MTA-6471 C# Provider Documentation

Prabha Kylasamiyer Sundara Rajan · Prabha Kylasamiyer Sundara Rajan · commit 1dd58faa0956 · 2026-03-04T14:19:19.000+05:30
Signed-off-by: Prabha Kylasamiyer Sundara Rajan &lt;pkylasam@pkylasam-thinkpadp16vgen1.bengluru.csb&gt;
diff --git a/assemblies/rules-development-guide/assembly_creating-rule.adoc b/assemblies/rules-development-guide/assembly_creating-rule.adoc
@@ -30,6 +30,7 @@ include::topics/rules-development/create-nodejs-custom-rule.adoc[leveloffset=+1]
 
 include::topics/rules-development/create-python-custom-rule.adoc[leveloffset=+1]
 
+include::topics/rules-development/create-csharp-custom-rule.adoc[leveloffset=+1]
 
 ifdef::parent-context-of-creating-rule[:context: {parent-context-of-creating-rule}]
 ifndef::parent-context-of-creating-rule[:!context:]
diff --git a/assemblies/rules-development-guide/assembly_rule-yaml-conditions.adoc b/assemblies/rules-development-guide/assembly_rule-yaml-conditions.adoc
@@ -16,25 +16,24 @@ endif::[]
 :context: rules-prov-cond
 
 [role="_abstract"]
-The providers are the modular components in charge of analyzing a given language. Providers are able to analyze code by leveraging the Language Server Protocol (LSP). Through the LSP, all code analysis is abstracted away from the analysis engine and left to the specific LSP server to run the search query defined in the rule on the source code. 
+The providers are the modular components in charge of analyzing a given language. The external providers, except `csharp`, are able to analyze code by leveraging the Language Server Protocol (LSP). Through the LSP, all code analysis is abstracted away from the analysis engine and left to the specific LSP server to run the search query defined in the rule on the source code. 
 
 Additionally, {ProductShortName} provides a built-in provider with abilities such as XML parsing, running regular expressions on files, and so on.
 
 Currently, {ProductShortName} supports the following providers:
 
 * Builtin
-* Java 
-* Go 
-* External providers (for `Python`, `Dotnet` and `Node.js` applications) initialized by the generic provider binary
+* Java  
+* External providers (for `Python`, `Csharp`,`Go`, and `Node.js` applications) 
 
 [NOTE]
 ====
 You can use the generic provider binary to create an external provider for any language that is compliant with link:https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/[LSP 3.17 specifications].
 ====
 
-.Using the provider capability in custom rules
+== Using the provider capability in custom rules
 
-In a rule, the when block is where the conditions for matching the rule are specified. Each provider offers a series of capabilities to do matching.. The search query in the rule condition can contain patterns, code locations, specific dependencies to be found, and so on, to evaluate the source code and dependencies. The provider sends the LSP server a request to check the search query against the application being analyzed. When the LSP server returns a match for the search in the source code, the analyzer triggers a violation.
+In a rule, the when block is where the conditions for matching the rule are specified. Each provider offers a series of capabilities to do matching. The search query in the rule condition can contain patterns, code locations, specific dependencies to be found, and so on, to evaluate the source code and dependencies. The provider sends the LSP server a request to check the search query against the application being analyzed. When the LSP server returns a match for the search in the source code, the analyzer triggers a violation.
 
 The syntax for the when block is as follows: contains one condition, but that condition can have multiple conditions nested under it.
 
diff --git a/docs/topics/rules-development/create-csharp-custom-rule.adoc b/docs/topics/rules-development/create-csharp-custom-rule.adoc
@@ -0,0 +1,77 @@
+// Module included in the following assemblies:
+//
+// * docs/rules-development-guide/master.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="create-csharp-custom-rule_{context}"]
+= Creating a custom C# rule
+
+[role="_abstract"]
+You can create custom rules for `C#` applications based on the following example.
+
+You can use the following custom rule to check if {ProductShortName} triggers an incident when it detects the `WebMatrix.WebData.WebSecurity` class in the `nerd-dinner` example project.
+
+.Prerequisites
+
+* You installed `ilspycmd` and `paket` dependencies
+* You installed `dotnet tools` and exported the `dotnet tools` path by using the `export PATH="$PATH:<path/to/.dotnet/tools"` command
+
+.Procedure
+. Create a `csharp-rule.yaml` file in your `Home` directory. 
+
+. Copy the following rule in the `csharp-rule.yaml` file:
++
+
+[source, yaml]
+----
+- category: mandatory
+  customVariables: []
+  description: WebMatrix.WebData.WebSecurity is not available in .NET Core
+  effort: 8
+  labels:
+  - konveyor.io/source=dotnet
+  - konveyor.io/target=dotnet-core
+  links:
+  - title: Introduction to Identity on ASP.NET Core
+    url: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity
+  - title: Migrate Authentication and Identity to ASP.NET Core
+    url: https://learn.microsoft.com/en-us/aspnet/core/migration/identity
+  message: |
+    WebMatrix.WebData.WebSecurity is not available in .NET Core and must be replaced with ASP.NET Core Identity.
+
+    Migration actions:
+    - Add Microsoft.AspNetCore.Identity.EntityFrameworkCore NuGet package
+    - Create ApplicationUser class inheriting from IdentityUser
+    - Update DbContext to inherit from IdentityDbContext<ApplicationUser>
+    - Replace WebSecurity.Login with SignInManager.PasswordSignInAsync
+    - Replace WebSecurity.Logout with SignInManager.SignOutAsync
+    - Replace WebSecurity.CreateUserAndAccount with UserManager.CreateAsync
+    - Replace WebSecurity.ChangePassword with UserManager.ChangePasswordAsync
+    - Configure Identity in Startup.ConfigureServices with AddIdentity or AddDefaultIdentity
+  ruleID: dotnet-core-websecurity-01
+  when:
+    csharp.referenced:
+      location: ALL
+      pattern: WebMatrix.WebData.WebSecurity
+----
+
+. Open a C# project that has the `WebMatrix.WebData.WebSecurity` class.
+
+. Run the following command in the {ProductShortName} CLI:
++
+
+[source, terminal]
+----
+$ ./mta-cli analyze -i _path_to_nerd-dinner_ -o _path_to_report_ --overwrite --run-local=false --enable-default-rulesets=false --mode source-only --rules ~/csharp-rule.yaml 
+----
++
+
+[NOTE]
+====
+Add the `--overwrite` option if you want to use the same directory for the report when you run subsequent tests. {ProductShortName} overwrites the current report with the result of the latest analysis that you run.
+====
+
+. Open the static report at _path_to_report_ in your browser.
+
+. Navigate to the issues to verify the *`WebMatrix.WebData.WebSecurity` is not available in `.NET Core`* issue.
+
diff --git a/docs/topics/rules-development/yaml-dotnet-provider.adoc b/docs/topics/rules-development/yaml-dotnet-provider.adoc
@@ -4,23 +4,27 @@
 
 :_mod-docs-content-type: REFERENCE
 [id="yaml-dotnet-provider_{context}"]
-= Dotnet provider
+= Csharp provider
 
 [role="_abstract"]
-The `dotnet` provider is an external provider used to analyze .NET and C# source code. Currently, the provider supports the `referenced` capability.
+The `csharp` provider is an external provider used to analyze `.NET` and `C#` source code. Currently, the provider supports the `referenced` capability.
 
-.`referenced`
+The `csharp` provider uses a gRPC interface to perform a semantic analysis of an application source code in the `source-only` mode. The provider parses the source code by using tree-sitter and uses stack graph for the analysis to find references to types, methods, classes, and fields. Based on the `C#` rule definition, the analyzer identifies violations in your code that you must resolve before the application migration. 
 
-By using the `referenced` capability, the provider finds references in the source code.
+`referenced`::
+
+The `csharp` provider supports `referenced` capability in rules to define fields such as `pattern`and `location` based on which the provider searches the code for violations. 
 
 [source,yaml]
 ----
 when:
-  dotnet.referenced:
+  csharp.referenced:
     pattern: "<pattern>" 
-    namespace: "<namespace>" 
+    location: CLASS 
 ----
 where:
 
- `pattern` :: A regular expression pattern to match the desired reference. For example, `HttpNotFound`.
- `namespace` :: Specifies the namespace to search within. For example, `System.Web.Mvc`.
+ `pattern` :: A regular expression pattern to match the needed reference. For example, `System.Web.Http.ApiController.*`
+ `location` :: Specifies the location in the source code to search the pattern. For example, `CLASS`.
+
+NOTE: You can also specify `location` as `METHOD`, `FIELD`, or `ALL`. When the `location` is `ALL`, the `C#` provider runs a search query for namespaces, structure types, and interfaces.
diff --git a/docs/topics/rules-development/yaml-provider-conditions.adoc b/docs/topics/rules-development/yaml-provider-conditions.adoc
@@ -27,14 +27,15 @@ The analyzer currently supports the following `provider` conditions:
 * `go`
 * `nodejs`
 * `python`
-* `dotnet`
-
-:FeatureName: Dotnet provider
+* `csharp`
 
+:FeatureName: Csharp provider
 [IMPORTANT]
 ====
 [subs="attributes+"]
-{FeatureName} is a Developer Preview feature only. Developer Preview features are not supported by Red Hat in any way and are not functionally complete or production-ready. Do not use Developer Preview features for production or business-critical workloads. Developer Preview features provide early access to upcoming product features in advance of their possible inclusion in a Red Hat product offering, enabling customers to test functionality and provide feedback during the development process. These features might not have any documentation, are subject to change or removal at any time, and testing is limited. Red Hat might provide ways to submit feedback on Developer Preview features without an associated SLA.
+{FeatureName} is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
+
+For more information about the support scope of Red Hat Technology Preview features, see link:https://access.redhat.com/support/offerings/techpreview/[Technology Preview Features Support Scope].
 ====
 :!FeatureName:
 
@@ -50,7 +51,7 @@ The analyzer currently supports the following `provider` conditions:
 
 | Providers that have rules already defined in the product
 a| 
-* `dotnet`
+* `csharp`
 * `java`
 
 |Providers that require custom rulesets for analysis
@@ -163,6 +164,17 @@ when:
   go.dependency:
     <fields>
 ----
+
+|`csharp`
+|references
+a|Find references to a pattern.
+For example, 
+[source,yaml]
+----
+when:
+  csharp.referenced:
+    <fields>
+----
 |===
 
 Following the example in the previous table, you can create the first part of the condition that does not contain any of the condition fields.
@@ -444,13 +456,75 @@ when:
       lowerbound: v4.2.0
 ----
 
-.3+|xref:yaml-dotnet-provider_rules-prov-cond[dotnet]
+.2+|xref:yaml-dotnet-provider_rules-prov-cond[csharp]
 .2+|referenced
 |pattern
 |Yes
-|Regular expression to match a reference in the source code. For example, `HttpNotFound`.
+|Regular expression to match a reference in the source code. For example, `System.Web.Mvc.*`.
 
-|namespace
+|location
 |Yes
-|Specify the namespace within which the search query must be run. For example, `System.Web.Mvc`.
+a|Specify one of the following for which the search query must be run. 
+
+ * Type reference including classes, interfaces and structure types (struct)
+
+ For example, 
+[subs="+quotes"]
+----
+when:
+  csharp.referenced:
+    location: CLASS
+    pattern: System.Web.Http.ApiController.*
+----
+ For example, 
+[subs="+quotes"]
+----
+when:
+  csharp.referenced:
+    location: ALL
+    pattern: "System.Console.Print*"
+----
+
+ * Method calls and definitions
+ 
+ For example, 
+[subs="+quotes"]
+----
+when:
+  csharp.referenced:
+    location: METHOD
+    pattern: "*.AppDomain.Unload"
+----
+
+ * Field usages and declaration
+
+ For example, 
+[subs="+quotes"]
+----
+when:
+  csharp.referenced:
+    location: FIELD
+    pattern: "DotNetOpenAuth.AspNet.AuthenticationResult.Provider"
+----
+
+ * Namespace imports and usages
+
+ For example, 
+[subs="+quotes"]
+----
+when:
+  csharp.referenced:
+    location: ALL
+    pattern: "System.Windows.Forms"
+----
+
+ * `ALL` - You can also specify `ALL` as `location` to run a search query namespaces, structure types, and interfaces.
+
+ For example, 
+[subs="+quotes"]
+----
+when:
+  csharp.referenced:
+    location: ALL
+----
 |===
diff --git a/docs/topics/vscode/proc_vscode-analyzing-application.adoc b/docs/topics/vscode/proc_vscode-analyzing-application.adoc
@@ -7,7 +7,12 @@ You can run a static code analysis of an application with or without enabling th
 
 .Prerequisites
 
-* You opened a Java project in your VS Code workspace.
+* You opened a project in your VS Code workspace.
+* You installed the following for `.NET` or `C#` application analysis:
+.. The {ProductShortName} Core and `C#` extensions 
+.. `dotnet tools` and added it to the `$PATH` environment variable
+.. `ilspycmd` command line tool for the `ILSpy.NET` decompiler
+.. `paket` package manager
 * You configured an analysis profile on the *{ProductShortName} Analysis View* page. For more information, see xref:configuring-profile-settings_vsc-extension-guide[Configuring the {ProductShortName} profile settings].
 
 .Procedure
