add paranoid warnings mode (#590)

8 files changed, 75 insertions, 15 deletions

diff --git a/docs/release-notes.md b/docs/release-notes.md
index 0ff90aa3..5d0d8a4e 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -21,6 +21,7 @@
   * **Breaking change:** most SMAPI files have been moved into a `smapi-internal` subfolder. This won't affect compiled mods, but you'll need to update the mod build config NuGet package when compiling mods.
 
 * For SMAPI developers:
+  * Added a 'paranoid warnings' option which reports mods using potentially sensitive .NET APIs (like file or shell access) in the mod issues list.
   * Adjusted `SaveBackup` mod to make it easier to account for custom mod subfolders in the installer.
   * Installer no longer special-cases Omegasis' older `SaveBackup` mod (now named `AdvancedSaveBackup`).
 
diff --git a/src/SMAPI/Framework/ModLoading/AssemblyLoader.cs b/src/SMAPI/Framework/ModLoading/AssemblyLoader.cs
index e750c659..fdbfdd8d 100644
--- a/src/SMAPI/Framework/ModLoading/AssemblyLoader.cs
+++ b/src/SMAPI/Framework/ModLoading/AssemblyLoader.cs
@@ -350,6 +350,16 @@ namespace StardewModdingAPI.Framework.ModLoading
                     mod.SetWarning(ModWarning.UsesDynamic);
                     break;
 
+                case InstructionHandleResult.DetectedFilesystemAccess:
+                    this.Monitor.LogOnce(loggedMessages, $"{logPrefix}Detected filesystem access ({handler.NounPhrase}) in assembly {filename}.");
+                    mod.SetWarning(ModWarning.AccessesFilesystem);
+                    break;
+
+                case InstructionHandleResult.DetectedShellAccess:
+                    this.Monitor.LogOnce(loggedMessages, $"{logPrefix}Detected shell or process access ({handler.NounPhrase}) in assembly {filename}.");
+                    mod.SetWarning(ModWarning.AccessesShell);
+                    break;
+
                 case InstructionHandleResult.None:
                     break;
 
diff --git a/src/SMAPI/Framework/ModLoading/InstructionHandleResult.cs b/src/SMAPI/Framework/ModLoading/InstructionHandleResult.cs
index cfa23d08..f3555c2d 100644
--- a/src/SMAPI/Framework/ModLoading/InstructionHandleResult.cs
+++ b/src/SMAPI/Framework/ModLoading/InstructionHandleResult.cs
@@ -24,6 +24,12 @@ namespace StardewModdingAPI.Framework.ModLoading
         DetectedDynamic,
 
         /// <summary>The instruction is compatible, but references <see cref="SpecialisedEvents.UnvalidatedUpdateTick"/> which may impact stability.</summary>
-        DetectedUnvalidatedUpdateTick
+        DetectedUnvalidatedUpdateTick,
+
+        /// <summary>The instruction accesses the filesystem directly.</summary>
+        DetectedFilesystemAccess,
+
+        /// <summary>The instruction accesses the OS shell or processes directly.</summary>
+        DetectedShellAccess
     }
 }
diff --git a/src/SMAPI/Framework/ModLoading/ModWarning.cs b/src/SMAPI/Framework/ModLoading/ModWarning.cs
index 0e4b2570..c62199b2 100644
--- a/src/SMAPI/Framework/ModLoading/ModWarning.cs
+++ b/src/SMAPI/Framework/ModLoading/ModWarning.cs
@@ -26,6 +26,12 @@ namespace StardewModdingAPI.Framework.ModLoading
         UsesUnvalidatedUpdateTick = 16,
 
         /// <summary>The mod has no update keys set.</summary>
-        NoUpdateKeys = 32
+        NoUpdateKeys = 32,
+
+        /// <summary>Uses .NET APIs for filesystem access.</summary>
+        AccessesFilesystem = 64,
+
+        /// <summary>Uses .NET APIs for shell or process access.</summary>
+        AccessesShell = 128
     }
 }
diff --git a/src/SMAPI/Framework/Models/SConfig.cs b/src/SMAPI/Framework/Models/SConfig.cs
index 15671af4..bdfaa670 100644
--- a/src/SMAPI/Framework/Models/SConfig.cs
+++ b/src/SMAPI/Framework/Models/SConfig.cs
@@ -14,6 +14,9 @@ namespace StardewModdingAPI.Framework.Models
         /// <summary>Whether to check for newer versions of SMAPI and mods on startup.</summary>
         public bool CheckForUpdates { get; set; }
 
+        /// <summary>Whether to add a section to the 'mod issues' list for mods which which directly use potentially sensitive .NET APIs like file or shell access.</summary>
+        public bool ParanoidWarnings { get; set; }
+
         /// <summary>Whether to show beta versions as valid updates.</summary>
         public bool UseBetaChannel { get; set; } = Constants.ApiVersion.IsPrerelease();
 
diff --git a/src/SMAPI/Framework/SCore.cs b/src/SMAPI/Framework/SCore.cs
index 3e93760b..af8df8a0 100644
--- a/src/SMAPI/Framework/SCore.cs
+++ b/src/SMAPI/Framework/SCore.cs
@@ -1026,6 +1026,17 @@ namespace StardewModdingAPI.Framework
                     "These mods change the save serialiser. They may corrupt your save files, or make them unusable if",
                     "you uninstall these mods."
                 );
+                if (this.Settings.ParanoidWarnings)
+                {
+                    LogWarningGroup(ModWarning.AccessesFilesystem, LogLevel.Warn, "Accesses filesystem directly",
+                        "These mods directly access the filesystem, and you enabled paranoid warnings. (Note that this may be",
+                        "legitimate and innocent usage; this warning is meaningless without further investigation.)"
+                    );
+                    LogWarningGroup(ModWarning.AccessesShell, LogLevel.Warn, "Accesses shell/process directly",
+                        "These mods directly access the OS shell or processes, and you enabled paranoid warnings. (Note that",
+                        "this may be legitimate and innocent usage; this warning is meaningless without further investigation.)"
+                    );
+                }
                 LogWarningGroup(ModWarning.PatchesGame, LogLevel.Info, "Patched game code",
                     "These mods directly change the game code. They're more likely to cause errors or bugs in-game; if",
                     "your game has issues, try removing these first. Otherwise you can ignore this warning."
diff --git a/src/SMAPI/Metadata/InstructionMetadata.cs b/src/SMAPI/Metadata/InstructionMetadata.cs
index 2f0c1b15..5a47fb1a 100644
--- a/src/SMAPI/Metadata/InstructionMetadata.cs
+++ b/src/SMAPI/Metadata/InstructionMetadata.cs
@@ -47,7 +47,7 @@ namespace StardewModdingAPI.Metadata
                 new StaticFieldToConstantRewriter<int>(typeof(Game1), "tileSize", Game1.tileSize),
 
                 /****
-                ** detect incompatible code
+                ** detect mod issues
                 ****/
                 // detect broken code
                 new ReferenceToMissingMemberFinder(this.ValidateReferencesToAssemblies),
@@ -61,7 +61,22 @@ namespace StardewModdingAPI.Metadata
                 new FieldFinder(typeof(SaveGame).FullName, nameof(SaveGame.serializer), InstructionHandleResult.DetectedSaveSerialiser),
                 new FieldFinder(typeof(SaveGame).FullName, nameof(SaveGame.farmerSerializer), InstructionHandleResult.DetectedSaveSerialiser),
                 new FieldFinder(typeof(SaveGame).FullName, nameof(SaveGame.locationSerializer), InstructionHandleResult.DetectedSaveSerialiser),
-                new EventFinder(typeof(SpecialisedEvents).FullName, nameof(SpecialisedEvents.UnvalidatedUpdateTick), InstructionHandleResult.DetectedUnvalidatedUpdateTick)
+                new EventFinder(typeof(SpecialisedEvents).FullName, nameof(SpecialisedEvents.UnvalidatedUpdateTick), InstructionHandleResult.DetectedUnvalidatedUpdateTick),
+                
+                /****
+                ** detect paranoid issues
+                ****/
+                // filesystem access
+                new TypeFinder(typeof(System.IO.File).FullName, InstructionHandleResult.DetectedFilesystemAccess),
+                new TypeFinder(typeof(System.IO.FileStream).FullName, InstructionHandleResult.DetectedFilesystemAccess),
+                new TypeFinder(typeof(System.IO.FileInfo).FullName, InstructionHandleResult.DetectedFilesystemAccess),
+                new TypeFinder(typeof(System.IO.Directory).FullName, InstructionHandleResult.DetectedFilesystemAccess),
+                new TypeFinder(typeof(System.IO.DirectoryInfo).FullName, InstructionHandleResult.DetectedFilesystemAccess),
+                new TypeFinder(typeof(System.IO.DriveInfo).FullName, InstructionHandleResult.DetectedFilesystemAccess),
+                new TypeFinder(typeof(System.IO.FileSystemWatcher).FullName, InstructionHandleResult.DetectedFilesystemAccess),
+
+                // shell access
+                new TypeFinder(typeof(System.Diagnostics.Process).FullName, InstructionHandleResult.DetectedShellAccess)
             };
         }
     }
diff --git a/src/SMAPI/StardewModdingAPI.config.json b/src/SMAPI/StardewModdingAPI.config.json
index 115997ba..d81292c8 100644
--- a/src/SMAPI/StardewModdingAPI.config.json
+++ b/src/SMAPI/StardewModdingAPI.config.json
@@ -9,10 +9,12 @@ This file contains advanced configuration for SMAPI. You generally shouldn't cha
 */
 {
   /**
-   * Whether to enable features intended for mod developers. Currently this only makes TRACE-level
-   * messages appear in the console.
+   * The console color theme to use. The possible values are:
+   *  - AutoDetect: SMAPI will assume a light background on Mac, and detect the background color automatically on Linux or Windows.
+   *  - LightBackground: use darker text colors that look better on a white or light background.
+   *  - DarkBackground: use lighter text colors that look better on a black or dark background.
    */
-  "DeveloperMode": true,
+  "ColorScheme": "AutoDetect",
 
   /**
    * Whether SMAPI should check for newer versions of SMAPI and mods when you load the game. If new
@@ -22,6 +24,20 @@ This file contains advanced configuration for SMAPI. You generally shouldn't cha
   "CheckForUpdates": true,
 
   /**
+   * Whether to enable features intended for mod developers. Currently this only makes TRACE-level
+   * messages appear in the console.
+   */
+  "DeveloperMode": true,
+
+  /**
+   * Whether to add a section to the 'mod issues' list for mods which directly use potentially
+   * sensitive .NET APIs like file or shell access. Note that many mods do this legitimately as
+   * part of their normal functionality, so these warnings are meaningless without further
+   * investigation.
+   */
+  "ParanoidWarnings": false,
+
+  /**
    * Whether SMAPI should show newer beta versions as an available update. If not specified, SMAPI
    * will only show beta updates if the current version is beta.
    */
@@ -51,14 +67,6 @@ This file contains advanced configuration for SMAPI. You generally shouldn't cha
   "DumpMetadata": false,
 
   /**
-   * The console color theme to use. The possible values are:
-   *  - AutoDetect: SMAPI will assume a light background on Mac, and detect the background color automatically on Linux or Windows.
-   *  - LightBackground: use darker text colors that look better on a white or light background.
-   *  - DarkBackground: use lighter text colors that look better on a black or dark background.
-   */
-  "ColorScheme": "AutoDetect",
-
-  /**
    * The mod IDs SMAPI should ignore when performing update checks or validating update keys.
    */
   "SuppressUpdateChecks": [