Research: contrastive positive/negative C# ownership challenge corpus (micro_service_seclab-inspired) #442

Classification

• Type: bounded research / independently labeled analyzer challenge-corpus pilot
• Priority: P2 / backlog; no production implementation or CI gate by default
• Area: C# source → Roslyn extraction → OwnIR / call summaries → ownership diagnostics
• External inspiration: l4yn3/micro_service_seclab, particularly its SSRF examples, SQL injection positive/negative controls, and CodeQL taint-flow investigation
• Related, not superseded: Research: semantic mutation testing harness for Own.NET analyzer coverage (bounded pilot) #405 (semantic mutation operators and harness), Research: semantic subgroup analysis for Own.NET diagnostic quality (bounded pilot) #427 (subgroup quality evaluation), Research: refactoring-aware metamorphic regression testing for ownership analysis (RefactoringMiner prior art) #432 (semantics-preserving refactoring/metamorphic testing), Research: OpenTaint-style contract tests and engine-gap triage for method-effect models #425 (external method-effect model contracts), Canonical first-party call facts: preserve interprocedural calls instead of collapsing them into frontend release/use/escape guesses #382 (canonical call facts), ConsumesParam flattens guarded release into unconditional handoff, causing false OWN009 and false must summaries #380 (guarded disposal)

Motivation

The Java project is not an analyzer and is not a benchmark for Own.NET ownership semantics. Its useful pattern is to encode the same security-relevant dataflow through several library/API and language shapes and pair vulnerable examples with deceptively similar safe ones. Its documentation discusses a CodeQL SSRF miss along URL → String.valueOf(URL) → Request.Get(...), then shows how a missing flow step changes the result. This is historical teaching material, not evidence that current CodeQL still misses the case.

Translate the testing method, not the Java vulnerabilities: for one already-supported Own.NET lifetime/ownership rule, can a manually reviewed, contrastive collection of C# paths expose frontend, alias/summary, control-flow, or reporting blind spots that ordinary happy-path tests miss? Crucially, a case where a checker emits some warning is not a pass unless the right warning is attached to the right resource/path.

Distinct scope / avoid duplicated work

• Research: semantic mutation testing harness for Own.NET analyzer coverage (bounded pilot) #405 owns generation and validation of defect-inducing mutants. This issue owns hand-curated cross-shape equivalent positives and confusable safe negatives, requiring no mutation engine. Reuse Research: semantic mutation testing harness for Own.NET analyzer coverage (bounded pilot) #405's runner/results format if available.
• Research: semantic subgroup analysis for Own.NET diagnostic quality (bounded pilot) #427 owns aggregate subgroup metrics. This pilot produces source-backed case oracles and a small case-by-case matrix, not another analytics framework.
• Research: refactoring-aware metamorphic regression testing for ownership analysis (RefactoringMiner prior art) #432 owns behavior-preserving refactorings and correspondence across revisions. Here multiple different source implementations may have the same expected ownership outcome without claiming full program equivalence.
• Research: OpenTaint-style contract tests and engine-gap triage for method-effect models #425 owns contract qualification for opaque/external method models. Do not invent trusted method summaries just to turn a challenge case green.

Bounded pilot

Inventory first. Identify one (maximum two) currently supported, high-value ownership diagnostic families and existing tests/issues. Prefer an established use-after-dispose or missed-Dispose obligation where independently adjudicated oracle cases already exist. If the intended variant needs unsupported semantics or a missing call fact, mark it as such rather than interpreting no warning as a soundness defect.

Create at most 8–12 small compiling C# cases in the existing fixture format, intentionally varying how the same resource/use/release relationship is expressed. Candidate dimensions, only where supported and relevant:

1. Direct vs alias: dispose one reference, then use the same object through another alias; safe lookalike disposes an unrelated object.
2. Direct vs call boundary: a known consuming callee versus a demonstrably non-consuming callee, including a receiver/argument distinction; classify missing/unknown summaries separately.
3. Straight line vs guarded cleanup: using / try/finally / if (disposing) / early return where ownership obligations genuinely differ; do not assume exception paths are equivalent.
4. Declaration reshaping (optional): partial-class teardown or harmless file/method split that still preserves the relevant obligation; reuse existing fixtures rather than cloning Research: refactoring-aware metamorphic regression testing for ownership analysis (RefactoringMiner prior art) #432.

For each family represented, include independently reviewed positive and close negative cases. Examples must not quietly change resource identity, transfer contract, dynamic dispatch, control-flow feasibility, exception behavior, or diagnostic applicability. Java/SQL/SSRF semantics are only inspiration and must not be presented as Own.NET rules.

Required case metadata and adjudication

Before running the analyzer, record in a compact per-case manifest:

• stable case ID, source revision, diagnostic family, positive/negative expectation, and why;
• relevant resource identity, ownership/acquire/transfer/release/use events, expected family and location/range;
• semantic shape tags and any known precondition/support boundary;
• build/extraction result, analyzed revision/mode, actual diagnostic family/location, and first suspected divergence if mismatched.

Outcomes must distinguish expected finding, missed expected finding, unexpected warning on reviewed safe case, unsupported/unknown semantics, invalid oracle or compile failure, and infrastructure failure/timeout. Do not score the last three as TP/FN/TN/FP. A different unrelated warning, generic nonzero exit, or a compiler failure is not a detected ownership bug. Don't silently treat an absence of diagnostics as a proof of safety.

Deliverables / acceptance criteria

• Audit existing fixtures and Research: semantic mutation testing harness for Own.NET analyzer coverage (bounded pilot) #405/Research: semantic subgroup analysis for Own.NET diagnostic quality (bounded pilot) #427/Research: refactoring-aware metamorphic regression testing for ownership analysis (RefactoringMiner prior art) #432 for overlap; document the exact incremental gap before writing new cases.
• At most 8–12 reviewed, compiling C# challenge cases with at least two positive/negative near-neighbor pairs, pinned source-level oracles, and stable IDs.
• Run through existing tooling with pinned Own.NET revision/toolchain and a reproducible local command; no new generalized harness or engine changes.
• Compact per-case results showing expected vs observed family/site/resource, with unsupported/invalid/infra separated, and one manually inspected first-divergence trace where possible.
• Link any independently reproduced, previously untracked miss/false positive to a separate narrowly scoped issue; do not “fix” the checker by weakening soundness or broadening trusted facts.
• Finish with an explicit GO / STOP on whether curated contrastive cases add meaningful regression signal beyond the existing corpus, at acceptable maintenance cost.

Stop gate / non-goals

STOP if the proposed cases duplicate #405/#427/#432, independent oracle review is not defensible, applicable rules do not support the scenarios, or the maintenance cost exceeds the incremental coverage. A synthetic fixture cannot establish prevalence in real C# projects or overall analyzer soundness.

Out of scope: porting the Java lab or security rules; adding general SQLi/SSRF/RCE analysis to Own.NET; migrating to a new test framework; a giant benchmark import; automatic issue spam; new production diagnostics/summary semantics by default.