C#: Use ProcessStartInfo built-in for correct escaping/quoting in the Dependency manager.

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs

@@ -49,7 +49,7 @@ private void Info()
             // Allow up to four attempts (with up to three retries) to run `dotnet --info`, to mitigate transient issues
             for (int attempt = 0; attempt < 4; attempt++)
             {
-                var exitCode = dotnetCliInvoker.RunCommandExitCode("--info", silent: false);
+                var exitCode = dotnetCliInvoker.RunCommandExitCode(["--info"], silent: false);
                 switch (exitCode)
                 {
                     case 0:
@@ -63,9 +63,9 @@ private void Info()
             }
         }
 
-        private string GetRestoreArgs(RestoreSettings restoreSettings)
+        private List<string> GetRestoreArgs(RestoreSettings restoreSettings)
         {
-            var args = $"restore --no-dependencies \"{restoreSettings.File}\" --packages \"{restoreSettings.PackageDirectory}\" /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal";
+            List<string> args = ["restore", "--no-dependencies", restoreSettings.File, "--packages", restoreSettings.PackageDirectory, "/p:DisableImplicitNuGetFallbackFolder=true", "--verbosity", "normal"];
 
             if (restoreSettings.ForceDotnetRefAssemblyFetching)
             {
@@ -77,28 +77,20 @@ private string GetRestoreArgs(RestoreSettings restoreSettings)
                     Directory.CreateDirectory(path);
                 }
 
-                args += $" /p:TargetFrameworkRootPath=\"{path}\" /p:NetCoreTargetingPackRoot=\"{path}\" /p:AllowMissingPrunePackageData=true";
-            }
-
-            if (restoreSettings.PathToNugetConfig != null)
-            {
-                args += $" --configfile \"{restoreSettings.PathToNugetConfig}\"";
+                args.AddRange([$"/p:TargetFrameworkRootPath={path}", $"/p:NetCoreTargetingPackRoot={path}", "/p:AllowMissingPrunePackageData=true"]);
             }
 
             if (restoreSettings.ForceReevaluation)
             {
-                args += " --force";
+                args.Add("--force");
             }
 
             if (restoreSettings.TargetWindows)
             {
-                args += " /p:EnableWindowsTargeting=true";
+                args.Add("/p:EnableWindowsTargeting=true");
             }
 
-            if (restoreSettings.NugetSources is not null)
-            {
-                args += $" {restoreSettings.NugetSources}";
-            }
+            args.AddRange(restoreSettings.NugetSources);
 
             return args;
         }
@@ -112,48 +104,48 @@ public RestoreResult Restore(RestoreSettings restoreSettings)
 
         public bool New(string folder)
         {
-            var args = $"new console --no-restore --output \"{folder}\"";
+            List<string> args = ["new", "console", "--no-restore", "--output", folder];
             return dotnetCliInvoker.RunCommand(args);
         }
 
         public bool AddPackage(string folder, string package)
         {
-            var args = $"add \"{folder}\" package \"{package}\" --no-restore";
+            List<string> args = ["add", folder, "package", package, "--no-restore"];
             return dotnetCliInvoker.RunCommand(args);
         }
 
-        public IList<string> GetListedRuntimes() => GetResultList("--list-runtimes");
+        public IList<string> GetListedRuntimes() => GetResultList(["--list-runtimes"]);
 
-        public IList<string> GetListedSdks() => GetResultList("--list-sdks");
+        public IList<string> GetListedSdks() => GetResultList(["--list-sdks"]);
 
-        private IList<string> GetResultList(string args, string? workingDirectory = null, bool silent = true)
+        private IList<string> GetResultList(List<string> args, string? workingDirectory = null, bool silent = true)
         {
             if (dotnetCliInvoker.RunCommand(args, workingDirectory, out var results, silent))
             {
                 return results;
             }
-            logger.LogWarning($"Running 'dotnet {args}' failed.");
-            return [];
+            logger.LogWarning($"Running 'dotnet {string.Join(" ", args)}' failed.");
+            return new List<string>();
         }
 
-        public bool Exec(string execArgs)
+        public bool Exec(List<string> execArgs)
         {
-            var args = $"exec {execArgs}";
+            List<string> args = ["exec", .. execArgs];
             return dotnetCliInvoker.RunCommand(args);
         }
 
-        private const string nugetListSourceCommand = "nuget list source --format Short";
+        private static readonly IReadOnlyList<string> nugetListSourceCommandArgs = ["nuget", "list", "source", "--format", "Short"];
 
         public IList<string> GetNugetFeeds(string nugetConfig)
         {
             logger.LogInfo($"Getting NuGet feeds from '{nugetConfig}'...");
-            return GetResultList($"{nugetListSourceCommand} --configfile \"{nugetConfig}\"");
+            return GetResultList([.. nugetListSourceCommandArgs, "--configfile", nugetConfig]);
         }
 
         public IList<string> GetNugetFeedsFromFolder(string folderPath)
         {
             logger.LogInfo($"Getting NuGet feeds in folder '{folderPath}'...");
-            return GetResultList(nugetListSourceCommand, folderPath);
+            return GetResultList(nugetListSourceCommandArgs.ToList(), folderPath);
         }
 
         // The version number should be kept in sync with the version .NET version used for building the application.

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNetCliInvoker.cs

@@ -1,6 +1,5 @@
 using System;
 using System.Collections.Generic;
-using System.Collections.ObjectModel;
 using System.Diagnostics;
 using Semmle.Util;
 using Semmle.Util.Logging;
@@ -25,14 +24,15 @@ public DotNetCliInvoker(ILogger logger, string exec, DependabotProxy? dependabot
             logger.LogInfo($"Using .NET CLI executable: '{Exec}'");
         }
 
-        private ProcessStartInfo MakeDotnetStartInfo(string args, string? workingDirectory)
+        private ProcessStartInfo MakeDotnetStartInfo(List<string> args, string? workingDirectory)
         {
             var startInfo = new ProcessStartInfo(Exec, args)
             {
                 UseShellExecute = false,
                 RedirectStandardOutput = true,
                 RedirectStandardError = true
             };
+
             if (!string.IsNullOrWhiteSpace(workingDirectory))
             {
                 startInfo.WorkingDirectory = workingDirectory;
@@ -57,39 +57,39 @@ private ProcessStartInfo MakeDotnetStartInfo(string args, string? workingDirecto
             return startInfo;
         }
 
-        private int RunCommandExitCodeAux(string args, string? workingDirectory, out IList<string> output, out string dirLog, bool silent)
+        private int RunCommandExitCodeAux(List<string> args, string? workingDirectory, out IList<string> output, out string dirLog, bool silent)
         {
             dirLog = string.IsNullOrWhiteSpace(workingDirectory) ? "" : $" in {workingDirectory}";
             var pi = MakeDotnetStartInfo(args, workingDirectory);
             var threadId = Environment.CurrentManagedThreadId;
             void onOut(string s) => logger.Log(silent ? Severity.Debug : Severity.Info, s, threadId);
             void onError(string s) => logger.LogError(s, threadId);
-            logger.LogInfo($"Running '{Exec} {args}'{dirLog}");
+            logger.LogInfo($"Running '{Exec} {string.Join(" ", args)}'{dirLog}");
             var exitCode = pi.ReadOutput(out output, onOut, onError);
             return exitCode;
         }
 
-        private bool RunCommandAux(string args, string? workingDirectory, out IList<string> output, bool silent)
+        private bool RunCommandAux(List<string> args, string? workingDirectory, out IList<string> output, bool silent)
         {
             var exitCode = RunCommandExitCodeAux(args, workingDirectory, out output, out var dirLog, silent);
             if (exitCode != 0)
             {
-                logger.LogError($"Command '{Exec} {args}'{dirLog} failed with exit code {exitCode}");
+                logger.LogError($"Command '{Exec} {string.Join(" ", args)}'{dirLog} failed with exit code {exitCode}");
                 return false;
             }
             return true;
         }
 
-        public bool RunCommand(string args, bool silent = true) =>
+        public bool RunCommand(List<string> args, bool silent = true) =>
             RunCommandAux(args, null, out _, silent);
 
-        public int RunCommandExitCode(string args, bool silent = true) =>
+        public int RunCommandExitCode(List<string> args, bool silent = true) =>
             RunCommandExitCodeAux(args, null, out _, out _, silent);
 
-        public bool RunCommand(string args, out IList<string> output, bool silent = true) =>
+        public bool RunCommand(List<string> args, out IList<string> output, bool silent = true) =>
             RunCommandAux(args, null, out output, silent);
 
-        public bool RunCommand(string args, string? workingDirectory, out IList<string> output, bool silent = true) =>
+        public bool RunCommand(List<string> args, string? workingDirectory, out IList<string> output, bool silent = true) =>
             RunCommandAux(args, workingDirectory, out output, silent);
     }
 }