Skip to content

Prevent build-tool resource name collisions - #4315

Open
siegfriedpammer wants to merge 1 commit into
masterfrom
fix/project-export-build-files
Open

siegfriedpammer wants to merge 1 commit into
masterfrom
fix/project-export-build-files

Conversation

@siegfriedpammer

@siegfriedpammer siegfriedpammer commented Nov 7, 2026 •

Copy link
Copy Markdown
Member

Summary

  • Prevent project exports from writing embedded resources under names that MSBuild, NuGet, the SDK, or IDEs load implicitly.
  • Append .bin to risky on-disk names while preserving the original resource name through LogicalName.
  • Use Unicode compatibility normalization plus ordinal case-insensitive matching to avoid filesystem-dependent filename bypasses.
  • Cover manifest resources and .resources entries through the shared filename reservation path.

Verification

  • OPENSSL_ENABLE_SHA1_SIGNATURES=1 dotnet test --project ICSharpCode.Decompiler.Tests/ICSharpCode.Decompiler.Tests.csproj --filter "FullyQualifiedName~WholeProjectDecompilerTests" --report-trx passes: 22/22.
  • Commit hook formatting completed successfully.

Assisted-by: OpenCode:gpt-5.6-luna:OpenCode

@siegfriedpammer
siegfriedpammer force-pushed the fix/project-export-build-files branch 2 times, most recently from 305f57d to 16df3ab Compare November 7, 2026 10:17
{
// Keep exported resources from being treated as build inputs merely because of their names.
if (IsReadByBuildTools(fileName))
fileName = AppendInertExtension(fileName);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why only for resources?
IMHO this should go into SanitizeFileName to ensure it applies to all files we write.

string[] segments = fileName.Split(Path.DirectorySeparatorChar);
if (segments.Length > 1 && segments[0].TrimEnd('.').Equals("obj", StringComparison.OrdinalIgnoreCase))
return true;
string name = segments[segments.Length - 1].TrimEnd('.');

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The .TrimEnd('.') is questionable here -- isn't this redundant because CleanUpName already removed trailing dots? If our input did not run through CleanUpName, then trimming dots would not be sufficient.

@siegfriedpammer
siegfriedpammer force-pushed the fix/project-export-build-files branch 2 times, most recently from 6a832bf to 2997eef Compare November 8, 2026 12:40
{
try
{
fileName = fileName.Normalize(NormalizationForm.FormKC);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why normalize here?
CleanUpName does similar checks; if normalization is necessary in this function then shouldn't it also be necessary over there?

@siegfriedpammer
siegfriedpammer force-pushed the fix/project-export-build-files branch from 2997eef to c2babea Compare November 8, 2026 14:15
Project exports write assembly-controlled resource names beside the generated project. Names such as Directory.Build.props can therefore become implicit MSBuild inputs when the export is opened. Keep the original LogicalName for rebuild fidelity while giving risky files an inert on-disk extension.

Assisted-by: OpenCode:gpt-5.6-luna:OpenCode
@siegfriedpammer
siegfriedpammer force-pushed the fix/project-export-build-files branch from c2babea to 94ffd82 Compare November 8, 2026 14:46

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants