Code Analysis

NEW POST: Used and Abused ?

eschneider — Tue, 12 Aug 2008 15:27:35 GMT

Looks like MS used everyone to help develop a free product (FxCop), turned it into a commercial one (Team System feature), and abandoned the fee one...

How about the source code at least?

NEW POST: How well can FxCop address the 19 Deadly Sins (or the OWASP Top Ten)?

ParanoidMike — Wed, 23 Jul 2008 01:29:59 GMT

I posted a question about this to the FxCop MSDN Forum here:
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=3652910&SiteID=1&mode=1

Basically, I'm trying to understand whether:

FxCop's Security Rules provide coverage to detect these issues in managed code
it'd be practical to write custom rules to at least provide reasonably low-false-positive warnings of these issues, or
if FxCop (and its "analysis of MSIL using Introspection" design approach) is really not suited to the task?

Thanks for any responses or thoughts you can provide.

Cheers, Mike

NEW POST: FxCop 1.36 final?

tibel — Mon, 14 Jul 2008 17:20:22 GMT

Hi,

does somebody know when FxCop 1.36 beta 2 will become final?

Greets,
Thomas

NEW POST: Rule suggestion : FileStream constructor usage

Guillaume — Wed, 02 Jul 2008 08:44:34 GMT

new FileStream(@"c:\program files\internet explorer\iexplore.exe", FileMode.Open);

The Framework doesn't know if you need Read/Write/... so it should try to open with maximum allowance.
It works under XP/Vista 32 but under Vista 64 (sp1) it'll try to open it read/write and throw a security exception if not ran as admin.

The dev rarely wants to open a file "as possible" and the Read/Write should almost always be specified.
So a rule that avoid usage of FileStream constructor with less than 3 parameters, advising File.OpenRead... or 3 parameter constructor will be usefull.

NEW POST: Apply stylesheet not working

Guillaume — Fri, 20 Jun 2008 10:25:25 GMT

I have two computers : one desktop with Vista, the other is a windows server 2003 R2

When my FxCop project is runned on the desktop, everything is ok my stylesheet is applied.
With the server, the output file is blank! no error... If I disable apply stylesheet, Internet Explorer apply it sucessfuly.

It's a custom xsl, it works with the default one.

It might be msxsl version ? but why Internet Explorer would transform it and not FxCop ?

NEW POST: Jumping to source leaves wait cursor behind

TaylorMichaelL — Fri, 13 Jun 2008 16:48:03 GMT

When I right-click a message in the message list and select Jump to Source. It switches over to my open instance of VS2008. However when I switch back to FxCop it is still showing the wait cursor. I can click on something to get it to reset but it shouldn't remain a wait cursor.

This is 1.3.6 beta 2.

NEW POST: Option to jump straight to source

TaylorMichaelL — Fri, 13 Jun 2008 16:46:26 GMT

Right now if you double click a message in the message list it takes you to the message description. I'd like to have a configurable option to take me straight to the source instead. I know from most message rules what the problem is so I don't need to see a description as to why I should fix it.

This is 1.3.6 beta 2.

NEW POST: Fonts & Colors UI is confusing

TaylorMichaelL — Fri, 13 Jun 2008 16:45:14 GMT

The control labeling for the Colors portion of the Fonts & Colors UI is confusing. The message level combo sits next to the Colors groupbox and the actual color picker button is labeled MessageLevel. This is confusing. I think it should be made more clear that the combo is the message level and the remaining buttons (is this a really good use for a button?) should indicate what color they're changing (text, foreground, background).

This is 1.3.6 beta 2.

Project License Changed

Fri, 13 Jun 2008 00:35:48 GMT

The license terms that govern this software are contained in the license agreement presented to you during installation.

NEW POST: Rule Support in FxCop

Tigraine — Fri, 06 Jun 2008 14:30:42 GMT

Yeah, the help links don't work any more?

When will this work again?

NEW POST: Rule Support in FxCop

Prathiba — Wed, 28 May 2008 06:25:02 GMT

The rule support (Help link) was previous taking to an apt page where we can see the explanation and related details. Where do we find this now in MSDN Code Gallery.

Target : Text (IntrospectionTargetMember)
Resolution : "Make 'Text' private or internal (Friend in VB,
public private in C++) and provide a public or protected
property to access it."
Help : http://www.gotdotnet.com/team/fxcop/docs/rules.aspx?version=1.35&url=/Design/DoNotDeclareVisibleInstanceFields.html (String)
Category : Microsoft.Design (String)
CheckId : CA1051 (String)
RuleFile : Design Rules (String)
Info : "Public or protected instance fields limit your ability
to change the implementation details for those data
items. Use properties instead. They do not compromise
usability or performance and they do provide flexibility
in that they conceal the implementation details of
the underlying data."
Created : 5/28/2008 4:32:42 AM (DateTime)
LastSeen : 5/28/2008 6:04:42 AM (DateTime)
Status : Active (MessageStatus)
Fix Category : Breaking (FixCategories)

NEW POST: New Rules on VS2008 Code analysis

ramesh_venkatesan — Fri, 23 May 2008 11:41:48 GMT

Any new rules are added part of VS2008 code analysis tool.

NEW POST: FxCopReport.xsl URL Path

Lex — Mon, 12 May 2008 11:14:05 GMT

Heh fairly easy actually; one of the command line options for FXCop allows you to force the xsl path (I think it's /outXSL: - but don't quote me).

So I simply published a copy of the xsl on an internal server (http://internal.mycompany.com/publish/xsl/1.35/FxCopReport.xsl) and changed the argument to match.

NEW POST: FxCopReport.xsl URL Path

GauriV — Mon, 12 May 2008 09:53:34 GMT

Hi Lex,

What did u do for the URL? Did you get another one? We are also getting the same problem :(

NEW POST: Unhandled Exception While Analyzing FW 1.1 Obfuscated Assembly

rkw — Sat, 26 Apr 2008 08:10:53 GMT

Hi,

I am using FxCop 1.36 (9.0.20928.0) and am running the analysis on a .NET FW 1.1 assembly that has been obfuscated using Aspose.Obfuscator ( http://www.aspose.com/Products/Aspose.Obfuscator/ ) and then re-signed using the sn.exe -R option (obfuscating seems to remove the strong name from the assembly).

However I am getting this error, along with 8 analysis results, 6 of them to do with the custom 'Watermark' type and the namespace that Apose.Obfuscator inserts after obfuscation - so despite the error, the analysis still works:

Message:
An unhandled exception occurred while analyzing assemblies:

InnerException:
System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.FxCop.Engines.Introspection.AnalysisVisitor.CheckMember(Member memberToAnalyze, Member member, TargetMember target)
at Microsoft.FxCop.Engines.Introspection.AnalysisVisitor.VisitMember(Member member, TargetMember target)
at Microsoft.FxCop.Engines.Introspection.BaseVisitor.VisitAccessor(Member member, TargetMemberDictionary targets, Hashtable visitedItems)
at Microsoft.FxCop.Engines.Introspection.BaseVisitor.VisitMembers(MemberCollection members, TargetMemberDictionary targets, Boolean visitNestedTypes)
at Microsoft.FxCop.Engines.Introspection.AnalysisVisitor.VisitType(TypeNode type, TargetType target)
at Microsoft.FxCop.Engines.Introspection.AnalysisVisitor.Analyze(Queue queue)
at Microsoft.FxCop.Engines.Introspection.IntrospectionAnalysisEngine.AnalyzeThread()

Keyword:
CA0001

UPDATED RELEASE: Microsoft FxCop 1.35 (Feb 29, 2008)

Fri, 29 Feb 2008 22:06:11 GMT

*Note:* You can download FxCop 1.36 Beta from [url:Microsoft Downloads|http://www.microsoft.com/downloads/details.aspx?familyid=3389F7E4-0E55-4A4D-BC74-4AEABB17997B&displaylang=en].

!!!!! Overview
Download FxCop 1.35, a code analysis tool for .NET managed assemblies

FxCop is a code analysis tool that checks .NET managed code assemblies for conformance to the Microsoft .NET Framework Design Guidelines. It uses MSIL parsing, and callgraph analysis to inspect assemblies for more than 200 defects in the following areas:

Library design
Globalization
Naming conventions
Performance
Interoperability and portability
Security
Usage

FxCop includes both GUI and command line versions of the tool and supports analyzing .NET 1.x, .NET 2.0 and .NET 3.x components.

!!!!! System Requirements

*Supported Operating Systems*: Windows 2000; Windows XP; Windows Vista; Windows 2000 Server; Windows Server 2003
*Required Framework*: .NET Framework 2.0

CREATED RELEASE: Code Analysis and FxCop Rule Comparison (Feb 29, 2008)

Fri, 29 Feb 2008 22:05:44 GMT

In response to a lot of recent requests, we've put together a complete list of rules that shipped in the different versions of Visual Studio Code Analysis and FxCop. Attached is an Excel worksheet providing this information for Visual Studio 2005, Visual Studio 2008, FxCop 1.35 and FxCop 1.36 Beta.

One of things you'll notice as you read through the list is that we removed some rules from the later versions. There are a few reasons for this:

* *Noise and applicability*. We use feedback from customers, SQM data (to see which rules users turn off), and input from internal teams (Windows, Office, CLR, etc) to determine the rules that are noisy without adding any perceivable value. There are also rules that are either no longer applicable or can no longer fire. for example, a rule could have been firing on a limitation of the CLR which has since been fixed in later versions.
* *Merged rules*. Sometimes it makes sense to merge rules that fire on similar things, for example, the analysis in SecureGetObjectDataOverrides was already covered by OverrideLinkDemandsShouldBeIdenticalToBase, so these two rules were merged. Similarly, LongAcronymsShouldBePascalCased, ShortAcronymsShouldBeUppercase and IdentifiersShouldBeCasedCorrectly all fired on the casing of identifiers, and hence were merged in the later.
* *Analysis engine removed*. In Visual Studio 2008 and FxCop 1.36 we removed one of our analysis engines. This engine was removed for a variety of reasons; it increased analysis time (although the engine encompassed less than 5% our analysis, it took up 50% of our time-to-analyze), indeterministic results (results appearing and disappearing between runs), and bugs found within the engine (and hence the rules that depended on it) required huge architectural changes. We instead decided to invest the resources that we would have spent on fixing the old engine, on a new data flow analysis engine based on Phoenix, which we will ship in a future version of Visual Studio.

UPDATED RELEASE: Microsoft FxCop 1.35 (Feb 29, 2008)

Fri, 29 Feb 2008 17:32:23 GMT

UPDATED RELEASE: Microsoft FxCop 1.35 (Feb 29, 2008)

Fri, 29 Feb 2008 17:25:27 GMT

*Note:* You can download FxCop 1.36 Beta from [url:Microsoft Downloads|http://www.microsoft.com/downloads/details.aspx?familyid=3389F7E4-0E55-4A4D-BC74-4AEABB17997B&displaylang=en].

Download FxCop 1.35, a code analysis tool for .NET managed assemblies

FxCop is a code analysis tool that checks .NET managed code assemblies for conformance to the Microsoft .NET Framework Design Guidelines. It uses MSIL parsing, and callgraph analysis to inspect assemblies for more than 200 defects in the following areas:

Library design
Globalization
Naming conventions
Performance
Interoperability and portability
Security
Usage

FxCop includes both GUI and command line versions of the tool and supports analyzing .NET 1.x, .NET 2.0 and .NET 3.x components.

UPDATED RELEASE: Microsoft FxCop 1.35 (Feb 29, 2008)

Fri, 29 Feb 2008 17:21:22 GMT

*Note:* You can download FxCop 1.36 Beta from {url:http://www.microsoft.com/downloads/details.aspx?familyid=3389F7E4-0E55-4A4D-BC74-4AEABB17997B&displaylang=en} Microsoft Downloads.

Download FxCop 1.35, a code analysis tool for .NET managed assemblies

FxCop is a code analysis tool that checks .NET managed code assemblies for conformance to the Microsoft .NET Framework Design Guidelines. It uses MSIL parsing, and callgraph analysis to inspect assemblies for more than 200 defects in the following areas:

Library design
Globalization
Naming conventions
Performance
Interoperability and portability
Security
Usage

FxCop includes both GUI and command line versions of the tool and supports analyzing .NET 1.x, .NET 2.0 and .NET 3.x components.