From c992610df993b4b6964e6b4ab73551df5a293854 Mon Sep 17 00:00:00 2001 From: Michael Nebel Date: Mon, 26 Oct 2026 11:09:20 +0100 Subject: [PATCH 1/3] C#: Do not set the private registry proxy environment variables when using the Nuget CLI. --- .../NugetPackageRestorer.cs | 4 +--- .../PackagesConfigRestorer.cs | 11 +++-------- 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs index 9257edfe2c19..fee72034781f 100644 --- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs +++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs @@ -18,7 +18,6 @@ internal sealed partial class NugetPackageRestorer : IDisposable private readonly IFileProvider fileProvider; private readonly FileContent fileContent; private readonly IDotNet dotnet; - private readonly IRegistryProxy? registryProxy; private readonly IDiagnosticsWriter diagnosticsWriter; private readonly DependencyDirectory legacyPackageDirectory; private readonly DependencyDirectory missingPackageDirectory; @@ -41,7 +40,6 @@ public NugetPackageRestorer( this.fileProvider = fileProvider; this.fileContent = fileContent; this.dotnet = dotnet; - this.registryProxy = registryProxy; this.diagnosticsWriter = diagnosticsWriter; this.logger = logger; this.compilationInfoContainer = compilationInfoContainer; @@ -135,7 +133,7 @@ public HashSet Restore() try { - var packagesConfigRestore = PackagesConfigRestoreFactory.Create(fileProvider, legacyPackageDirectory, logger, feedManager, registryProxy); + var packagesConfigRestore = PackagesConfigRestoreFactory.Create(fileProvider, legacyPackageDirectory, logger, feedManager); var count = packagesConfigRestore.InstallPackages(); if (packagesConfigRestore.PackageCount > 0) { diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs index 29276d72a82c..2348eb809f8c 100644 --- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs +++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs @@ -33,11 +33,11 @@ internal interface IPackagesConfigRestore /// internal class PackagesConfigRestoreFactory { - public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager, IRegistryProxy? registryProxy) + public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager) { if (SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled()) { - return new NugetExeWrapper(fileProvider, packageDirectory, logger, feedManager, registryProxy); + return new NugetExeWrapper(fileProvider, packageDirectory, logger, feedManager); } return new NoOpPackagesConfig(fileProvider.PackagesConfigs, logger); @@ -52,7 +52,6 @@ private class NugetExeWrapper : IPackagesConfigRestore { private readonly string? nugetExe; private readonly Semmle.Util.Logging.ILogger logger; - private readonly IRegistryProxy? registryProxy; public int PackageCount => fileProvider.PackagesConfigs.Count; @@ -71,13 +70,12 @@ private class NugetExeWrapper : IPackagesConfigRestore /// /// Create the package manager for a specified source tree. /// - public NugetExeWrapper(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager, IRegistryProxy? registryProxy) + public NugetExeWrapper(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager) { this.fileProvider = fileProvider; this.packageDirectory = packageDirectory; this.logger = logger; this.feedManager = feedManager; - this.registryProxy = registryProxy; if (fileProvider.PackagesConfigs.Count > 0) { @@ -211,9 +209,6 @@ private bool TryRestoreNugetPackage(string packagesConfig) UseShellExecute = false }; - // Configure the proxy settings, if applicable. - registryProxy?.SetProcessEnvironment(pi); - var threadId = Environment.CurrentManagedThreadId; void onOut(string s) => logger.LogDebug(s, threadId); void onError(string s) => logger.LogError(s, threadId); From e867ab0c075ae420051e4ba89e238d66344f4788 Mon Sep 17 00:00:00 2001 From: Michael Nebel Date: Mon, 26 Oct 2026 11:13:45 +0100 Subject: [PATCH 2/3] C#: Add change note. --- .../change-notes/2026-10-26-nugetcli-proxy-config-rollback.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md diff --git a/csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md b/csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md new file mode 100644 index 000000000000..e4127ed5040e --- /dev/null +++ b/csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Rolled back the change that set proxy and certificate environment variables for the subprocess that invokes the NuGet CLI. From 36933cac80bf48e16adeb8cf4bb1156d4cf4451a Mon Sep 17 00:00:00 2001 From: Michael Nebel Date: Mon, 26 Oct 2026 15:22:04 +0100 Subject: [PATCH 3/3] Update csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md Co-authored-by: Michael B. Gale --- .../change-notes/2026-10-26-nugetcli-proxy-config-rollback.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md b/csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md index e4127ed5040e..bda5d495d70a 100644 --- a/csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md +++ b/csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md @@ -1,4 +1,4 @@ --- category: minorAnalysis --- -* Rolled back the change that set proxy and certificate environment variables for the subprocess that invokes the NuGet CLI. +* Rolled back the change that set proxy and certificate environment variables for the subprocess that invokes the NuGet CLI because the environment variables were only partially respected by the target process in some cases.