System.UnauthorizedAccessException thrown if .csproj file is read-only

[FredAtIvory]

Upgraded from 2.7.0 to 3.05 and getting System.UnauthorizedAccessException when CycloneDX attempts to open a read-only .csproj file.

I am specifying a .sln file on the command line which references multiple .csproj files. I I make the .cs

Windows 10 and 11, .NET 8.0

This seems like new behavior since 2.7.0 works fine on the same .sln/.csproj file set. I expect it to be able to parse the .csproj file even if it is read-only.

I am passing a .sln file on the command line which references several .csproj files. My .csproj files are RO. If I make one RW, 3.0.5 will open it, but then the exception is thrown on the next .csproj file which is RO.

This happens in ProjectFileService.cs: line 92, possibly added with -ipr feature.

91 XmlDocument xmldoc = new XmlDocument();
92 using var fileStream = _fileSystem.FileStream.New(projectFilePath, FileMode.Open);
93 xmldoc.Load(fileStream);

Stack trace:

Unhandled exception: System.UnauthorizedAccessException: Access to the path 'C:\my-app\my-project.csproj' is denied.
at Microsoft.Win32.SafeHandles.SafeFileHandle.CreateFile(String fullPath, FileMode mode, FileAccess access, FileShare share, FileOptions options)
at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String fullPath, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize, Nullable1 unixCreateMode)
at System.IO.Strategies.OSFileStreamStrategy..ctor(String path, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize, Nullable1 unixCreateMode)
at System.IO.Strategies.FileStreamHelpers.ChooseStrategyCore(String path, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize, Nullable1 unixCreateMode)
at System.IO.FileStream..ctor(String path, FileMode mode)
at System.IO.Abstractions.FileStreamFactory.New(String path, FileMode mode)
at CycloneDX.Services.ProjectFileService.GetProjectNameAndVersion(String projectFilePath) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/ProjectFileService.cs:line 92
at CycloneDX.Services.ProjectFileService.RecursivelyGetProjectReferencesAsync(String projectFilePath) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/ProjectFileService.cs:line 331
at CycloneDX.Services.SolutionFileService.GetSolutionProjectReferencesAsync(String solutionFilePath) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/SolutionFileService.cs:line 73
at CycloneDX.Services.SolutionFileService.GetSolutionDotnetDependencys(String solutionFilePath, String baseIntermediateOutputPath, Boolean excludeTestProjects, String framework, String runtime) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/SolutionFileService.cs:line 99
at CycloneDX.Runner.HandleCommandAsync(RunOptions options) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Runner.cs:line 167
at CycloneDX.Program.<>c__DisplayClass0_0.<

b__2>d.MoveNext() in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Program.cs:line 137

[mtsfoni]

Hello Fred,

thanks for reporting the issue. I could reproduce it and prepared a fix at #860. There are one or two other things that need fixes, and I'd like to bundle them. I'd say you can expect a new Version with the fix in the next 48 hours.

[mtsfoni]

Release is out. I'd appreciate feedback if it works for you as expected.

[FredAtIvory]

confirmed working in 3.0.6