Feat/csharp integration

pom.xml

@@ -13,7 +13,7 @@
         <maven.compiler.release>21</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-        <sonar.crypto.plugin.version>1.5.1</sonar.crypto.plugin.version>
+        <sonar.crypto.plugin.version>2.0.0-SNAPSHOT</sonar.crypto.plugin.version>
         <sonar.plugin.api.version>13.4.3.4290</sonar.plugin.api.version>
         <sonar.plugin.api.impl.version>25.8.0.112029</sonar.plugin.api.impl.version>
 

src/main/java/org/pqca/indexing/csharp/CSharpBuildType.java

@@ -0,0 +1,26 @@
+/*
+ * CBOMkit-lib
+ * Copyright (C) 2025 PQCA
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pqca.indexing.csharp;
+
+import org.pqca.indexing.IBuildType;
+
+public enum CSharpBuildType implements IBuildType {
+    CSPROJ
+}

src/main/java/org/pqca/indexing/csharp/CSharpIndexService.java

@@ -0,0 +1,72 @@
+/*
+ * CBOMkit-lib
+ * Copyright (C) 2024 PQCA
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pqca.indexing.csharp;
+
+import jakarta.annotation.Nonnull;
+import java.io.File;
+import java.util.List;
+import javax.annotation.Nullable;
+import org.pqca.indexing.IBuildType;
+import org.pqca.indexing.IndexingService;
+import org.pqca.progress.IProgressDispatcher;
+
+public final class CSharpIndexService extends IndexingService {
+
+    public CSharpIndexService(@Nonnull File baseDirectory) {
+        this(null, baseDirectory);
+    }
+
+    public CSharpIndexService(
+            @Nullable IProgressDispatcher progressDispatcher, @Nonnull File baseDirectory) {
+        super(progressDispatcher, baseDirectory, "cs", ".cs");
+        this.setExcludePatterns(null);
+    }
+
+    public void setExcludePatterns(@Nullable List<String> patterns) {
+        if (patterns == null) {
+            super.setExcludePatterns(List.of("tests/", "Tests$"));
+        } else {
+            super.setExcludePatterns(patterns);
+        }
+    }
+
+    @Override
+    public boolean isModule(@Nonnull File directory) {
+        if (!directory.isDirectory()) {
+            return false;
+        }
+
+        final File file = new File(directory, directory.getName() + ".csproj");
+        return file.exists() && file.isFile();
+    }
+
+    @Override
+    @Nullable public IBuildType getMainBuildTypeFromModuleDirectory(@Nonnull File directory) {
+        if (!directory.isDirectory()) {
+            return null;
+        }
+        // csproj
+        final File csProjFile = new File(directory, directory.getName() + ".csproj");
+        if (csProjFile.exists() && csProjFile.isFile()) {
+            return CSharpBuildType.CSPROJ;
+        }
+        return null;
+    }
+}

src/main/java/org/pqca/scanning/Language.java

@@ -22,5 +22,6 @@
 public enum Language {
     JAVA,
     PYTHON,
-    GO
+    GO,
+    CSHARP
 }

src/main/java/org/pqca/scanning/csharp/CSharpDetectionCollectionRule.java

@@ -0,0 +1,47 @@
+/*
+ * CBOMkit-lib
+ * Copyright (C) 2024 PQCA
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pqca.scanning.csharp;
+
+import com.ibm.engine.detection.Finding;
+import com.ibm.engine.language.csharp.CSharpCheck;
+import com.ibm.engine.language.csharp.CSharpScanContext;
+import com.ibm.engine.language.csharp.CSharpSymbol;
+import com.ibm.engine.language.csharp.tree.CSharpTree;
+import com.ibm.mapper.model.INode;
+import com.ibm.plugin.rules.CSharpInventoryRule;
+import jakarta.annotation.Nonnull;
+import java.util.List;
+import java.util.function.Consumer;
+
+public class CSharpDetectionCollectionRule extends CSharpInventoryRule {
+    private final Consumer<List<INode>> handler;
+
+    public CSharpDetectionCollectionRule(@Nonnull Consumer<List<INode>> findingConsumer) {
+        this.handler = findingConsumer;
+    }
+
+    @Override
+    public void update(
+            @Nonnull Finding<CSharpCheck, CSharpTree, CSharpSymbol, CSharpScanContext> finding) {
+        super.update(finding);
+        final List<INode> nodes = csharpTranslationProcess.initiate(finding.detectionStore());
+        handler.accept(nodes);
+    }
+}

src/main/java/org/pqca/scanning/csharp/CSharpScannerService.java

@@ -0,0 +1,95 @@
+/*
+ * CBOMkit-lib
+ * Copyright (C) 2026 PQCA
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pqca.scanning.csharp;
+
+import com.ibm.engine.language.csharp.CSharpCheck;
+import com.ibm.plugin.CryptoCSharpSensor;
+import jakarta.annotation.Nonnull;
+import jakarta.annotation.Nullable;
+import java.io.File;
+import java.util.Collection;
+import java.util.List;
+import org.pqca.errors.ClientDisconnected;
+import org.pqca.indexing.ProjectModule;
+import org.pqca.progress.IProgressDispatcher;
+import org.pqca.progress.ProgressMessage;
+import org.pqca.progress.ProgressMessageType;
+import org.pqca.scanning.CBOM;
+import org.pqca.scanning.ScanResultDTO;
+import org.pqca.scanning.ScannerService;
+import org.sonar.api.batch.fs.InputFile;
+import org.sonar.api.batch.sensor.SensorContext;
+import org.sonar.api.batch.sensor.internal.SensorContextTester;
+
+public final class CSharpScannerService extends ScannerService {
+
+    public CSharpScannerService(@Nonnull File projectDirectory) {
+        this(null, projectDirectory);
+    }
+
+    public CSharpScannerService(
+            @Nullable IProgressDispatcher progressDispatcher, @Nonnull File projectDirectory) {
+        super(progressDispatcher, projectDirectory);
+    }
+
+    @Override
+    public @Nonnull ScanResultDTO scan(@Nonnull List<ProjectModule> index)
+            throws ClientDisconnected {
+        LOGGER.info("Start scanning {} C# projects", index.size());
+
+        long scanTimeStart = System.currentTimeMillis();
+        int counter = 1;
+        int numberOfScannedLines = 0;
+        int numberOfScannedFiles = 0;
+
+        CSharpCheck visitor = new CSharpDetectionCollectionRule(this);
+        Collection<CSharpCheck> checks = List.of(visitor);
+        final SensorContextTester sensorContext = SensorContextTester.create(projectDirectory);
+        // C# scanner (CryptoCSharpSensor) reads files from context
+        index.forEach(project -> project.inputFileList().forEach(sensorContext.fileSystem()::add));
+
+        for (ProjectModule project : index) {
+            numberOfScannedFiles += project.inputFileList().size();
+            numberOfScannedLines +=
+                    project.inputFileList().stream().mapToInt(InputFile::lines).sum();
+
+            final String projectStr =
+                    project.identifier() + " (" + counter + "/" + index.size() + ")";
+            if (this.progressDispatcher != null) {
+                this.progressDispatcher.send(
+                        new ProgressMessage(
+                                ProgressMessageType.LABEL, "Scanning C# project " + projectStr));
+            }
+            LOGGER.info("Scanning C# project {}", projectStr);
+
+            CryptoCSharpSensor.execute((SensorContext) sensorContext, checks);
+
+            counter += 1;
+        }
+        LOGGER.info("Scanned {} C# projects", index.size());
+
+        return new ScanResultDTO(
+                scanTimeStart,
+                System.currentTimeMillis(),
+                numberOfScannedLines,
+                numberOfScannedFiles,
+                this.getBOM().map(CBOM::new).orElse(null));
+    }
+}

src/main/java/org/pqca/scanning/go/GoScannerService.java

@@ -134,7 +134,6 @@ public List<GoCheck> all() {
             return this.checks;
         }
 
-        @SuppressWarnings("null")
         public RuleKey ruleKey(GoCheck check) {
             return RuleKey.of("sonar-cryptography", "go-rule");
         }

src/test/java/org/pqca/indexing/CSharpIndexServiceTest.java

@@ -0,0 +1,52 @@
+/*
+ * CBOMkit-lib
+ * Copyright (C) 2025 PQCA
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pqca.indexing;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.Assert.assertThat;
+
+import java.io.File;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+import org.pqca.errors.ClientDisconnected;
+import org.pqca.indexing.csharp.CSharpIndexService;
+
+class CSharpIndexServiceTest {
+    @Test
+    void testDefaultExclusion() throws ClientDisconnected {
+        final CSharpIndexService csharpIndexService =
+                new CSharpIndexService(new File("src/test/testdata/csharp/dotnet"));
+        final List<ProjectModule> projectModules = csharpIndexService.index(null);
+        assertThat(projectModules).hasSize(1);
+        assertThat(projectModules.getFirst().identifier()).isEqualTo("");
+        assertThat(projectModules.getFirst().inputFileList()).hasSize(12);
+    }
+
+    @Test
+    void testExclusion() throws ClientDisconnected {
+        final CSharpIndexService csharpIndexService =
+                new CSharpIndexService(new File("src/test/testdata/csharp/dotnet"));
+        csharpIndexService.setExcludePatterns(List.of("AES"));
+        final List<ProjectModule> projectModules = csharpIndexService.index(null);
+        assertThat(projectModules).hasSize(1);
+        assertThat(projectModules.getFirst().identifier()).isEqualTo("");
+        assertThat(projectModules.getFirst().inputFileList()).hasSize(10);
+    }
+}

src/test/java/org/pqca/indexing/GoIndexServiceTest.java

@@ -32,11 +32,21 @@ class GoIndexServiceTest {
     @Test
     void testDefaultExclusion() throws ClientDisconnected {
         final GoIndexService goIndexService =
-                new GoIndexService(new File("src/test/testdata/go/simple"));
+                new GoIndexService(new File("src/test/testdata/go/gocrypto"));
         final List<ProjectModule> projectModules = goIndexService.index(null);
         assertThat(projectModules).hasSize(1);
-        assertThat(projectModules.getFirst().inputFileList())
-                .extracting(Object::toString)
-                .containsExactlyInAnyOrder("go.mod", "module1/file.go");
+        assertThat(projectModules.getFirst().identifier()).isEqualTo("");
+        assertThat(projectModules.getFirst().inputFileList()).hasSize(36);
+    }
+
+    @Test
+    void testCustomExclusion() throws ClientDisconnected {
+        final GoIndexService goIndexService =
+                new GoIndexService(new File("src/test/testdata/go/gocrypto"));
+        goIndexService.setExcludePatterns(List.of("RSA"));
+        final List<ProjectModule> projectModules = goIndexService.index(null);
+        assertThat(projectModules).hasSize(1);
+        assertThat(projectModules.getFirst().identifier()).isEqualTo("");
+        assertThat(projectModules.getFirst().inputFileList()).hasSize(31);
     }
 }