C#: Exclude private registries from NuGet CLI restore feeds

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: michaelnebel

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FeedManager.cs

@@ -246,6 +246,30 @@ public List<string> MakeRestoreFeeds(string path)
             return RestoreFeeds(feedsToUse);
         }
 
+        /// <summary>
+        /// Constructs the NuGet CLI restore sources, excluding private registries that require the registry proxy.
+        /// An empty list leaves source selection to NuGet only when no filtering or default feeds are needed.
+        /// </summary>
+        public List<string> MakeNugetExeRestoreFeeds(string path)
+        {
+            var feedsToUse = FeedsToUse(path).ToList();
+            var defaultFeeds = CheckNugetFeedResponsiveness ? ReachableDefaultFeeds : DefaultFeeds;
+            var useDefaultFeeds = feedsToUse.Count == 0 && defaultFeeds.Count > 0;
+
+            if (!CheckNugetFeedResponsiveness && !HasPrivateRegistryFeeds && !useDefaultFeeds)
+            {
+                return [];
+            }
+
+            if (useDefaultFeeds)
+            {
+                feedsToUse.AddRange(defaultFeeds);
+            }
+
+            // Filter after selecting defaults so private base feeds cannot be reintroduced.
+            return RestoreFeeds(feedsToUse.Where(feed => !privateRegistryFeeds.Contains(feed)));
+        }
+
         private (int initialTimeout, int tryCount) GetFeedRequestSettings(bool isFallback)
         {
             int timeoutMilliSeconds = isFallback && int.TryParse(Environment.GetEnvironmentVariable(EnvironmentVariableNames.NugetFeedResponsivenessInitialTimeoutForFallback), out timeoutMilliSeconds)

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs

@@ -163,24 +163,8 @@ private bool TryRestoreNugetPackage(string packagesConfig)
             {
                 logger.LogInfo($"Restoring file \"{packagesConfig}\"...");
 
-                List<string> sourcesArgument = [];
-                var feedsToUse = feedManager.FeedsToUse(packagesConfig).ToList();
-                var defaultFeeds = feedManager.CheckNugetFeedResponsiveness
-                    ? feedManager.ReachableDefaultFeeds
-                    : feedManager.DefaultFeeds;
-                var useDefaultFeeds = feedsToUse.Count == 0 && defaultFeeds.Count > 0;
-
-                // Explicitly construct the sources to be used for the restore command when checking feed
-                // responsiveness, using private registries, or falling back to default feeds.
-                if (feedManager.CheckNugetFeedResponsiveness || feedManager.HasPrivateRegistryFeeds || useDefaultFeeds)
-                {
-                    if (useDefaultFeeds)
-                    {
-                        feedsToUse.AddRange(defaultFeeds);
-                    }
-                    var restoreFeeds = feedManager.RestoreFeeds(feedsToUse);
-                    sourcesArgument = restoreFeeds.SelectMany<string, string>(feed => ["-Source", feed]).ToList();
-                }
+                var sourcesArgument = feedManager.MakeNugetExeRestoreFeeds(packagesConfig)
+                    .SelectMany<string, string>(feed => ["-Source", feed]).ToList();
 
                 /* Use nuget.exe to install a package.
                  * Note that there is a clutch of NuGet assemblies which could be used to