search

ossf / scorecard

OpenSSF Scorecard - Security health metrics for Open Source
https://scorecard.dev
Apache License 2.0
4.6k stars 500 forks source link

BUG: .Net Pinned dependency check ignores using RestoreLockedMode #4251

Closed balteravishay closed 1 month ago

balteravishay commented 3 months ago

Describe the bug The current implementation of checking for locking dependencies in .net only checks if the command that is used is of type "dotnet.exe restore --locked-mode" or "msbuild.exe -t:restore -p:RestoreLockedMode=true", but ignores cases in which the maintainer opts for using RestoreLockedMode MSBuild property in their project file as such:

<PropertyGroup>
    <!--- ... -->
    <RestoreLockedMode>true</RestoreLockedMode>
    <!--- ... -->
</PropertyGroup>

more info here

Reproduction steps Steps to reproduce the behavior:

  1. when scanning for pinned dependency a repo which leverages RestoreLockedMode MSBuild property, the pinning should be detected.
  2. example: go run main.go --repo elastic/elasticsearch-net --checks Pinned-Dependencies --format json --show-details | jq

Expected behavior .net repositories can leverage either restore behavior with lock file that is documented and the pinned dependency score should be similar. For the example given above (elastic/elasticsearch-net), the score for pinned nugetCommand dependencies should be 3 out of 3.