feature: add CX002 and CX001 analyzers, completing Tier 3 (#49)

Completes the four Tier 3 analyzers.

CX002 — flags a non-throwing ResolveTypeDef()/ResolveMethodDef() result that is
dereferenced immediately with no null check (crashes on external/unresolvable
references). Only genuine dereferences are flagged (x.ResolveTypeDef().Member /
[i]); null-conditional access, assignment, return, and passing the result as an
argument (e.g. to dnlib's null-tolerant SigComparer.Equals, as VTableAnalyzer
does) are correctly not reported. No existing violations — pure prevention.

CX001 — redesigned against the current code. The issue's original call sites were
already refactored to a context-aware Import(context, Type, method) helper; the
only remaining host-reflection path is that helper's last-resort fallback. CX001
now flags Import(...) whose argument is Type.GetMethod/GetConstructor/GetField/
GetProperty (host reflection → wrong-corlib reference). The single intentional
fallback in Confuser.Protections/Utils.cs is isolated and suppressed with a
documented pragma; new occurrences are flagged.

8 new analyzer tests (17 total). Full solution builds clean — zero CX
diagnostics.

Author: RandomCrocodile

Confuser.Analyzers/HostRuntimeImportAnalyzer.cs

@@ -0,0 +1,64 @@
+using System.Collections.Immutable;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Microsoft.CodeAnalysis.Diagnostics;
+
+namespace Confuser.Analyzers {
+	/// <summary>
+	///     CX001 — flags <c>Import(...)</c> whose argument is a member resolved via reflection on
+	///     the host runtime (<c>someType.GetMethod(...)</c>, <c>GetConstructor</c>, <c>GetField</c>,
+	///     <c>GetProperty</c> where the receiver is a <see cref="System.Type" />). Importing a
+	///     host-runtime member into a target module produces a reference to the wrong corlib
+	///     (e.g. the obfuscator's .NET rather than the target's), which breaks the protected
+	///     assembly. Resolve the member through the target module's corlib instead.
+	/// </summary>
+	[DiagnosticAnalyzer(LanguageNames.CSharp)]
+	public sealed class HostRuntimeImportAnalyzer : DiagnosticAnalyzer {
+		static readonly DiagnosticDescriptor Rule = new DiagnosticDescriptor(
+			DiagnosticIds.HostRuntimeImport,
+			"Importing a member resolved via host reflection",
+			"Import() argument is resolved with Type.{0}() on the host runtime; resolve the member through the target module's corlib to avoid a wrong-corlib reference",
+			DiagnosticIds.Category,
+			DiagnosticSeverity.Warning,
+			isEnabledByDefault: true,
+			description: "Importing a System.Reflection member (from Type.GetMethod/GetConstructor/GetField/" +
+				"GetProperty) into a dnlib module references the obfuscator's runtime corlib rather than the " +
+				"target's, producing a broken assembly. Resolve the member through the target module's corlib.");
+
+		static readonly ImmutableHashSet<string> ReflectionGetters =
+			ImmutableHashSet.Create("GetMethod", "GetConstructor", "GetField", "GetProperty");
+
+		public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => ImmutableArray.Create(Rule);
+
+		public override void Initialize(AnalysisContext context) {
+			context.EnableConcurrentExecution();
+			context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
+			context.RegisterSyntaxNodeAction(Analyze, SyntaxKind.InvocationExpression);
+		}
+
+		static void Analyze(SyntaxNodeAnalysisContext context) {
+			var invocation = (InvocationExpressionSyntax)context.Node;
+			if (invocation.Expression is not MemberAccessExpressionSyntax member ||
+				member.Name.Identifier.ValueText != "Import")
+				return;
+
+			foreach (var argument in invocation.ArgumentList.Arguments) {
+				if (argument.Expression is not InvocationExpressionSyntax inner ||
+					inner.Expression is not MemberAccessExpressionSyntax innerMember)
+					continue;
+
+				var getterName = innerMember.Name.Identifier.ValueText;
+				if (!ReflectionGetters.Contains(getterName))
+					continue;
+
+				if (context.SemanticModel.GetSymbolInfo(inner, context.CancellationToken).Symbol is not IMethodSymbol getter ||
+					getter.ContainingType?.ToDisplayString() != "System.Type")
+					continue;
+
+				context.ReportDiagnostic(Diagnostic.Create(Rule, innerMember.Name.GetLocation(), getterName));
+				return;
+			}
+		}
+	}
+}

Confuser.Analyzers/UnguardedResolveAnalyzer.cs

@@ -0,0 +1,76 @@
+using System.Collections.Immutable;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Microsoft.CodeAnalysis.Diagnostics;
+
+namespace Confuser.Analyzers {
+	/// <summary>
+	///     CX002 — flags the result of a non-throwing dnlib <c>ResolveTypeDef()</c> /
+	///     <c>ResolveMethodDef()</c> being dereferenced immediately, with no null check. Those
+	///     methods return <c>null</c> for external or unresolvable references, so a direct
+	///     dereference crashes with a <see cref="System.NullReferenceException" /> on assemblies
+	///     that reference types outside the obfuscation set.
+	/// </summary>
+	/// <remarks>
+	///     Only a genuine dereference of the result is flagged — <c>x.ResolveTypeDef().Member</c> or
+	///     <c>x.ResolveMethodDef()[i]</c>. A null-conditional (<c>?.</c>), an assignment, a
+	///     <c>return</c>, or passing the result as an argument (e.g. to dnlib's null-tolerant
+	///     <c>SigComparer.Equals</c>) is not a crash and is intentionally not reported.
+	/// </remarks>
+	[DiagnosticAnalyzer(LanguageNames.CSharp)]
+	public sealed class UnguardedResolveAnalyzer : DiagnosticAnalyzer {
+		static readonly DiagnosticDescriptor Rule = new DiagnosticDescriptor(
+			DiagnosticIds.UnguardedResolve,
+			"Resolve result dereferenced without a null check",
+			"'{0}()' returns null for unresolvable references; check the result for null before dereferencing it",
+			DiagnosticIds.Category,
+			DiagnosticSeverity.Warning,
+			isEnabledByDefault: true,
+			description: "dnlib's ResolveTypeDef()/ResolveMethodDef() return null when a reference cannot be " +
+				"resolved (external or unresolvable types). Dereferencing the result directly crashes obfuscation " +
+				"on such assemblies; guard it with a null check or the null-conditional operator.");
+
+		static readonly ImmutableHashSet<string> ResolveMethods =
+			ImmutableHashSet.Create("ResolveTypeDef", "ResolveMethodDef");
+
+		public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => ImmutableArray.Create(Rule);
+
+		public override void Initialize(AnalysisContext context) {
+			context.EnableConcurrentExecution();
+			context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
+			context.RegisterSyntaxNodeAction(Analyze, SyntaxKind.InvocationExpression);
+		}
+
+		static void Analyze(SyntaxNodeAnalysisContext context) {
+			var invocation = (InvocationExpressionSyntax)context.Node;
+			if (invocation.Expression is not MemberAccessExpressionSyntax member ||
+				!ResolveMethods.Contains(member.Name.Identifier.ValueText) ||
+				invocation.ArgumentList.Arguments.Count != 0)
+				return;
+
+			if (!IsImmediatelyDereferenced(invocation))
+				return;
+
+			context.ReportDiagnostic(Diagnostic.Create(Rule, member.Name.GetLocation(),
+				member.Name.Identifier.ValueText));
+		}
+
+		/// <summary>
+		///     Returns <c>true</c> only when <paramref name="invocation" /> is the receiver of a
+		///     plain member access or element access — i.e. its result is dereferenced right away
+		///     without a null guard. A null-conditional access makes the parent a
+		///     <see cref="ConditionalAccessExpressionSyntax" />, which is safe and returns false.
+		/// </summary>
+		static bool IsImmediatelyDereferenced(InvocationExpressionSyntax invocation) {
+			switch (invocation.Parent) {
+				case MemberAccessExpressionSyntax parentMember when parentMember.Expression == invocation:
+					return true;
+				case ElementAccessExpressionSyntax parentElement when parentElement.Expression == invocation:
+					return true;
+				default:
+					return false;
+			}
+		}
+	}
+}

Confuser.Protections/Utils.cs

@@ -12,7 +12,15 @@ internal static class Utils {
 		public static IMethod Import(this ModuleDef module, ConfuserContext context, Type classType, string method) {
 			var corLib = context.Resolver.Resolve(context.CurrentModule?.CorLibTypes.AssemblyRef, context.CurrentModule);
 			var typeInfo = corLib?.ManifestModule.Find(classType.FullName, true);
-			return (typeInfo == null) ? module.Import(classType.GetMethod(method)) : module.Import(typeInfo.FindMethod(method));
+			if (typeInfo != null)
+				return module.Import(typeInfo.FindMethod(method));
+
+			// CX001: intentional last-resort fallback. When the target module's corlib type cannot be
+			// resolved through the context (rare), host reflection is the only available source for the
+			// member reference. New code must resolve through the context instead of copying this.
+#pragma warning disable CX001
+			return module.Import(classType.GetMethod(method));
+#pragma warning restore CX001
 		}
 	}
 }

Tests/Confuser.Analyzers.Test/HostRuntimeImportAnalyzerTest.cs

@@ -0,0 +1,63 @@
+using System.Threading.Tasks;
+using Microsoft.CodeAnalysis.Testing;
+using Xunit;
+using Verify = Microsoft.CodeAnalysis.CSharp.Testing.CSharpAnalyzerVerifier<
+	Confuser.Analyzers.HostRuntimeImportAnalyzer,
+	Microsoft.CodeAnalysis.Testing.DefaultVerifier>;
+
+namespace Confuser.Analyzers.Test {
+	public class HostRuntimeImportAnalyzerTest {
+		const string Stub = @"
+using System;
+class Mod { public object Import(object member) => member; }
+";
+
+		[Fact]
+		public async Task Flags_ImportOfTypeVariableGetMethod() {
+			string source = Stub + @"
+class C {
+    void M(Mod mod, Type t) {
+        mod.Import(t.{|#0:GetMethod|}(""X""));
+    }
+}";
+			var expected = Verify.Diagnostic("CX001").WithLocation(0).WithArguments("GetMethod");
+			await Verify.VerifyAnalyzerAsync(source, expected);
+		}
+
+		[Fact]
+		public async Task Flags_ImportOfTypeofGetConstructor() {
+			string source = Stub + @"
+class C {
+    void M(Mod mod) {
+        mod.Import(typeof(string).{|#0:GetConstructor|}(Type.EmptyTypes));
+    }
+}";
+			var expected = Verify.Diagnostic("CX001").WithLocation(0).WithArguments("GetConstructor");
+			await Verify.VerifyAnalyzerAsync(source, expected);
+		}
+
+		[Fact]
+		public async Task DoesNotFlag_ImportOfNonReflectionMember() {
+			// Resolving through a non-System.Type API (the safe path) must not be flagged.
+			string source = Stub + @"
+class Resolved { public object FindMethod(string n) => null; }
+class C {
+    void M(Mod mod, Resolved r) {
+        mod.Import(r.FindMethod(""X""));
+    }
+}";
+			await Verify.VerifyAnalyzerAsync(source);
+		}
+
+		[Fact]
+		public async Task DoesNotFlag_NonImportCall() {
+			string source = Stub + @"
+class C {
+    void M(Type t) {
+        var m = t.GetMethod(""X"");
+    }
+}";
+			await Verify.VerifyAnalyzerAsync(source);
+		}
+	}
+}

Tests/Confuser.Analyzers.Test/UnguardedResolveAnalyzerTest.cs

@@ -0,0 +1,67 @@
+using System.Threading.Tasks;
+using Microsoft.CodeAnalysis.Testing;
+using Xunit;
+using Verify = Microsoft.CodeAnalysis.CSharp.Testing.CSharpAnalyzerVerifier<
+	Confuser.Analyzers.UnguardedResolveAnalyzer,
+	Microsoft.CodeAnalysis.Testing.DefaultVerifier>;
+
+namespace Confuser.Analyzers.Test {
+	public class UnguardedResolveAnalyzerTest {
+		const string Stub = @"
+class Def { public int Field; public void Do() {} }
+class Ref {
+    public Def ResolveTypeDef() => null;
+    public Def ResolveMethodDef() => null;
+}
+";
+
+		[Fact]
+		public async Task Flags_ImmediateMemberDereference() {
+			string source = Stub + @"
+class C {
+    void M(Ref r) {
+        r.{|#0:ResolveTypeDef|}().Do();
+    }
+}";
+			var expected = Verify.Diagnostic("CX002").WithLocation(0).WithArguments("ResolveTypeDef");
+			await Verify.VerifyAnalyzerAsync(source, expected);
+		}
+
+		[Fact]
+		public async Task DoesNotFlag_NullConditionalDereference() {
+			string source = Stub + @"
+class C {
+    void M(Ref r) {
+        r.ResolveMethodDef()?.Do();
+    }
+}";
+			await Verify.VerifyAnalyzerAsync(source);
+		}
+
+		[Fact]
+		public async Task DoesNotFlag_AssignmentWithoutDereference() {
+			string source = Stub + @"
+class C {
+    Def M(Ref r) {
+        var d = r.ResolveTypeDef();
+        return d;
+    }
+}";
+			await Verify.VerifyAnalyzerAsync(source);
+		}
+
+		[Fact]
+		public async Task DoesNotFlag_PassedAsArgument() {
+			// Mirrors the real VTableAnalyzer usage: the result is handed to a null-tolerant method,
+			// which is not a dereference and must not be flagged.
+			string source = Stub + @"
+class C {
+    static bool AreEqual(Def a, Def b) => true;
+    void M(Ref r) {
+        var ok = AreEqual(r.ResolveTypeDef(), r.ResolveMethodDef());
+    }
+}";
+			await Verify.VerifyAnalyzerAsync(source);
+		}
+	}
+}