MsBuild: keep warnings from bare task names like EXEC

When MSBuild's Exec task runs an external tool, it prefixes any output
lines that lack a file name with the task name in upper-case (e.g. EXEC).
isToolName() was treating these the same as executable names (.exe) and
discarding the whole warning via Optional.empty().

This caused NuGet vulnerability warnings (NU1902, NU1903, etc.) to be
silently dropped and never appear in the Jenkins Warnings plugin.

Fix: split the isToolName branch. Executable names (.exe) and pseudo-file
placeholders like <command line option> are still dropped. Bare MSBuild
task names (EXEC, NMAKE, CSC, cl, rs, ...) now produce an issue with
fileName set to '-' so the warning still shows up in the report.

Fixes #1512

Author: Dipanshusinghh

src/main/java/edu/hm/hafner/analysis/parser/MsBuildParser.java

@@ -81,16 +81,14 @@ public class MsBuildParser extends LookaheadParser {
             + PROJECT_DIR_PATTERN
             + "))$";
 
-    /**
-     * Pattern to identify bare tool names that should be ignored (without path separators).
-     * Only matches tool names when they appear alone, not as part of a path.
-     */
+    /** Tool-like tokens: bare task names, .exe files, and pseudo-file placeholders. */
     private static final Pattern TOOL_NAME_PATTERN = Pattern.compile(
             "^(?:EXEC|NMAKE|LINK|MSBUILD|CSC|MSBuild|link|nmake|msbuild|cl|rs)$|"
             + "^[^/\\\\]*\\.exe$|"
             + "^<[^>]+>$",
             Pattern.CASE_INSENSITIVE);
 
+
     /**
      * Pattern to identify compiler/linker parameters (e.g., /INCREMENTAL, /OPT:ICF, -Wall).
      * These should not be treated as filenames.
@@ -137,9 +135,14 @@ protected Optional<Issue> createIssue(final Matcher matcher, final LookaheadStre
         if (isLinkerParameter(fileName)) {
             fileName = "-";
         }
-        // Skip if this is a tool name (executable or tool without proper source extension)
         else if (isToolName(fileName)) {
-            return Optional.empty();
+            if (isBareToolName(fileName)) {
+                // EXEC/NMAKE etc. prefix real tool output - keep these as fileName "-"
+                fileName = "-";
+            }
+            else {
+                return Optional.empty();
+            }
         }
 
         // Check if this is a Delphi warning/hint where the actual file is in the message
@@ -276,6 +279,20 @@ private boolean isToolName(final String fileName) {
         return TOOL_NAME_PATTERN.matcher(baseFileName).matches();
     }
 
+    // Checks if fileName is a bare MSBuild task name like EXEC or NMAKE.
+    private boolean isBareToolName(final String fileName) {
+        if (StringUtils.isBlank(fileName) || "-".equals(fileName) || "unknown.file".equals(fileName)) {
+            return false;
+        }
+
+        var baseFileName = FilenameUtils.getName(fileName).trim();
+
+        baseFileName = baseFileName.replaceAll("^\\d{1,2}:\\d{2}:\\d{2}\\s+", "");
+
+        return !StringUtils.endsWithIgnoreCase(baseFileName, ".exe")
+                && !(baseFileName.startsWith("<") && baseFileName.endsWith(">"));
+    }
+
     /**
      * Determines the name of the file that is the cause of the warning.
      *

src/test/java/edu/hm/hafner/analysis/parser/MsBuildParserTest.java

@@ -56,18 +56,61 @@ void shouldRemoveAnsiColors() {
      */
     @Test
     void issue56613() {
-        assertThat(parse("issue56613.txt")).isEmpty();
+        var warnings = parse("issue56613.txt");
+
+        // ConsoleTranslator.exe is an executable name and is still dropped.
+        // EXEC, NMAKE and rs are bare MSBuild task names: their warnings are now surfaced
+        // with fileName "-" rather than silently discarded (see issue #1512).
+        assertThat(warnings).hasSize(4);
+        assertThatReportHasSeverities(warnings, 3, 0, 1, 0);
     }
 
     /**
-     * Extended test for issue 56613 - ensures tool names are properly ignored.
-     * Tests that executables (.exe) and tool names without extensions (NMAKE, rs, cl) are skipped.
+     * Extended test for issue 56613 - ensures tool names are properly handled.
+     * Executable names (.exe) and pseudo-file placeholders are still dropped.
+     * Bare task names (EXEC, NMAKE, CSC, MSBuild, rs) now produce issues with fileName "-".
      *
      * @see <a href="https://issues.jenkins.io/browse/JENKINS-56613">Issue 56613</a>
      */
     @Test
     void issue56613Extended() {
-        assertThat(parse("issue56613-extended.txt")).isEmpty();
+        var warnings = parse("issue56613-extended.txt");
+
+        assertThat(warnings).hasSize(6);
+        assertThatReportHasSeverities(warnings, 3, 0, 3, 0);
+    }
+
+    /**
+     * Warnings prefixed by a bare task name like EXEC should not be dropped.
+     *
+     * @see <a href="https://github.com/jenkinsci/analysis-model/issues/1512">Issue #1512</a>
+     */
+    @Test
+    void issue1512() {
+        var warnings = parse("issue1512.txt");
+
+        assertThat(warnings).hasSize(3);
+        assertThatReportHasSeverities(warnings, 0, 0, 3, 0);
+
+        try (var softly = new SoftAssertions()) {
+            softly.assertThat(warnings.get(0))
+                    .hasFileName("-")
+                    .hasCategory("NU1902")
+                    .hasSeverity(Severity.WARNING_NORMAL)
+                    .hasMessage("Package 'Microsoft.IdentityModel.JsonWebTokens' 6.11.1 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-59j7-ghrg-fj52");
+
+            softly.assertThat(warnings.get(1))
+                    .hasFileName("-")
+                    .hasCategory("NU1903")
+                    .hasSeverity(Severity.WARNING_NORMAL)
+                    .hasMessage("Package 'Microsoft.Owin' 4.2.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-3rq8-h3gj-r5c6");
+
+            softly.assertThat(warnings.get(2))
+                    .hasFileName("-")
+                    .hasCategory("NU1902")
+                    .hasSeverity(Severity.WARNING_NORMAL)
+                    .hasMessage("Package 'System.IdentityModel.Tokens.Jwt' 6.11.1 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-59j7-ghrg-fj52");
+        }
     }
 
     /**

src/test/resources/edu/hm/hafner/analysis/parser/issue1512.txt

@@ -0,0 +1,3 @@
+EXEC : warning : NU1902: Package 'Microsoft.IdentityModel.JsonWebTokens' 6.11.1 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-59j7-ghrg-fj52 [C:\jenkins\workspace\project\ci.msbuildproj]
+EXEC : warning : NU1903: Package 'Microsoft.Owin' 4.2.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-3rq8-h3gj-r5c6 [C:\jenkins\workspace\project\ci.msbuildproj]
+EXEC : warning : NU1902: Package 'System.IdentityModel.Tokens.Jwt' 6.11.1 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-59j7-ghrg-fj52 [C:\jenkins\workspace\project\ci.msbuildproj]