Anchor .config regex to prevent matching .config.json files

[Copilot]

Fix .config file regex to prevent matching JSON files

• Understand the issue: Files with ".config" in the name (e.g., file.test.config.json) are being matched by overly broad regex
• Locate the problematic rules in dotnet_framework.json
• Fix the regex pattern from .*\\.config to .*\\.config$ to match only files ending with .config
• Create test to validate the fix
• Improve test based on feedback to properly validate filename matching
• Add exit code assertions for proper error handling validation
• Merge with main branch and add properly numbered changelog entry
• Build and test the changes
• Run manual verification with test files

Changes Made:

• Updated rules/default/security/frameworks/dotnet_framework.json:
  • Changed regex from .*\\.config to .*\\.config$ for rules DS450001, DS450002, DS450003
  • This ensures only files ending with .config are matched by xpath rules
• Added test TestConfigXPathRulesApplyOnlyToConfigFiles in AnalyzeTest.cs that:
  • Validates rules DO apply to .config files with problematic patterns
  • Validates rules do NOT apply to .config.json files even with same content
  • Properly tests the filename matching logic rather than just content matching
  • Verifies commands complete successfully without errors
• Updated Changelog.md with version 1.0.74 entry

Verification:

• ✅ .config.json files no longer trigger XML parsing errors
• ✅ Actual .config files still correctly trigger xpath rules
• ✅ Test validates filename matching logic directly
• ✅ All 300 tests pass
• ✅ Branch merged with main
• ✅ Changelog properly numbered per guidelines

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Parsing JSON files as XML in CLI</issue_title>
<issue_description>Describe the bug
When analysing JSON files with dots in their names (e.g., file.test.config.json), DevSkim CLI incorrectly attempts to parse them as XML, resulting in a parsing error: [13:40:06 ERR] Failed to parse Data at the root level is invalid. Line 1, position 1. as a XML document: null

To Reproduce
Steps to reproduce the behavior:

1. Create a JSON file with dots in its name, such as file.test.config.json.
2. Run the DevSkim analyze command on this file. I have run devskim analyze -I ./src -s Important -E true -g **/bin/**,**/obj/**,**/.git/**,**/node_modules/** -x Verbose
3. Observe the error message indicating a failure to parse the file as XML.

Expected behavior
DevSkim should be able to recognise and parse a JSON file.

Screenshots

Versions(please complete the following information):

• OS: Windows 10 (10.0.22631)
• Devskim Version 1.0.51+210b5d121e

Additional context
N/A
</issue_description>

<agent_instructions>Investigate this issue with files named .config and xpath queries.</agent_instructions>

Comments on the Issue (you are Copilot in this section)

Michael Scovetta (@scovetta) Thanks Alex Koller (@alexandrakoller)! I suspect this isn't due to the extra dot in the name, but the '.config' substring in your example, since .config files are parsed as XML by design. Are you able to repro if the name is just "foo.bar.baz.json"? Giulia Stocco (@gfs) In order to perform xpath computation, first we have to try to parse the file as XML, which is failing, as expect for a json document, but there's no way to know its not XML without trying to parse it, so the issue may just be that this message shouldn't be logged as an error: https://github.com/microsoft/ApplicationInspector/blob/567ac2faadc9984edca818855d0f961f08edc255/AppInspector.RulesEngine/TextContainer.cs#L195 Giulia Stocco (@gfs) I double checked and do receive this error with a file with that particular name which seems to be due to the ".config" portion of the filename. If I swap out ".config" for anything else the error no longer appears. I think this indicates that one of the default rules that uses xpaths has an applies to filter that is too broad. This shouldn't impact actual scan results though, because of course that rule won't be able to apply since the xpath filtering won't work.

• Fixes Parsing JSON files as XML in CLI #675

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Giulia Stocco (gfs)]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[Copilot]

Pull request overview

This pull request fixes an issue where DevSkim CLI incorrectly attempted to parse JSON files containing .config in their filename (e.g., file.test.config.json) as XML files, resulting in parsing errors.

Changes:

• Fixed overly broad regex patterns in three .NET Framework security rules (DS450001, DS450002, DS450003)
• Changed regex from .*\\.config to .*\\.config$ to match only files ending with .config
• Added comprehensive test to validate the fix works for both .config and .config.json files

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
rules/default/security/frameworks/dotnet_framework.json	Anchored regex patterns with $ for rules DS450001, DS450002, and DS450003 to prevent matching files that merely contain .config in their name
DevSkim-DotNet/Microsoft.DevSkim.Tests/AnalyzeTest.cs	Added test validating that xpath rules apply to .config files but not to .config.json files

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Giulia Stocco (gfs)]

Copilot update branch with main and add appropriate entry to changelog

[Copilot]

Copilot update branch with main and add appropriate entry to changelog

Branch updated with main and changelog entry added in commit 301d266.

[Giulia Stocco (gfs)]

Copilot follow the copilot instructions and properly number the change in the changelog.

[Copilot]

Copilot follow the copilot instructions and properly number the change in the changelog.

Changelog updated with proper version number [1.0.74] in commit c83a414.

[Giulia Stocco (gfs)]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[Dan Fiedler (danfiedler-msft)]

100% nit that shouldn't hold up the merge, but this should be two separate tests methods.