[michaelnebel]

Instead of searching through all files (including source code files) we attempt to read the files as XML instead for detecting framework and package dependencies (and other project related settings). This will

• Implicitly enable "fail-fast" (as an exception will be thrown as non-XML file content is found).
• Make it easier to extend the logic for detecting certain properties.

Note, that this change impacts the semantics of the heuristic and we expect that this generally improves the precision of the heuristic detection of project properties.

• Only XML file content is taken into consideration.
• XML split across multiple lines will now be parsed and detected correctly.
• Comments across multiple lines will be handled correctly.
• <Sdk Name="..."> is now taken into consideration.
• We don't do any handling of encoding (pointed out by CoPilot) and I don't think that is worth incorporating unless we see a concrete use-case.

Furthermore, this is expected to improve performance: We do less parsing of text as the XmlReader gives up and throws an exception, as soon as non-XML is encountered (before we read all text from all files and did regular expression matching).

DCA looks good

• Drastic reduction in the number of calls with missing call target for dotnet/efcore.
• Performance appears unaffected.

[Copilot]

🟡 Changes recommended

Case-sensitive MSBuild element matching ignores valid settings, and failed XML parsing leaves partial dependencies and settings committed, allowing invalid files to affect restoration.

2 open issues

• Prevent partial state commits when XML parsing fails · New
• Preserve case-insensitive MSBuild property and item matching · New

What changed in this PR

Replaces text-based dependency detection in the C# extractor with streaming XML parsing, improving handling of project settings, multiline elements, and XML comments.

Changes:

• Replaces regular expressions with XmlReader for detecting packages and project settings.
• Changes file reading to streams and logs XML parsing failures.
• Expands tests for XML syntax, namespaces, comments, packages.config, and invalid input.

File	Description
csharp/​extractor/​Semmle.Extraction.Tests/​FileContent.cs	Updates test fixtures and adds XML parsing coverage.
csharp/​extractor/​Semmle.Extraction.CSharp.DependencyFetching/​FileContent.cs	Implements streaming XML-based dependency and settings detection.

_{Review effort: Balanced (auto)}

[Copilot]

🔵 Needs a closer look

Unresolved regressions misclassify SDK import-form projects, skipping Razor/.resx generation, and skip valid Windows-1252-declared projects, losing package and framework references.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Register code-page provider for Windows-1252 XML

csharp/​extractor/​Semmle.Extraction.CSharp.DependencyFetching/​FileContent.cs:155

An otherwise valid, ASCII-only project declaring encoding="windows-1252" is now skipped at its declaration unless a code-page provider is registered. The extractor targets .NET 10 and does not register one, so this loses package and framework references that the old StreamReader path found. Register CodePagesEncodingProvider before creating XML readers, while keeping stream-based decoding for correctly declared encodings.

Recognize SDK attribute in project imports

csharp/​extractor/​Semmle.Extraction.CSharp.DependencyFetching/​FileContent.cs:275

Projects that declare their SDK with <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" /> now leave IsSdkProjectStructureUsed false; the removed regex recognized this form. In repositories using only these imports, that skips Razor/.resx source generation and falls back to the executing runtime. Check the Sdk attribute in this branch as well, and add an import-form regression test.

2 resolved since last review

• Preserve case-insensitive MSBuild property and item matching
• Prevent partial state commits when XML parsing fails

_{Review effort: Max}