Enhance HasUnresolvedVariables method to support double underscore and hash-delimited tokens in image references

Author: jpinz

src/Microsoft.ComponentDetection.Common/DockerReference/DockerReferenceUtility.cs

@@ -28,6 +28,7 @@ namespace Microsoft.ComponentDetection.Common;
 
 using System;
 using System.Diagnostics.CodeAnalysis;
+using System.Text.RegularExpressions;
 using Microsoft.ComponentDetection.Contracts;
 using Microsoft.Extensions.Logging;
 
@@ -39,14 +40,29 @@ public static class DockerReferenceUtility
     private const string LEGACYDEFAULTDOMAIN = "index.docker.io";
     private const string OFFICIALREPOSITORYNAME = "library";
 
+    // Characters that only appear in an image reference as part of an unresolved templating
+    // token. '$', '{' and '}' cover shell / Helm / Go-template placeholders (e.g. ${VAR},
+    // {{ .Values.tag }}); '#' covers Azure DevOps and other token-replacement placeholders
+    // (e.g. #imageTag#) and is never valid in a resolved docker reference.
+    private static readonly char[] TemplateDelimiters = ['$', '{', '}', '#'];
+
+    // Matches token-replacement placeholders that wrap an identifier in double underscores,
+    // e.g. __IMAGE_TAG__ or __MCR_ENDPOINT__. Without this they parse as an uppercase repository
+    // name and surface as a noisy parse failure instead of being skipped as a templated value.
+    private static readonly Regex DoubleUnderscoreTokenRegex = new(@"__\w+__");
+
     /// <summary>
-    /// Returns true if the reference contains unresolved variable placeholders (e.g., ${VAR}, {{ .Values.tag }}).
-    /// Such references should be skipped before calling <see cref="ParseFamiliarName"/> or <see cref="ParseQualifiedName"/>.
+    /// Returns true if the reference contains unresolved variable or templating placeholders,
+    /// e.g. <c>${VAR}</c>, <c>{{ .Values.tag }}</c>, <c>#imageTag#</c>, or <c>__IMAGE_TAG__</c>.
+    /// Such references are not real, resolvable images, so they should be skipped before calling
+    /// <see cref="ParseFamiliarName"/> or <see cref="ParseQualifiedName"/> and treated as
+    /// unresolved values rather than reported as parse failures.
     /// </summary>
     /// <param name="reference">The image reference string to check.</param>
     /// <returns><c>true</c> if the reference contains variable placeholder characters; otherwise <c>false</c>.</returns>
     public static bool HasUnresolvedVariables(string reference) =>
-        reference.IndexOfAny(['$', '{', '}']) >= 0;
+        reference.IndexOfAny(TemplateDelimiters) >= 0 ||
+        DoubleUnderscoreTokenRegex.IsMatch(reference);
 
     /// <summary>
     /// Attempts to parse an image reference string into a <see cref="DockerReference"/>.

test/Microsoft.ComponentDetection.Common.Tests/DockerReferenceUtilityTests.cs

@@ -284,18 +284,66 @@ public void HasUnresolvedVariables_ReturnsTrueForBraces()
         DockerReferenceUtility.HasUnresolvedVariables("{{ .Values.image }}").Should().BeTrue();
     }
 
+    [TestMethod]
+    public void HasUnresolvedVariables_ReturnsTrueForDoubleUnderscoreTokens()
+    {
+        DockerReferenceUtility.HasUnresolvedVariables("__MCR_ENDPOINT__/aks/devinfra/helm3sample:__IMAGE_TAG__").Should().BeTrue();
+    }
+
+    [TestMethod]
+    public void HasUnresolvedVariables_ReturnsTrueForHashDelimitedTokens()
+    {
+        DockerReferenceUtility.HasUnresolvedVariables("#cs_containerRegistryLoginServerUrl#/coreservicesaksservice_#cs_aks_workloadName#_#cs_aks_serviceTrackIdentifier#/#serviceName#:#imageTag#").Should().BeTrue();
+    }
+
     [TestMethod]
     public void HasUnresolvedVariables_ReturnsFalseForPlainReference()
     {
         DockerReferenceUtility.HasUnresolvedVariables("docker.io/library/nginx:latest").Should().BeFalse();
     }
 
+    [TestMethod]
+    public void HasUnresolvedVariables_ReturnsFalseForReferenceWithUnderscores()
+    {
+        DockerReferenceUtility.HasUnresolvedVariables("mcr.microsoft.com/some_repo/my_image:1.0").Should().BeFalse();
+    }
+
     [TestMethod]
     public void TryParseImageReference_ReturnsNullForUnresolvedVariables()
     {
         DockerReferenceUtility.TryParseImageReference("${IMAGE}:latest").Should().BeNull();
     }
 
+    [TestMethod]
+    public void TryParseImageReference_ReturnsNullForDoubleUnderscoreTokens()
+    {
+        DockerReferenceUtility.TryParseImageReference("__MCR_ENDPOINT__/aks/devinfra/helm3sample:__IMAGE_TAG__").Should().BeNull();
+    }
+
+    [TestMethod]
+    public void TryParseImageReference_ReturnsNullForHashDelimitedTokens()
+    {
+        DockerReferenceUtility.TryParseImageReference("#cs_containerRegistryLoginServerUrl#/svc/#serviceName#:#imageTag#").Should().BeNull();
+    }
+
+    [TestMethod]
+    public void TryParseImageReference_DoesNotLogWarningForTemplatedReference()
+    {
+        var logger = new Mock<ILogger>();
+
+        var result = DockerReferenceUtility.TryParseImageReference("__MCR_ENDPOINT__/aks/devinfra/helm3sample:__IMAGE_TAG__", logger.Object);
+
+        result.Should().BeNull();
+        logger.Verify(
+            l => l.Log(
+                It.IsAny<LogLevel>(),
+                It.IsAny<EventId>(),
+                It.IsAny<It.IsAnyType>(),
+                It.IsAny<Exception>(),
+                It.IsAny<Func<It.IsAnyType, Exception, string>>()),
+            Times.Never);
+    }
+
     [TestMethod]
     public void TryParseImageReference_ReturnsNullForInvalidReference()
     {