C#: Fix NuGet CLI fallback and registry URI matching

Filter private candidates and defaults before choosing the fallback, and compare registry URI identities while preserving path case. Add regressions for missing or unreachable folder feeds and equivalent registry URLs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: michaelnebel

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FeedManager.cs

@@ -252,8 +252,15 @@ public List<string> MakeRestoreFeeds(string path)
         /// </summary>
         public List<string> MakeNugetExeRestoreFeeds(string path)
         {
-            var feedsToUse = FeedsToUse(path).ToList();
-            var defaultFeeds = CheckNugetFeedResponsiveness ? ReachableDefaultFeeds : DefaultFeeds;
+            bool IsPrivateFeed(string feed) =>
+                privateRegistryFeeds.Contains(feed) ||
+                (Uri.TryCreate(feed, UriKind.Absolute, out var uri) &&
+                    privateRegistryFeeds.Any(registry =>
+                        Uri.TryCreate(registry, UriKind.Absolute, out var registryUri) && uri.Equals(registryUri)));
+
+            var feedsToUse = FeedsToUse(path).Where(feed => !IsPrivateFeed(feed)).ToList();
+            var defaultFeeds = (CheckNugetFeedResponsiveness ? ReachableDefaultFeeds : DefaultFeeds)
+                .Where(feed => !IsPrivateFeed(feed)).ToList();
             var useDefaultFeeds = feedsToUse.Count == 0 && defaultFeeds.Count > 0;
 
             if (!CheckNugetFeedResponsiveness && !HasPrivateRegistryFeeds && !useDefaultFeeds)
@@ -266,8 +273,7 @@ public List<string> MakeNugetExeRestoreFeeds(string path)
                 feedsToUse.AddRange(defaultFeeds);
             }
 
-            // Filter after selecting defaults so private base feeds cannot be reintroduced.
-            return RestoreFeeds(feedsToUse.Where(feed => !privateRegistryFeeds.Contains(feed)));
+            return RestoreFeeds(feedsToUse);
         }
 
         private (int initialTimeout, int tryCount) GetFeedRequestSettings(bool isFallback)

csharp/extractor/Semmle.Extraction.Tests/FeedManager.cs

@@ -293,7 +293,7 @@ public void TestNugetExeRestoreFeedsExcludePrivateBaseRegistries()
         }
 
         /// <summary>
-        /// Verify that NuGet CLI restore uses an empty local source when only private registries are configured,
+        /// Verify that NuGet CLI restore uses an empty local source when private registries replace the default feeds,
         /// regardless of their reachability.
         /// </summary>
         [Theory]
@@ -355,6 +355,53 @@ public void TestNugetExeRestoreFeedsUseDefaults()
             Assert.Equal(["https://api.nuget.org/v3/index.json"], feeds);
         }
 
+        /// <summary>
+        /// Verify that non-base private registries do not prevent NuGet CLI restore from falling back to NuGet.org
+        /// when no usable folder feeds remain.
+        /// </summary>
+        [Theory]
+        [InlineData(false)]
+        [InlineData(true)]
+        public void TestNugetExeRestoreFeedsUseDefaultsWithPrivateRegistries(bool unreachableFolderFeed)
+        {
+            // Setup
+            var logger = new LoggerStub();
+            var dotnet = new DotNetStub([], [], [],
+                unreachableFolderFeed ? ["E https://feed.from/folder1"] : []);
+            using var feedManager = new FeedManager(logger, dotnet, new RegistryProxyStub(),
+                new FileProviderStub(), new FeedManagerIOStub(["https://feed.from/folder1"]));
+
+            // Execute
+            var feeds = feedManager.MakeNugetExeRestoreFeeds("/path/to/packages.config");
+
+            // Verify
+            Assert.Equal(["https://api.nuget.org/v3/index.json"], feeds);
+        }
+
+        /// <summary>
+        /// Verify that NuGet CLI restore identifies equivalent private registry URLs regardless of host case
+        /// or explicit default ports, while preserving case-sensitive registry paths.
+        /// </summary>
+        [Theory]
+        [InlineData("https://EXAMPLE.COM/registry2", true)]
+        [InlineData("https://example.com:443/registry2", true)]
+        [InlineData("https://EXAMPLE.COM:443/registry2", true)]
+        [InlineData("https://example.com/Registry2", false)]
+        public void TestNugetExeRestoreFeedsCompareRegistryUris(string folderFeed, bool isPrivate)
+        {
+            // Setup
+            var logger = new LoggerStub();
+            var dotnet = new DotNetStub([], [], [], [$"E {folderFeed}"]);
+            using var feedManager = new FeedManager(logger, dotnet, new RegistryProxyStub(),
+                new FileProviderStub(), new FeedManagerIOStub([]));
+
+            // Execute
+            var feeds = feedManager.MakeNugetExeRestoreFeeds("/path/to/packages.config");
+
+            // Verify
+            Assert.Equal([isPrivate ? "https://api.nuget.org/v3/index.json" : folderFeed], feeds);
+        }
+
         /// <summary>
         /// Verify that `FeedManager` correctly computes the default feeds and reachable default feeds
         /// when no private registries are configured.