dependencies;
 
@@ -179,6 +195,28 @@ function buildGraph(
     dependencies: topLevelDepPackages,
   } as DotnetPackage;
 
+  // runtimeAssembly doesn't have entries if the target framework is `netstandard`
+  if (Object.keys(runtimeAssembly).length > 0) {
+    const localPackagesNames = extractLocalProjects(
+      publishedProjectDeps.libraries,
+    );
+
+    // Overwriting the runtime versions with the versions declared in the manifest files.
+    const targets = publishedProjectDeps.targets[runtimeTarget];
+    for (const pgkName of localPackagesNames) {
+      if (targets[pgkName]?.dependencies) {
+        for (const [key, value] of Object.entries(
+          targets[pgkName].dependencies,
+        )) {
+          const dllName = `${key}.dll`;
+          if (runtimeAssembly[dllName]) {
+            runtimeAssembly[dllName] = value as string;
+          }
+        }
+      }
+    }
+  }
+
   recursivelyPopulateNodes(
     depGraphBuilder,
     targetDependencies,

diff --git a/test/fixtures/dotnetcore/dotnet_6_local_package_reference/proj1/expected_depgraph.json b/test/fixtures/dotnetcore/dotnet_6_local_package_reference/proj1/expected_depgraph.json
@@ -489,10 +489,10 @@
         }
       },
       {
-        "id": "System.Text.Encodings.Web@6.0.0",
+        "id": "System.Text.Encodings.Web@4.7.2",
         "info": {
           "name": "System.Text.Encodings.Web",
-          "version": "6.0.0"
+          "version": "4.7.2"
         }
       }
     ],
@@ -2746,7 +2746,7 @@
         },
         {
           "nodeId": "[email protected]",
-          "pkgId": "System.Text.Encodings.Web@6.0.0",
+          "pkgId": "System.Text.Encodings.Web@4.7.2",
           "deps": []
         }
       ]

diff --git a/test/fixtures/dotnetcore/dotnet_8_false_positive/FirstProject/dotnet_8_false_positive.csproj b/test/fixtures/dotnetcore/dotnet_8_false_positive/FirstProject/dotnet_8_false_positive.csproj
@@ -0,0 +1,17 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="System.Text.Json" Version="8.0.4" />
+    <PackageReference Include="Aspire.RabbitMQ.Client" Version="8.2.2" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference
+      Include="..\SecondProject\dotnet_8_second_project.csproj"
+    />
+  </ItemGroup>
+</Project>