Add support for parsing .csproj files and enhance repo URL validation

Author: murat.oguz

backend/app/services/file_analyzer.py

@@ -30,48 +30,95 @@ def parse_package_json(text: str) -> List[Dict[str, Any]]:
             deps.append({"name": name, "version": version})
     return deps
 
+def parse_csproj_file(content: str) -> List[Dict[str, Any]]:
+    """Parse a .csproj file content and extract PackageReference entries.
 
-def parse_requirements(text: str) -> List[Dict[str, Any]]:
+    Returns a list of dicts with keys: `name` and `version` (version may be None).
+    Handles both attribute-style (`<PackageReference Include="Foo" Version="1.2.3" />`)
+    and nested `<Version>` child elements. Works with XML namespaces.
+    """
+    try:
+        root = ET.fromstring(content)
+    except ET.ParseError:
+        return []
+
+    deps: List[Dict[str, Any]] = []
+
+    def local_name(tag: str) -> str:
+        return tag.split('}')[-1] if '}' in tag else tag
+
+    # Iterate through all elements and find PackageReference nodes
+    for elem in root.iter():
+        if local_name(elem.tag) != 'PackageReference':
+            continue
+
+        # Name can be in Include or Update attribute
+        name = elem.get('Include') or elem.get('Update')
+
+        # Version can be an attribute or a child <Version> element
+        version = elem.get('Version')
+        if version is None:
+            for child in list(elem):
+                if local_name(child.tag) == 'Version' and (child.text or '').strip():
+                    version = (child.text or '').strip()
+                    break
+
+        if name:
+            deps.append({"name": name, "version": version})
+
+    return deps
+
+def parse_requirements(text: str, filename: str="") -> List[Dict[str, Any]]:
     # Support two common formats:
     # 1) pip-style requirements (lines with optional ==version)
     # 2) NuGet packages.config XML
     text_stripped = text.strip()
-    # Heuristic: if it looks like XML and contains <package ... />, parse as packages.config
-    if text_stripped.startswith("<?xml") or "<packages" in text_stripped or "<package" in text_stripped:
-        deps: List[Dict[str, Any]] = []
-        try:
-            root = ET.fromstring(text)
-            # Handle <packages><package id="..." version="..." /></packages>
-            for pkg in root.findall('.//package'):
-                name = pkg.get('id') or pkg.get('Id') or pkg.get('name')
-                version = pkg.get('version') or pkg.get('Version')
-                if name:
-                    deps.append({"name": name, "version": version})
-        except ET.ParseError:
-            # Fall back to pip-style parsing if XML parsing fails
-            deps = []
-            for raw in text.splitlines():
-                line = raw.strip()
-                if not line or line.startswith("#"):
-                    continue
-                if "==" in line:
-                    name, ver = line.split("==", 1)
-                    deps.append({"name": name.strip(), "version": ver.strip()})
-                else:
-                    deps.append({"name": line, "version": None})
-        return deps
-
-    # Default: pip-style requirements
-    deps = []
-    for raw in text.splitlines():
-        line = raw.strip()
-        if not line or line.startswith("#"):
-            continue
-        if "==" in line:
-            name, ver = line.split("==", 1)
-            deps.append({"name": name.strip(), "version": ver.strip()})
-        else:
-            deps.append({"name": line, "version": None})
+    deps: List[Dict[str, Any]] = []
+
+    if filename and filename.lower().endswith(".csproj"):
+        deps = parse_csproj_file(content=text_stripped)
+    elif (filename and filename.lower().find("packages.config") != -1):
+        return parse_packages_config(text)
+    else:
+        # Default: pip-style requirements
+        deps = []
+        for raw in text.splitlines():
+            line = raw.strip()
+            if not line or line.startswith("#"):
+                continue
+            if "==" in line:
+                name, ver = line.split("==", 1)
+                deps.append({"name": name.strip(), "version": ver.strip()})
+            else:
+                deps.append({"name": line, "version": None})
+    return deps
+
+
+def parse_packages_config(text: str) -> List[Dict[str, Any]]:
+    """Parse a NuGet `packages.config` XML or fall back to pip-style lines.
+
+    Returns list of {name, version}.
+    """
+    deps: List[Dict[str, Any]] = []
+    try:
+        root = ET.fromstring(text)
+        # Handle <packages><package id="..." version="..." /></packages>
+        for pkg in root.findall('.//package'):
+            name = pkg.get('id') or pkg.get('Id') or pkg.get('name')
+            version = pkg.get('version') or pkg.get('Version')
+            if name:
+                deps.append({"name": name, "version": version})
+    except ET.ParseError:
+        # Fall back to pip-style parsing if XML parsing fails
+        for raw in text.splitlines():
+            line = raw.strip()
+            if not line or line.startswith("#"):
+                continue
+            if "==" in line:
+                name, ver = line.split("==", 1)
+                deps.append({"name": name.strip(), "version": ver.strip()})
+            else:
+                deps.append({"name": line, "version": None})
     return deps
 
 
@@ -88,7 +135,7 @@ def analyze_file(filename: str, content: str) -> Dict[str, Any]:
     elif manager == "maven":
         result["ecosystem"] = "maven"
     elif manager == "nuget":
-        result["dependencies"] = parse_requirements(content)
+        result["dependencies"] = parse_requirements(content, filename=filename)
         result["ecosystem"] = "nuget"
     else:
         result["ecosystem"] = "unknown"

backend/app/services/repo_scanner.py

@@ -18,18 +18,17 @@
     "pom.xml", "build.gradle", "build.gradle.kts",
     # .NET
     "packages.config",
-    # TODO: Disable until .csproj support is added
-    # "csproj",
+    ".csproj",
     # Go
     "go.mod", "vendor/modules.txt",
 }
 
 
 def is_dependency_file(filename: str) -> bool:
     lower = filename.lower()
-    # TODO: Disable until .csproj support is added
-    # if lower.endswith(".csproj"):
-    #     return True
+
+    if lower.endswith(".csproj"):
+        return True
     return lower in DEP_FILES
 
 

backend/app/views/library_view.py

@@ -294,6 +294,10 @@ async def handle_repo_clone(payload: dict):
     repo_url = payload.get('url')
     if not repo_url:
         raise HTTPException(status_code=400, detail='url is required')
+    if not isinstance(repo_url, str):
+        raise HTTPException(status_code=400, detail='url must be a string')
+    # ensure static type checkers see a plain str
+    repo_url = str(repo_url)
 
     try:
         root = clone_repository(repo_url)
@@ -329,9 +333,12 @@ async def handle_repo_list_packages(payload: dict):
             summaries = list_repository_packages(root)
             return {"root": root, "files": summaries}
         # else clone then list
-        root = clone_repository(repo_url)
-        summaries = list_repository_packages(root)
-        return {"url": repo_url, "root": root, "files": summaries}
+        elif repo_url:
+            if not isinstance(repo_url, str):
+                raise HTTPException(status_code=400, detail='url must be a string')
+            root = clone_repository(str(repo_url))
+            summaries = list_repository_packages(root)
+            return {"url": repo_url, "root": root, "files": summaries}
     except Exception as error:
         raise HTTPException(status_code=500, detail=str(error))
 
@@ -346,6 +353,9 @@ async def handle_repo_scan_highest_risk(payload: dict):
     repo_url = payload.get('url')
     if not repo_url:
         raise HTTPException(status_code=400, detail='url is required')
+    if not isinstance(repo_url, str):
+        raise HTTPException(status_code=400, detail='url must be a string')
+    repo_url = str(repo_url)
 
     client = get_mcp_http_client()
     if not client: