Project-mode NuGet agent scan patches, and VEX attests, packages the project doesn't depend on (the crawler lists the whole ~/.nuget/packages)

未關閉

#427 建立於 2026年10月1日 1 則留言 0 個 reaction 已指派 0 人在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度: 4/5
預估耗時: 3-5 天
新手友好度: 68/100

Issue 類型: 缺陷
描述清晰度: 描述清楚
活躍度: 活躍
技術堆疊: csharp, rust
領域: cli, devtools

研究方向

Start in crates/socket-patch-core/src/crawlers/nuget_crawler.rs:74-78 and inspect how obj/project.assets.json libraries and packageFolders could determine project packages. Run the provided Linux reproduction and verify project-mode discovery no longer crawls unrelated global-cache packages, patches them, or includes them in VEX output.

由索引模型根據 Issue 內容生成。

描述

agent:triaged bug bughunt pm:nuget priority:p3

[agent] Found by the scheduled NuGet / dotnet bug-hunt routine (ledger #320).

Summary

Without -g, NuGet discovery for a .NET project lists every package in the user-wide global packages folder (~/.nuget/packages, %USERPROFILE%\.nuget\packages), not just the packages the project resolves. So, in a project that depends only on Newtonsoft.Json:

scan reports and looks up [email protected], netstandard.library, … left over from unrelated projects on the same machine.
scan --mode agent --yes applies a patch to [email protected] in the shared cache, which the project never uses, and records it in this project's .socket/manifest.json. Exit 0, 1 of 1 targeted patch applied.
vex --product pkg:nuget/[email protected] then emits not_affected / inline_mitigations_already_exist with pkg:nuget/[email protected] as a subcomponent of App. App doesn't contain serilog.

This is the NuGet twin of #265 (Maven: "the crawler lists all of ~/.m2").

Impact

A false VEX: the product's attestation names components it doesn't ship. That pollutes SBOM/VEX consumers and can mask the real dependency set.
Agent mode mutates bytes in a cache shared by every other project on the machine. The patch is recorded against this project, so another project's rollback / repair doesn't know about it.
Noise: scan output and the patch-API batch carry the whole machine cache (hundreds of packages on a dev box or warm CI image).

Repro (Linux, dotnet SDK 8.0.131, main `2463257`)

SP=/path/to/target/release/socket-patch
export SOCKET_NO_CONFIG=1 SOCKET_TELEMETRY_DISABLED=1
# another project on this machine uses Serilog
mkdir other && cd other && cat > O.csproj <<'X'
<Project Sdk="Microsoft.NET.Sdk"><PropertyGroup><TargetFramework>net8.0</TargetFramework></PropertyGroup><ItemGroup><PackageReference Include="Serilog" Version="3.1.1" /></ItemGroup></Project>
X
dotnet restore && cd ..
# our project depends only on Newtonsoft.Json
mkdir app && cd app && cat > App.csproj <<'X'
<Project Sdk="Microsoft.NET.Sdk"><PropertyGroup><TargetFramework>netstandard2.0</TargetFramework></PropertyGroup><ItemGroup><PackageReference Include="Newtonsoft.Json" Version="13.0.3" /></ItemGroup></Project>
X
dotnet restore
grep -ci serilog obj/project.assets.json          # 0, not a dependency
# local stand-in for the public proxy (POST /patch/batch, GET /patch/by-package/<purl>,
# GET /patch/view/<uuid>) that serves one free patch for pkg:nuget/[email protected] (README.md + marker line)
$SP scan --mode agent --yes --proxy-url http://127.0.0.1:8766
#   Found 4 packages (4 nuget) ... Patched packages: pkg:nuget/[email protected] (via blob)
#   Summary: 1 of 1 targeted patch applied   (exit 0)
grep -c SOCKET_MARKER ~/.nuget/packages/serilog/3.1.1/README.md   # 1
$SP vex --offline --product pkg:nuget/[email protected]
#   products[0] = pkg:nuget/[email protected], subcomponents = [pkg:nuget/[email protected]], status not_affected

Reproduced twice (rollback in between restores the bytes exactly). scan --json without --mode (report-only / hosted) also lists the unrelated packages.

Expected vs actual

Expected: project-mode discovery covers the packages this project resolves. For PackageReference projects that's the libraries in obj/project.assets.json (or packages.lock.json); for packages.config, the packages/ folder. The VEX contract (README VEX section, CLI_CONTRACT.md) attests only what is patched in the product. The maintainers' global-mode note (ledger #320, 20261001T040000Z entry) also asks that a scan without -g never touch the global location beyond the project.
Actual: get_nuget_package_paths adds the whole global packages folder as a crawl root in local mode, and crawl_all emits every <id>/<ver>/ in it.

OS × SDK matrix

OS	SDK	unrelated cache package patched + attested
Linux (local)	8.0.131	yes (2/2 runs)

The crawler code path is OS-independent (the same nuget_home() root is used on macOS and Windows; the probe run https://github.com/SocketDev/socket-patch/actions/runs/36820498426 shows the same ~/.nuget/packages / C:\Users\runneradmin\.nuget\packages root being crawled on all 3 OSes). I haven't separately run this agent-mode scenario on macOS or Windows.

First bad version

Not a regression: v4.0.0 (scan --apply --yes) patches [email protected] the same way.

Suspect code

crates/socket-patch-core/src/crawlers/nuget_crawler.rs:74-78 (// 2. Fall back to the global cache. pushes nuget_home() as a crawl root in local mode). A fix would crawl only the <id>/<ver> dirs named in obj/project.assets.json libraries (resolved against its packageFolders) instead of the whole folder. That would also fix the wrong-folder half of #397.

主要語言: Rust
星號: 8
分支: 0
平均合併: 1 天 31 分鐘
30 天內合併 PR: 151

環境準備

沒有 Dockerfile 或 Docker Compose 檔案
沒有 Pull Request 範本
閱讀貢獻指南

從這裡開始

先讀完整個 Issue，再讀專案的貢獻指南。
在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
Fork 儲存庫，在一個分支上完成修改。
送出 Pull Request，並在描述裡引用這個 Issue 編號。

SocketDev/socket-patch 的其他 Issue

Vendored yarn berry misses a parent-scoped user `resolutions` entry (`pkg-a/left-pad`), reports success, and every `yarn install --immutable` fails YN0028
未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:yarn-berry priority:p1

難度 2/5 1-3 小時新手友好度 73/100

SocketDev/socket-patch#783 · 1 則留言 · 2026年10月4日建立

維護者通常 1 天內回覆
`scan --mode hosted --dry-run --vex <path> --json` drops the documented `vex: {skipped: true, reason: "dry_run"}` marker (agent and vendored scans emit it)
未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:pipenv priority:p1

難度 2/5 1-3 小時新手友好度 83/100

SocketDev/socket-patch#744 · 1 則留言 · 2026年10月4日建立

維護者通常 1 天內回覆
Vendored cargo warns cargo_multi_version_old_cargo ("declares no rust-version") when the root package inherits rust-version from [workspace.package]
未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:cargo priority:p2

難度 2/5 1-3 小時新手友好度 84/100

SocketDev/socket-patch#651 · 3 則留言 · 2026年10月3日建立

維護者通常 1 天內回覆
Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted
未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:composer priority:p2

難度 2/5 1-3 小時新手友好度 90/100

SocketDev/socket-patch#515 · 1 則留言 · 2026年10月1日建立

維護者通常 1 天內回覆
A report-only `scan -g` tells you to run `socket-patch scan --mode agent [PATHS]` without `-g`, so following the hint scans the cwd project instead of the global install
可能已有人在做關聯的 PR 仍在進行中或已合併。未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:npm priority:p1

難度 2/5 1-3 小時新手友好度 82/100

SocketDev/socket-patch#464 · 1 則留言 · 2026年10月1日建立

維護者通常 1 天內回覆

查看 SocketDev/socket-patch 的全部 Issue

相似的 Issue

spend: meter SSE frames that omit the event: line (derive type from data)
未關閉
- 哪裡不對？
難度 2/5 1-3 小時新手友好度 85/100

pleaseai/shunt#747 · 2026年10月5日建立

維護者通常 1 天內回覆
[bug] `!=` and `!~` on `taskTag` and `projectTag` match when any tag differs, and never match an untagged item
未關閉
- 哪裡不對？
難度 2/5 1-3 小時新手友好度 78/100

moonrepo/moon#2744 · 2026年10月5日建立

維護者通常 1 天內回覆
install: root SSH tmpfiles.d drop-in is labeled etc_runtime_t instead of etc_t
可能已有人在做 @andrewdunndev 今天認領。未關閉
- 哪裡不對？
難度 2/5 1-3 小時新手友好度 82/100

bootc-dev/bootc#2538 · 2026年10月5日建立

維護者通常 1 天內回覆
[Misdetection] `text/tab-separated-values` file misdetected as `text/tsv`
可能已有人在做 @bact 今天認領。未關閉
- 哪裡不對？
misdetection needs triage

難度 2/5 1-3 小時新手友好度 70/100

google/magika#1525 · 2026年10月5日建立

維護者通常 1 天內回覆
https://docs.rs/hyper-util/latest/hyper_util/client/legacy/struct.Builder.html#method.timer links to wrong method
未關閉
- 哪裡不對？
C-bug

難度 2/5 1-3 小時新手友好度 72/100

hyperium/hyper#4221 · 2026年10月5日建立

維護者通常 2 天內回覆

更多 Rust Issue

Project-mode NuGet agent scan patches, and VEX attests, packages the project doesn't depend on (the crawler lists the whole ~/.nuget/packages)

哪裡不對？

評估

研究方向

描述

Summary

Impact

Repro (Linux, dotnet SDK 8.0.131, main 2463257)

Expected vs actual

OS × SDK matrix

First bad version

Suspect code

環境準備

從這裡開始

SocketDev/socket-patch 的其他 Issue

哪裡不對？

哪裡不對？

哪裡不對？

哪裡不對？

哪裡不對？

相似的 Issue

哪裡不對？

哪裡不對？

哪裡不對？

哪裡不對？

哪裡不對？

把新 issue 寄到你的電子郵件信箱

Repro (Linux, dotnet SDK 8.0.131, main `2463257`)