Repository navigation
Tier 3: Custom ConfuserEx-specific Roslyn analyzers #49
Description
Custom Roslyn Analyzers for ConfuserEx
Domain-specific analyzers that catch the exact bugs we've been fixing at compile time, preventing regressions.
Analyzer Rules
| ID | Pattern | Severity | Violations | Prevents |
|---|---|---|---|---|
| CX001 | typeof(X).GetMethod() with module.Import() — imports from host runtime |
Error | 3 | Wrong mscorlib version (#7) |
| CX002 | ResolveTypeDef()/ResolveMethodDef() without null check before use |
Warning | 6 (2-3 real bugs) | Crashes on external assemblies (#13, #27) |
| CX003 | ResolveThrow/ResolveTypeDefThrow usage audit |
Info | ~34 (most intentional) | Awareness — flags spots to evaluate |
| CX004 | Assembly.GetTypes() without ReflectionTypeLoadException catch |
Warning | 2 | Packer startup crashes (#24) |
Scope
This issue covers:
- Create
Confuser.Analyzersproject (netstandard2.0) - Implement all 4 analyzers (CX001-CX004)
- Wire into build via ConfuserEx.Common.targets
- Fix all existing violations found by the analyzers
- Add analyzer tests
Implementation Order
- CX003 (easy, ~120 LOC) — set up project infrastructure, simple method name match
- CX001 (medium, ~170 LOC) — nested invocation detection + fix 3 violations
- CX004 (medium, ~230 LOC) — type discrimination + try-catch walk + fix 2 violations
- CX002 (hard, ~300 LOC) — data flow analysis + fix VTableAnalyzer.cs:355-356
Technical Requirements
- Target:
netstandard2.0(required for Roslyn analyzers) - Dependencies:
Microsoft.CodeAnalysis.CSharp≥ 3.3.1,Microsoft.CodeAnalysis.Analyzers≥ 3.3.4 - Testing:
Microsoft.CodeAnalysis.CSharp.Analyzer.Testing.XUnit - Integration:
ProjectReferencewithOutputItemType=Analyzerin shared targets
Known Violations to Fix
CX001 (3 files):
Confuser.Protections/Resources/InjectPhase.cs:139Confuser.Protections/Constants/EncodePhase.cs:124Confuser.Protections/Compress/Compressor.cs:199
CX002 (2 files):
Confuser.Renamer/Analyzers/VTableAnalyzer.cs:355-356(2 unguarded calls)
CX004 (2 files):
Confuser.Core/PluginDiscovery.cs:58ConfuserEx/ComponentDiscovery.cs:15
Estimated Effort
~1,050 lines total (820 analyzer + 230 tests). Implementation order above allows incremental delivery.
Activity
fix: add missing System.Linq using in PluginDiscovery (#49)
fix: exclude Confuser.Runtime (net20) from analyzer project reference (…
fix: use SkipGetTargetFrameworkProperties for full analyzer coverage …
fix: force analyzer to build as netstandard2.0 regardless of consumin…
feature: add CX002 and CX001 analyzers, completing Tier 3 (#49)
feature: Tier 3 custom Roslyn analyzers CX001–CX004 (#49, #46) (#95)
mcpolo99 commentedon Jul 4, 2026
Resolved by #95 (squash-merged to
developas44e6f29). All four Tier 3 analyzers shipped: CX004 (GetTypes/RTLE), CX003 (Resolve…Throw audit), CX002 (unguarded Resolve deref), CX001 (host-reflection import). 17 analyzer tests; violations fixed/suppressed. Note: CX001/CX002 premises were stale and were corrected against the current code (see PR).