Merge pull request #14545 from tamasvajk/standalone/remove-netstandard.library.ref

C#: Handle `netstandard` references in standalone extraction

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyManager.cs

@@ -99,6 +99,8 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
 
             var existsNetCoreRefNugetPackage = false;
             var existsNetFrameworkRefNugetPackage = false;
+            var existsNetstandardLibRefNugetPackage = false;
+            var existsNetstandardLibNugetPackage = false;
 
             // Find DLLs in the .Net / Asp.Net Framework
             // This block needs to come after the nuget restore, because the nuget restore might fetch the .NET Core/Framework reference assemblies.
@@ -106,8 +108,13 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
             {
                 existsNetCoreRefNugetPackage = IsNugetPackageAvailable("microsoft.netcore.app.ref");
                 existsNetFrameworkRefNugetPackage = IsNugetPackageAvailable("microsoft.netframework.referenceassemblies");
+                existsNetstandardLibRefNugetPackage = IsNugetPackageAvailable("netstandard.library.ref");
+                existsNetstandardLibNugetPackage = IsNugetPackageAvailable("netstandard.library");
 
-                if (existsNetCoreRefNugetPackage || existsNetFrameworkRefNugetPackage)
+                if (existsNetCoreRefNugetPackage
+                    || existsNetFrameworkRefNugetPackage
+                    || existsNetstandardLibRefNugetPackage
+                    || existsNetstandardLibNugetPackage)
                 {
                     progressMonitor.LogInfo("Found .NET Core/Framework DLLs in NuGet packages. Not adding installation directory.");
                 }
@@ -125,7 +132,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                 UseReference(filename);
             }
 
-            RemoveUnnecessaryNugetPackages(existsNetCoreRefNugetPackage, existsNetFrameworkRefNugetPackage);
+            RemoveUnnecessaryNugetPackages(existsNetCoreRefNugetPackage, existsNetFrameworkRefNugetPackage, existsNetstandardLibRefNugetPackage, existsNetstandardLibNugetPackage);
             ResolveConflicts();
 
             // Output the findings
@@ -160,7 +167,8 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                 DateTime.Now - startTime);
         }
 
-        private void RemoveUnnecessaryNugetPackages(bool existsNetCoreRefNugetPackage, bool existsNetFrameworkRefNugetPackage)
+        private void RemoveUnnecessaryNugetPackages(bool existsNetCoreRefNugetPackage, bool existsNetFrameworkRefNugetPackage,
+            bool existsNetstandardLibRefNugetPackage, bool existsNetstandardLibNugetPackage)
         {
             RemoveNugetAnalyzerReferences();
             RemoveRuntimeNugetPackageReferences();
@@ -172,10 +180,38 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                 RemoveNugetPackageReference("microsoft.aspnetcore.app.ref");
             }
 
-            if (existsNetCoreRefNugetPackage && existsNetFrameworkRefNugetPackage)
+            // Multiple dotnet framework packages could be present. We keep only one.
+            // The order of the packages is important, we're keeping the first one that is present in the nuget cache.
+            var packagesInPrioOrder = new (bool isPresent, string prefix)[]
             {
-                // Multiple packages are available, we keep only one:
-                RemoveNugetPackageReference("microsoft.netframework.referenceassemblies.");
+                // net7.0, ... net5.0, netcoreapp3.1, netcoreapp3.0
+                (existsNetCoreRefNugetPackage, "microsoft.netcore.app.ref"),
+                // net48, ..., net20
+                (existsNetFrameworkRefNugetPackage, "microsoft.netframework.referenceassemblies."),
+                // netstandard2.1
+                (existsNetstandardLibRefNugetPackage, "netstandard.library.ref"),
+                // netstandard2.0
+                (existsNetstandardLibNugetPackage, "netstandard.library")
+            };
+
+            for (var i = 0; i < packagesInPrioOrder.Length; i++)
+            {
+                var (isPresent, _) = packagesInPrioOrder[i];
+                if (!isPresent)
+                {
+                    continue;
+                }
+
+                // Package is present, remove all the lower priority packages:
+                for (var j = i + 1; j < packagesInPrioOrder.Length; j++)
+                {
+                    var (otherIsPresent, otherPrefix) = packagesInPrioOrder[j];
+                    if (otherIsPresent)
+                    {
+                        RemoveNugetPackageReference(otherPrefix);
+                    }
+                }
+                break;
             }
 
             // TODO: There could be multiple `microsoft.netframework.referenceassemblies` packages,

csharp/ql/integration-tests/posix-only/standalone_dependencies/Assemblies.expected

@@ -168,6 +168,5 @@
 | /microsoft.netcore.app.ref/7.0.2/ref/net7.0/WindowsBase.dll |
 | /microsoft.netcore.app.ref/7.0.2/ref/net7.0/mscorlib.dll |
 | /microsoft.netcore.app.ref/7.0.2/ref/net7.0/netstandard.dll |
-| /netstandard.library/2.0.3/build/netstandard2.0/ref/System.ComponentModel.Composition.dll |
 | /newtonsoft.json/12.0.1/lib/portable-net45+win8+wp8+wpa81/Newtonsoft.Json.dll |
 | /nunit/3.13.3/lib/netstandard2.0/nunit.framework.dll |

csharp/ql/integration-tests/windows-only/standalone_dependencies/Assemblies.expected

@@ -212,6 +212,5 @@
 | /microsoft.windowsdesktop.app.ref/7.0.2/ref/net7.0/UIAutomationTypes.dll |
 | /microsoft.windowsdesktop.app.ref/7.0.2/ref/net7.0/WindowsBase.dll |
 | /microsoft.windowsdesktop.app.ref/7.0.2/ref/net7.0/WindowsFormsIntegration.dll |
-| /netstandard.library/2.0.3/build/netstandard2.0/ref/System.ComponentModel.Composition.dll |
 | /newtonsoft.json/12.0.1/lib/portable-net45+win8+wp8+wpa81/Newtonsoft.Json.dll |
 | /nunit/3.13.3/lib/netstandard2.0/nunit.framework.dll |