feature: add CX003 Resolve...Throw audit analyzer (#49)

CX003 surfaces every call to a dnlib Resolve...Throw helper (ResolveThrow,
ResolveTypeDefThrow, ResolveMethodDefThrow, ResolveFieldThrow) at Info severity —
an awareness rule for spots that crash on unresolvable references. Info severity
means no build noise (the ~34 existing intentional uses are not reported as
warnings). 5 tests.

Author: RandomCrocodile

Confuser.Analyzers/ResolveThrowAuditAnalyzer.cs

@@ -0,0 +1,54 @@
+using System.Collections.Immutable;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Microsoft.CodeAnalysis.Diagnostics;
+
+namespace Confuser.Analyzers {
+	/// <summary>
+	///     CX003 — an awareness/audit rule that surfaces every call to a dnlib <c>Resolve…Throw</c>
+	///     helper (<c>ResolveThrow</c>, <c>ResolveTypeDefThrow</c>, <c>ResolveMethodDefThrow</c>,
+	///     <c>ResolveFieldThrow</c>). These throw when a reference cannot be resolved, which crashes
+	///     obfuscation on assemblies with external/unresolvable members. Most uses are intentional;
+	///     this reports at <see cref="DiagnosticSeverity.Info" /> so the spots can be evaluated
+	///     without adding build noise.
+	/// </summary>
+	[DiagnosticAnalyzer(LanguageNames.CSharp)]
+	public sealed class ResolveThrowAuditAnalyzer : DiagnosticAnalyzer {
+		static readonly DiagnosticDescriptor Rule = new DiagnosticDescriptor(
+			DiagnosticIds.ResolveThrowAudit,
+			"Throwing resolve helper used",
+			"'{0}' throws when resolution fails; confirm the target is always resolvable or prefer the non-throwing overload with a null check",
+			DiagnosticIds.Category,
+			DiagnosticSeverity.Info,
+			isEnabledByDefault: true,
+			description: "dnlib's Resolve...Throw helpers throw when a type/member reference cannot be " +
+				"resolved. This surfaces each usage for review; external or unresolvable references should " +
+				"use the non-throwing Resolve... overload with a null check instead.");
+
+		public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => ImmutableArray.Create(Rule);
+
+		public override void Initialize(AnalysisContext context) {
+			context.EnableConcurrentExecution();
+			context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
+			context.RegisterSyntaxNodeAction(Analyze, SyntaxKind.InvocationExpression);
+		}
+
+		static void Analyze(SyntaxNodeAnalysisContext context) {
+			var invocation = (InvocationExpressionSyntax)context.Node;
+			if (invocation.Expression is not MemberAccessExpressionSyntax member)
+				return;
+
+			var name = member.Name.Identifier.ValueText;
+			if (!IsResolveThrowName(name))
+				return;
+
+			context.ReportDiagnostic(Diagnostic.Create(Rule, member.Name.GetLocation(), name));
+		}
+
+		static bool IsResolveThrowName(string name) =>
+			name.Length > "ResolveThrow".Length - 1 &&
+			name.StartsWith("Resolve", System.StringComparison.Ordinal) &&
+			name.EndsWith("Throw", System.StringComparison.Ordinal);
+	}
+}

Tests/Confuser.Analyzers.Test/ResolveThrowAuditAnalyzerTest.cs

@@ -0,0 +1,39 @@
+using System.Threading.Tasks;
+using Microsoft.CodeAnalysis.Testing;
+using Xunit;
+using Verify = Microsoft.CodeAnalysis.CSharp.Testing.CSharpAnalyzerVerifier<
+	Confuser.Analyzers.ResolveThrowAuditAnalyzer,
+	Microsoft.CodeAnalysis.Testing.DefaultVerifier>;
+
+namespace Confuser.Analyzers.Test {
+	public class ResolveThrowAuditAnalyzerTest {
+		[Theory]
+		[InlineData("ResolveThrow")]
+		[InlineData("ResolveTypeDefThrow")]
+		[InlineData("ResolveMethodDefThrow")]
+		[InlineData("ResolveFieldThrow")]
+		public async Task Flags_ResolveThrowHelpers(string methodName) {
+			string source = @"
+class Ref { public object " + methodName + @"() => null; }
+class C {
+    void M(Ref r) {
+        var x = r.{|#0:" + methodName + @"|}();
+    }
+}";
+			var expected = Verify.Diagnostic("CX003").WithLocation(0).WithArguments(methodName);
+			await Verify.VerifyAnalyzerAsync(source, expected);
+		}
+
+		[Fact]
+		public async Task DoesNotFlag_NonThrowingResolve() {
+			const string source = @"
+class Ref { public object ResolveTypeDef() => null; }
+class C {
+    void M(Ref r) {
+        var x = r.ResolveTypeDef();
+    }
+}";
+			await Verify.VerifyAnalyzerAsync(source);
+		}
+	}
+}