Tier 3: Custom ConfuserEx-specific Roslyn analyzers

[mcpolo99]

Parent: #46
Depends on: #48

Custom Roslyn Analyzers for ConfuserEx

Domain-specific analyzers that catch the exact bugs we've been fixing at compile time, preventing regressions.

Analyzer Rules

ID	Pattern	Severity	Violations	Prevents
CX001	typeof(X).GetMethod() with module.Import() — imports from host runtime	Error	3	Wrong mscorlib version (#7)
CX002	ResolveTypeDef()/ResolveMethodDef() without null check before use	Warning	6 (2-3 real bugs)	Crashes on external assemblies (#13, #27)
CX003	ResolveThrow/ResolveTypeDefThrow usage audit	Info	~34 (most intentional)	Awareness — flags spots to evaluate
CX004	Assembly.GetTypes() without ReflectionTypeLoadException catch	Warning	2	Packer startup crashes (#24)

Scope

This issue covers:

1. Create Confuser.Analyzers project (netstandard2.0)
2. Implement all 4 analyzers (CX001-CX004)
3. Wire into build via ConfuserEx.Common.targets
4. Fix all existing violations found by the analyzers
5. Add analyzer tests

Implementation Order

1. CX003 (easy, ~120 LOC) — set up project infrastructure, simple method name match
2. CX001 (medium, ~170 LOC) — nested invocation detection + fix 3 violations
3. CX004 (medium, ~230 LOC) — type discrimination + try-catch walk + fix 2 violations
4. CX002 (hard, ~300 LOC) — data flow analysis + fix VTableAnalyzer.cs:355-356

Technical Requirements

• Target: netstandard2.0 (required for Roslyn analyzers)
• Dependencies: Microsoft.CodeAnalysis.CSharp ≥ 3.3.1, Microsoft.CodeAnalysis.Analyzers ≥ 3.3.4
• Testing: Microsoft.CodeAnalysis.CSharp.Analyzer.Testing.XUnit
• Integration: ProjectReference with OutputItemType=Analyzer in shared targets

Known Violations to Fix

CX001 (3 files):

• Confuser.Protections/Resources/InjectPhase.cs:139
• Confuser.Protections/Constants/EncodePhase.cs:124
• Confuser.Protections/Compress/Compressor.cs:199

CX002 (2 files):

• Confuser.Renamer/Analyzers/VTableAnalyzer.cs:355-356 (2 unguarded calls)

CX004 (2 files):

• Confuser.Core/PluginDiscovery.cs:58
• ConfuserEx/ComponentDiscovery.cs:15

Estimated Effort

~1,050 lines total (820 analyzer + 230 tests). Implementation order above allows incremental delivery.

[mcpolo99]

Resolved by #95 (squash-merged to develop as 44e6f29). All four Tier 3 analyzers shipped: CX004 (GetTypes/RTLE), CX003 (Resolve…Throw audit), CX002 (unguarded Resolve deref), CX001 (host-reflection import). 17 analyzer tests; violations fixed/suppressed. Note: CX001/CX002 premises were stale and were corrected against the current code (see PR).