From 51886b7f1b3f4e45411e480df59d5cda9c00c80b Mon Sep 17 00:00:00 2001 From: Siegfried Pammer Date: Thu, 10 Sep 2026 07:16:11 +0200 Subject: [PATCH] Identify nugetfuzz findings by full assembly name and path A sweep covers thousands of packages, and the same simple assembly name ships in many of them and in several TFM folders of a single package, so a finding keyed on the file name alone cannot be traced back to the assembly it came from. Assisted-by: Claude:claude-opus-5:Claude Code --- TestTools/nugetfuzz.cs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/TestTools/nugetfuzz.cs b/TestTools/nugetfuzz.cs index 6c4ecb900..b1e001393 100644 --- a/TestTools/nugetfuzz.cs +++ b/TestTools/nugetfuzz.cs @@ -567,6 +567,9 @@ async Task DecompileAssembly(string pkg, string dllPath, List searchDirs } using (module) { + // The file name alone is ambiguous across a sweep: the same simple name ships in many + // packages and many TFM folders. Identify findings by full assembly name plus path. + name = $"{module.FullName} ({dllPath})"; // ".NETCoreApp,Version=v5.0" -> 5.0; null for .NET Framework / netstandard modules. Version? coreVersion = null; var tfmId = module.DetectTargetFrameworkId(); @@ -768,7 +771,6 @@ void CheckGeneratedPdb(string pkg, string asm, PEFile module, CSharpDecompiler d // reported here is a defect in the lint rather than in ILSpy. void LintExistingPdb(string dllPath) { - var asm = Path.GetFileName(dllPath); using var peStream = File.OpenRead(dllPath); PEReader peReader; try @@ -783,6 +785,7 @@ void LintExistingPdb(string dllPath) } using (peReader) { + var asm = $"{peReader.GetMetadataReader().GetFullAssemblyName()} ({dllPath})"; // A PDB next to the assembly if there is one, otherwise the one embedded in the PE. MemoryStream? pdbStream = null; MetadataReaderProvider? provider = null;