Print warning when AddJsonFile is called with "local.settings.json"

docs/analyzer-rules/AZFW0016.md

@@ -0,0 +1,27 @@
+# AZFW0016: Redundant usage of local.settings.json in the worker configuration
+
+| | Value |
+|-|-|
+| **Rule ID** |AZFW00016|
+| **Category** |[Usage]|
+| **Severity** |Warning|
+
+## Cause
+
+This rule is triggered when `local.settings.json` is passed to `AddJsonFile()` method of the `IConfigurationBuilder`.
+
+## Rule description
+
+`local.settings.json` is a file that is automatically loaded to the configuration by Azure Functions Core Tools.
+There is no need to explicitly add it to the configuration of the worker during development. And in production scenarios `local.settings.json` should never be used because it means checking it into the source control.
+And this a securiy risk because this file usually contains sensitive information like connection strings.
+
+
+## How to fix violations
+
+Don't pass `local.settings.json` to `AddJsonFile()` when configuring the Azure Functions Worker.
+
+
+## When to suppress
+
+It is okay to suppress the warning if it happens in a code block that is guaranteed to execute only during the development (Debug configuration) and you want to be explicit about the source of configuration. It should never be suppressed for the code that will run in production.

sdk/Sdk.Analyzers/DiagnosticDescriptors.cs

@@ -5,7 +5,7 @@
 
 namespace Microsoft.Azure.Functions.Worker.Sdk.Analyzers
 {
-    internal class DiagnosticDescriptors
+    internal static class DiagnosticDescriptors
     {
         private static DiagnosticDescriptor Create(string id, string title,string messageFormat, string category, DiagnosticSeverity severity)
         {
@@ -32,5 +32,9 @@ private static DiagnosticDescriptor Create(string id, string title,string messag
         public static DiagnosticDescriptor IterableBindingTypeExpectedForBlobContainer { get; }
             = Create(id: "AZFW0011", title: "Invalid binding type", messageFormat: "The binding type '{0}' must be iterable for container path.",
                 category: Constants.DiagnosticsCategories.Usage, severity: DiagnosticSeverity.Error);
+
+        public static DiagnosticDescriptor LocalSettingsJsonNotAllowedAsConfiguration { get; }
+            = Create(id: "AZFW0016", title: "local.settings.json should not be used as a configuration file", messageFormat: "There is no need to use local.settings.json as a configuration file. During development, it's automatically loaded by Functions Core Tools; in production scenarios, configuration should be handled via App Settings in Azure.",
+                category: Constants.DiagnosticsCategories.Usage, severity: DiagnosticSeverity.Warning);
     }
 }

sdk/Sdk.Analyzers/LocalSettingsJsonNotAllowedAsConfiguration.cs

@@ -0,0 +1,143 @@
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.IO;
+using System.Linq;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Microsoft.CodeAnalysis.Diagnostics;
+
+namespace Microsoft.Azure.Functions.Worker.Sdk.Analyzers
+{
+    [DiagnosticAnalyzer(LanguageNames.CSharp)]
+    public class LocalSettingsJsonNotAllowedAsConfiguration : DiagnosticAnalyzer
+    {
+        private const string ConfigurationBuilderFullName = "Microsoft.Extensions.Configuration.IConfigurationBuilder";
+        private const string LocalSettingsJsonFileName = "local.settings.json";
+        private const string AddJsonFileMethodName = "AddJsonFile";
+
+        public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics { get; } =
+            ImmutableArray.Create(DiagnosticDescriptors.LocalSettingsJsonNotAllowedAsConfiguration);
+
+        public override void Initialize(AnalysisContext context)
+        {
+            context.EnableConcurrentExecution();
+            context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.Analyze);
+            context.RegisterSyntaxNodeAction(AnalyzeInvocation, SyntaxKind.InvocationExpression);
+        }
+
+        // This analyzer handles only the overloads of AddJsonFile() with a string as first argument
+        private static void AnalyzeInvocation(SyntaxNodeAnalysisContext context)
+        {
+            var invocation = (InvocationExpressionSyntax)context.Node;
+            if (!IsAddJsonFileMethodWithAtLeastOneArgument(invocation, context))
+            {
+                return;
+            }
+
+            var firstArgument = invocation.ArgumentList.Arguments.First().Expression;
+            if (!IsOfStringType(firstArgument, context))
+            {
+                return;
+            }
+
+            if (FindLiterals(firstArgument, context).Any(IsPathToLocalSettingsJson))
+            {
+                var diagnostic = CreateDiagnostic(firstArgument);
+                context.ReportDiagnostic(diagnostic);
+            }
+        }
+
+        // This method ensures that the analyzer doesn't check more than it should.
+        // It looks for the literal values of the argument, from the easiest to hardest to find.
+        // Current order: literal -> constant -> declaration -> assignment in containing method.
+        private static IEnumerable<string> FindLiterals(ExpressionSyntax argument, SyntaxNodeAnalysisContext context)
+        {
+            if (argument is LiteralExpressionSyntax literal)
+            {
+                yield return literal.Token.ValueText;
+                yield break; // no need to check further
+            }
+
+            var constant = context.SemanticModel.GetConstantValue(argument);
+            if (constant.HasValue)
+            {
+                yield return constant.Value.ToString();
+                yield break; // no need to check further
+            }
+
+            if (argument is not IdentifierNameSyntax identifier)
+            {
+                yield break;
+            }
+
+            var identifierSymbol = context.SemanticModel.GetSymbolInfo(identifier).Symbol;
+            if (identifierSymbol is null)
+            {
+                yield break;
+            }
+
+            var declarationLiterals = identifierSymbol.DeclaringSyntaxReferences
+                .Select(reference => reference.GetSyntax(context.CancellationToken))
+                .OfType<VariableDeclaratorSyntax>()
+                .Select(variable => variable.Initializer?.Value)
+                .OfType<LiteralExpressionSyntax>();
+
+            // usually there should be only 1 declaration but better safe than sorry
+            foreach (var declarationLiteral in declarationLiterals)
+            {
+                yield return declarationLiteral.Token.ValueText;
+            }
+
+            // let's check assignments in the containing method
+            var containingMethod = argument.Ancestors()
+                .OfType<MethodDeclarationSyntax>()
+                .FirstOrDefault();
+
+            if (containingMethod is null)
+            {
+                yield break;
+            }
+
+            var assignmentsInContainingMethod = containingMethod.DescendantNodes()
+                .OfType<AssignmentExpressionSyntax>()
+                .Where(assignment => assignment.SpanStart < argument.SpanStart);
+
+            foreach (var assignment in assignmentsInContainingMethod)
+            {
+                var leftSymbol = context.SemanticModel.GetSymbolInfo(assignment.Left).Symbol;
+                if (SymbolEqualityComparer.Default.Equals(leftSymbol, identifierSymbol)
+                    && assignment.Right is LiteralExpressionSyntax assignmentLiteral)
+                {
+                    yield return assignmentLiteral.Token.ValueText;
+                }
+            }
+        }
+
+        private static bool IsAddJsonFileMethodWithAtLeastOneArgument(
+            InvocationExpressionSyntax invocation, SyntaxNodeAnalysisContext context)
+        {
+            return invocation.ArgumentList.Arguments.Count > 0
+                && invocation.Expression is MemberAccessExpressionSyntax { Name.Identifier.Text: AddJsonFileMethodName } memberAccess 
+                && context.SemanticModel.GetSymbolInfo(memberAccess).Symbol is IMethodSymbol methodSymbol 
+                && methodSymbol.ReceiverType?.ToDisplayString() == ConfigurationBuilderFullName;
+        }
+
+        private static bool IsOfStringType(ExpressionSyntax expression, SyntaxNodeAnalysisContext context)
+        {
+            return context.SemanticModel.GetTypeInfo(expression).Type?.SpecialType == SpecialType.System_String;
+        }
+
+        private static bool IsPathToLocalSettingsJson(string literal)
+        {
+            return Path.GetFileName(literal) == LocalSettingsJsonFileName;
+        }
+
+        private static Diagnostic CreateDiagnostic(ExpressionSyntax expression)
+        {
+            return Diagnostic.Create(
+                DiagnosticDescriptors.LocalSettingsJsonNotAllowedAsConfiguration,
+                expression.GetLocation());
+        }
+    }
+}