Can Roslyn detect a target method in third-party library or package?

[Magicyss]

Hi. I was working on a project to monitor services' resilience gaps. We found that some methods are not recommended any more. I am new to Roslyn, so I am not sure if Roslyn can detect a target method which is wrapped by another method or class in a shared library. If it is possible to do so, how many layers can be checked? How can I use Roslyn to do that? Thanks in advance!

[333fred]

I suspect the answer is no, but can you show an example to make sure I'm understanding the question?

[Magicyss]

Hi.
We don't recommend services to use method GetXXX() in their code which may cause the dependency service throttling. So I wrote some CodeQL query to find if the service is using it. But some third party package may use this method in their own method WrappedGetXXX(). Then if service is only using WrappedGetXXX, I will fail to find it is actually calling GetXXX.
So I want to know if Roslyn can find a target method being wrapped by another package is used or not.

[CyrusNajmabadi]

Roslyn can only do this if you have access to the source of the package.

[Magicyss]

What do you mean by "the source of the package"? Do you mean that the package source code should be contained in the service?

[CyrusNajmabadi]

Roslyn can analyze source code. Or the signatures of symbols from metadata. It can't see inside methods from metadata.