Add C# reflection detection rules

[Copilot]

Summary

Fixed rule validation errors in reflection.json by capitalizing all enum values to match schema requirements.

Changes Made

• Changed severity: "moderate" → "Moderate"
• Changed type: "regex" → "Regex", "regexword" → "RegexWord"
• Changed scopes: "code" → "Code"
• Changed confidence: "medium" → "Medium", "high" → "High"

Error Fixed

Rule validation was failing because enum values must be capitalized according to the rule-schema-v1.json:

• Severity: "Critical", "Important", "Moderate", "BestPractice", "ManualReview", "Unspecified"
• Type: "Regex", "RegexWord", "String", "Substring"
• Scopes: "Code", "Comment", "All", "Html"
• Confidence: "High", "Medium", "Low", "Unspecified"

All 8 reflection rules now use proper capitalized enum values and should pass schema validation.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Reflection Detection</issue_title>
<issue_description>I'm not sure how exactly this applies to other languages but this is a particular issue in C#.

Using Reflection can allow for dynamic behavior at runtime, including dynamic access to APIs which are not discernable at static analysis time. Application Inspector should report when an app using reflection in a way that would allow such behavior.

If you want a project to test reflection rules against see OAT.

Proposal:

I don't think we want to overgrab here, so there are some things that seem okay.

Check the Version Number by reflecting the assembly information from a type.
Read an embedded file

And things that are less common that might be interesting:

Create an object using invoke/constructorinfo
Loading assemblies at runtime
Invoke a method (for example using invoke method)
etc.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Reflection Detection #288

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[gfs]

@copilot can you please improve these new rules with must-match and must-not-match self tests in the json definitions?

[Copilot]

@copilot can you please improve these new rules with must-match and must-not-match self tests in the json definitions?

Added comprehensive must-match and must-not-match self-tests to all 8 reflection rules. Each rule now includes 3-4 positive test cases (code that should match) and 3-4 negative test cases (similar code that should not match). Commit: 31511d7

[gfs]

@copilot These changes dont even compile. D:\a\_work\1\s\AppInspector.Tests\RuleProcessor\ReflectionTests.cs(11,22): error CS0118: 'Languages' is a namespace but is used like a type [D:\a\_work\1\s\AppInspector.Tests\AppInspector.Tests.csproj::TargetFramework=net10.0] please be more careful and ensure any changes build and that tests run and pass.

[Copilot]

@copilot These changes dont even compile. `D:\a_work\1\s\AppInspector.Tests\RuleProcessor\ReflectionTests.cs(11,22): error CS0118: 'Languages' is a namespace but is used like a type [D:\a_work\1\s\A...

Fixed the compilation error. The issue was a namespace conflict with Languages and a missing using statement for FileEntry. Both are now corrected to match the pattern used in other test files. Commit: 0677b44

[gfs]

@copilot the rule validation tests in particular do not pass. please fix rule validation errors.

[Copilot]

@copilot the rule validation tests in particular do not pass. please fix rule validation errors.

Fixed rule validation errors. All enum values in reflection.json are now properly capitalized per schema requirements (Moderate, Regex/RegexWord, Code, High/Medium). Commit: 12ff371