dohertj2/lmxopcua
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(scripting): resolve Medium code-review finding (Core.Scripting-004)

Browse Source 
DependencyExtractor.VisitInvocationExpression now additionally checks
that the member-access receiver is the identifier "ctx" before treating
a GetTag / SetVirtualTag call as a ScriptContext dependency. This
prevents spurious dependencies when a script defines a local helper type
with a matching method name and calls it as other.GetTag("X"). Test
Ignores_member_access_GetTag_on_non_ctx_receiver added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Joseph Doherty
2026-05-22 09:23:12 -04:00
parent e390e1c067
commit 2c571001ca
2 changed files with 37 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/DependencyExtractor.cs
View File

@@ -21,11 +21,15 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Scripting;
/// token.
/// </para>
/// <para>
/// Identifier matching is by spelling: the extractor looks for
/// <c>ctx.GetTag(...)</c> / <c>ctx.SetVirtualTag(...)</c> literally. A deliberately
/// misspelled method call (<c>ctx.GetTagz</c>) is not picked up but will also fail
/// to compile against <see cref="ScriptContext"/>, so there's no way to smuggle a
/// dependency past the extractor while still having a working script.
/// Matching is by spelling: the extractor looks for member-access invocations
/// whose receiver identifier is literally <c>ctx</c> and whose method name is
/// <c>GetTag</c> or <c>SetVirtualTag</c>. A deliberately misspelled method call
/// (<c>ctx.GetTagz</c>) is not picked up but will also fail to compile against
/// <see cref="ScriptContext"/>, so there is no way to smuggle a dependency past the
/// extractor while still having a working script. Calls with the same method name on
/// a different receiver (<c>other.GetTag("X")</c>) are explicitly ignored so that
/// scripts defining local helper types with matching names do not produce spurious
/// dependencies. (Core.Scripting-004.)
/// </para>
/// </remarks>
public static class DependencyExtractor
@@ -67,10 +71,15 @@ public static class DependencyExtractor
public override void VisitInvocationExpression(InvocationExpressionSyntax node)
{
// Only interested in member-access form: ctx.GetTag(...) / ctx.SetVirtualTag(...).
// Anything else (free functions, chained calls, static calls) is ignored — but
// still visit children in case a ctx.GetTag call is nested inside.
if (node.Expression is MemberAccessExpressionSyntax member)
// Only interested in ctx.GetTag(...) / ctx.SetVirtualTag(...) — member-access
// form where the receiver is the identifier "ctx" (the ScriptGlobals<T>.ctx
// field). Calls with the same method name on a different receiver (e.g.
// someHelper.GetTag("X")) are ignored — not picking them up avoids spurious
// dependencies when scripts define local types with matching method names.
// (Core.Scripting-004.)
if (node.Expression is MemberAccessExpressionSyntax member
&& member.Expression is IdentifierNameSyntax receiver
&& receiver.Identifier.ValueText == "ctx")
{
var methodName = member.Name.Identifier.ValueText;
if (methodName is nameof(ScriptContext.GetTag) or nameof(ScriptContext.SetVirtualTag))