microsoft / microsoft/component-detection
Improving Nuget detectors to track packages being consumed.
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
Per OSE support thread "MerlinBot doesn't read PackageReferences correctly?", they're wondering if the nuget detectors can be improved to only look at packages being consumed instead of looking at csproj files in isolation.
Interesting points from my conversation with Parker:
- NET has assembly binding redirects that can be applied so that even if the app or a dependency asks for a vulnerable version, and Nuget downloads one, only non-vulnerable versions may be packaged or consumed
- .NET Core can also do this, but with different settings and with and assets.jsons rather than packages.config.
Would it be possible to leverage something like this to improve our nuget detectors?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by reviewing the NuGet detector behavior and comparing how packages are represented in csproj files, packages.config, .NET Core assets.json files, and assembly binding redirects. Done should mean detectors identify packages actually consumed or packaged rather than relying on csproj files in isolation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100