From 0fe80a0ba2c0154329993558b086954bb72f25c2 Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Fri, 27 Mar 2026 13:13:43 +0100 Subject: [PATCH 01/11] Warn for missing shebang --- documentation/general/dotnet-run-file.md | 5 + .../Run/CSharpCompilerCommand.Generated.cs | 1 + .../CSharpMissingShebangInFileBasedProgram.cs | 57 ++++++++++ .../AnalyzerReleases.Unshipped.md | 6 + .../MicrosoftNetCoreAnalyzersResources.resx | 9 ++ .../MissingShebangInFileBasedProgram.cs | 31 +++++ .../MicrosoftNetCoreAnalyzersResources.cs.xlf | 15 +++ .../MicrosoftNetCoreAnalyzersResources.de.xlf | 15 +++ .../MicrosoftNetCoreAnalyzersResources.es.xlf | 15 +++ .../MicrosoftNetCoreAnalyzersResources.fr.xlf | 15 +++ .../MicrosoftNetCoreAnalyzersResources.it.xlf | 15 +++ .../MicrosoftNetCoreAnalyzersResources.ja.xlf | 15 +++ .../MicrosoftNetCoreAnalyzersResources.ko.xlf | 15 +++ .../MicrosoftNetCoreAnalyzersResources.pl.xlf | 15 +++ ...crosoftNetCoreAnalyzersResources.pt-BR.xlf | 15 +++ .../MicrosoftNetCoreAnalyzersResources.ru.xlf | 15 +++ .../MicrosoftNetCoreAnalyzersResources.tr.xlf | 15 +++ ...osoftNetCoreAnalyzersResources.zh-Hans.xlf | 15 +++ ...osoftNetCoreAnalyzersResources.zh-Hant.xlf | 15 +++ .../DiagnosticCategoryAndIdRanges.txt | 2 +- .../MissingShebangInFileBasedProgramTests.cs | 107 ++++++++++++++++++ .../VirtualProjectBuilder.cs | 1 + .../Microsoft.NET.Sdk.Analyzers.targets | 1 + .../CommandTests/Run/RunFileTests.cs | 80 ++++++++++++- 24 files changed, 493 insertions(+), 2 deletions(-) create mode 100644 src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs create mode 100644 src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs create mode 100644 src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs diff --git a/documentation/general/dotnet-run-file.md b/documentation/general/dotnet-run-file.md index bdaf0176fdaa..2858846a3da2 100644 --- a/documentation/general/dotnet-run-file.md +++ b/documentation/general/dotnet-run-file.md @@ -270,6 +270,11 @@ Along with `#:`, the language also ignores `#!` which could be then used for [sh Console.WriteLine("Hello"); ``` +When a file-based program uses [`#:include`](#multiple-files) directives to include additional files, +the entry point file should start with `#!` to clearly distinguish it from included files. +This helps IDEs to properly handle multi-file scenarios and discover entry points. +The analyzer **CA2266** reports a warning if the entry point file is missing the shebang line in this scenario. + ## Implementation The build is performed using MSBuild APIs on in-memory project files. diff --git a/src/Cli/dotnet/Commands/Run/CSharpCompilerCommand.Generated.cs b/src/Cli/dotnet/Commands/Run/CSharpCompilerCommand.Generated.cs index 147f81e8bfee..26691640b7db 100644 --- a/src/Cli/dotnet/Commands/Run/CSharpCompilerCommand.Generated.cs +++ b/src/Cli/dotnet/Commands/Run/CSharpCompilerCommand.Generated.cs @@ -170,6 +170,7 @@ private string GetGeneratedMSBuildEditorConfigContent() build_property.ProjectDir = {BaseDirectoryWithTrailingSeparator} build_property.EnableComHosting = build_property.EnableGeneratedComInterfaceComImportInterop = false +build_property.EntryPointFilePath = {EntryPointFileFullPath} build_property.EffectiveAnalysisLevelStyle = {TargetFrameworkVersion} build_property.EnableCodeStyleSeverity = diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs new file mode 100644 index 000000000000..7e80ac955554 --- /dev/null +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs @@ -0,0 +1,57 @@ +// Copyright (c) Microsoft. All Rights Reserved. Licensed under the MIT license. See License.txt in the project root for license information. + +using System; +using System.Linq; +using Analyzer.Utilities.Extensions; +using Microsoft.CodeAnalysis; +using Microsoft.CodeAnalysis.CSharp; +using Microsoft.CodeAnalysis.Diagnostics; +using Microsoft.NetCore.Analyzers.Runtime; + +namespace Microsoft.NetCore.CSharp.Analyzers.Runtime +{ + /// CA2026: + [DiagnosticAnalyzer(LanguageNames.CSharp)] + public sealed class CSharpMissingShebangInFileBasedProgram : MissingShebangInFileBasedProgram + { + public override void Initialize(AnalysisContext context) + { + context.EnableConcurrentExecution(); + context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None); + + context.RegisterCompilationStartAction(context => + { + var globalOptions = context.Options.AnalyzerConfigOptionsProvider.GlobalOptions; + if (!globalOptions.TryGetValue("build_property.EntryPointFilePath", out var entryPointFilePath) + || string.IsNullOrEmpty(entryPointFilePath)) + { + return; + } + + // Only warn when there are multiple syntax trees (i.e., #:include directives are used). + // Single-file programs don't need a shebang to distinguish the entry point. + if (context.Compilation.SyntaxTrees.Count() <= 1) + { + return; + } + + context.RegisterSyntaxTreeAction(context => + { + if (!context.Tree.FilePath.Equals(entryPointFilePath, StringComparison.OrdinalIgnoreCase)) + { + return; + } + + var root = context.Tree.GetRoot(context.CancellationToken); + if (root.GetLeadingTrivia().Any(SyntaxKind.ShebangDirectiveTrivia)) + { + return; + } + + var location = root.GetFirstToken(includeZeroWidth: true).GetLocation(); + context.ReportDiagnostic(location.CreateDiagnostic(Rule)); + }); + }); + } + } +} diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/AnalyzerReleases.Unshipped.md b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/AnalyzerReleases.Unshipped.md index cdf4f1397e0b..bdb7ada7fa0d 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/AnalyzerReleases.Unshipped.md +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/AnalyzerReleases.Unshipped.md @@ -1 +1,7 @@ ; Please do not edit this file manually, it should only be updated through code fix application. + +### New Rules + +Rule ID | Category | Severity | Notes +--------|----------|----------|------- +CA2266 | Usage | Warning | MissingShebangInFileBasedProgram diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx index 55948fcbc88d..1749547f5bb1 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx @@ -2216,4 +2216,13 @@ Widening and user defined conversions are not supported with generic types. Replace obsolete call + + File-based program entry point should start with '#!' + + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + File-based program entry point should start with '#!' + diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs new file mode 100644 index 000000000000..04d53309e118 --- /dev/null +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs @@ -0,0 +1,31 @@ +// Copyright (c) Microsoft. All Rights Reserved. Licensed under the MIT license. See License.txt in the project root for license information. + +using System.Collections.Immutable; +using Analyzer.Utilities; +using Microsoft.CodeAnalysis; +using Microsoft.CodeAnalysis.Diagnostics; + +namespace Microsoft.NetCore.Analyzers.Runtime +{ + using static MicrosoftNetCoreAnalyzersResources; + + /// + /// CA2266: + /// + public abstract class MissingShebangInFileBasedProgram : DiagnosticAnalyzer + { + internal const string RuleId = "CA2266"; + + internal static readonly DiagnosticDescriptor Rule = DiagnosticDescriptorHelper.Create( + RuleId, + CreateLocalizableResourceString(nameof(MissingShebangInFileBasedProgramTitle)), + CreateLocalizableResourceString(nameof(MissingShebangInFileBasedProgramMessage)), + DiagnosticCategory.Usage, + RuleLevel.BuildWarning, + CreateLocalizableResourceString(nameof(MissingShebangInFileBasedProgramDescription)), + isPortedFxCopRule: false, + isDataflowRule: false); + + public sealed override ImmutableArray SupportedDiagnostics { get; } = ImmutableArray.Create(Rule); + } +} diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf index d5f92baf02e5..c6a9793fd82b 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf @@ -1833,6 +1833,21 @@ Rozšíření a uživatelem definované převody se u obecných typů nepodporuj Metoda akce {0} musí explicitně určit druh požadavku HTTP. + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. Inicializátory modulů jsou určeny pro použití kódem aplikace k zajištění, aby byly komponenty aplikace inicializovány před tím, než se začne kód aplikace spouštět. Pokud kód knihovny deklaruje metodu s ModuleInitializerAttribute, může narušovat inicializaci aplikace a také vést k omezením schopností oříznutí dané aplikace. Knihovna by proto neměla používat metody s označením ModuleInitializerAttribute, ale namísto toho by měla zpřístupnit metody, které lze použít k inicializaci všech komponent v rámci knihovny a umožnit aplikaci vyvolat metodu během inicializace aplikace. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf index f63f006d064d..64a5a2f79bfb 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf @@ -1833,6 +1833,21 @@ Erweiterungen und benutzerdefinierte Konvertierungen werden bei generischen Type Die Aktionsmethode "{0}" muss die Art der HTTP-Anforderung explizit angeben. + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. Modulinitialisierer sollen vom Anwendungscode verwendet werden, um sicherzustellen, dass die Komponenten einer Anwendung initialisiert werden, bevor der Anwendungscode ausgeführt wird. Wenn Bibliothekscode eine Methode mit \"ModuleInitializerAttribute\" deklariert, kann dies die Anwendungsinitialisierung beeinträchtigen und auch zu Einschränkungen in den Kürzungsfähigkeiten dieser Anwendung führen. Anstatt Methoden zu verwenden, die mit \"ModuleInitializerAttribute\" gekennzeichnet sind, sollte die Bibliothek Methoden verfügbar machen, mit denen alle Komponenten innerhalb der Bibliothek initialisiert werden können, und der Anwendung das Aufrufen der Methode während der Anwendungsinitialisierung ermöglichen. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf index a03a7a0fa4d0..900593b59fb3 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf @@ -1833,6 +1833,21 @@ La ampliación y las conversiones definidas por el usuario no se admiten con tip El método de acción {0} debe especificar la variante de solicitud HTTP de forma explícita. + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. Los inicializadores de módulo están diseñados para que los use el código de aplicación para asegurarse de que los componentes de una aplicación se inicializan antes de que el código de la aplicación comience a ejecutarse. Si el código de biblioteca declara un método con \"ModuleInitializerAttribute\", puede interferir con la inicialización de la aplicación y también provocar limitaciones en las capacidades de recorte de esa aplicación. En lugar de usar métodos marcados con \"ModuleInitializerAttribute\", la biblioteca debe exponer métodos que se pueden usar para inicializar cualquier componente dentro de la biblioteca y permitir que la aplicación invoque el método durante la inicialización de la aplicación. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf index 40c160bb5b5f..5f30a08ca809 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf @@ -1833,6 +1833,21 @@ Les conversions étendues et définies par l’utilisateur ne sont pas prises en La méthode d'action {0} doit spécifier explicitement le genre de requête HTTP + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. Les initialiseurs de module sont destinés à être utilisés par le code d’application pour s’assurer que les composants d’une application sont initialisés avant le début de l’exécution du code d’application. Si le code de bibliothèque déclare une méthode avec « ModuleInitializerAttribute », il peut interférer avec l’initialisation de l’application et également entraîner des limitations dans les capacités de découpage de cette application. Au lieu d’utiliser des méthodes marquées avec « ModuleInitializerAttribute », la bibliothèque doit exposer des méthodes qui peuvent être utilisées pour initialiser tous les composants de la bibliothèque et permettre à l’application d’appeler la méthode pendant l’initialisation de l’application. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf index 924a482d9f5d..0149236f47d9 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf @@ -1833,6 +1833,21 @@ L'ampliamento e le conversioni definite dall'utente non sono supportate con tipi Il metodo di azione {0} deve specificare in modo esplicito il tipo della richiesta HTTP + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. La presenza di inizializzatori di modulo nel codice dell'applicazione assicura che i componenti di un'applicazione vengano inizializzati prima dell'inizio dell'esecuzione del codice dell'applicazione. La dichiarazione di un modulo 'ModuleInitializerAttribute' nel codice della libreria può interferire con l'inizializzazione dell'applicazione e causare limitazioni alle funzionalità di trimming di tale applicazione. Il codice della libreria non deve quindi utilizzare l'attributo 'ModuleInitializerAttribute', ma esporre metodi utilizzabili per inizializzare tutti i componenti nella libreria e consentire all'applicazione di richiamare il metodo durante l'inizializzazione dell'applicazione. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf index 6c3fbfeccd9a..54dba869429d 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf @@ -1833,6 +1833,21 @@ Enumerable.OfType<T> で使用されるジェネリック型チェック ( アクション メソッド {0} では、HTTP 要求の種類を明示的に指定する必要があります + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. モジュール初期化子は、アプリケーション コードの実行を開始する前にアプリケーションのコンポーネントが初期化されるように、アプリケーション コードによって使用されることを目的としています。ライブラリ コードで 'ModuleInitializerAttribute' を使用してメソッドを宣言する場合、アプリケーションの初期化を妨げる可能性があり、そのアプリケーションのトリミング機能の制限にもつながります。'ModuleInitializerAttribute' でマークされたメソッドを使用する代わりに、ライブラリ内のコンポーネントを初期化し、アプリケーションの初期化中にアプリケーションがメソッドを呼び出せるようにするために使用できるメソッドを公開する必要があります。 diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf index f0706403c0d4..a8006a1199e5 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf @@ -1833,6 +1833,21 @@ Enumerable.OfType<T>에서 사용하는 제네릭 형식 검사(C# 'is' 작업 메서드 {0}은(는) HTTP 요청 종류를 명시적으로 지정해야 합니다. + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. 모듈 이니셜라이저는 응용 프로그램 코드가 실행을 시작하기 전에 응용 프로그램의 구성 요소가 초기화되도록 응용 프로그램 코드에서 사용하기 위한 것입니다. 라이브러리 코드가 'ModuleInitializerAttribute'를 사용하여 메서드를 선언하면 응용 프로그램 초기화를 방해할 수 있으며 해당 응용 프로그램의 트리밍 기능에 제한이 생길 수도 있습니다. 'ModuleInitializerAttribute'로 표시된 메서드를 사용하는 대신 라이브러리는 라이브러리 내의 구성 요소를 초기화하는 데 사용할 수 있는 메서드를 노출하고 응용 프로그램 초기화 중에 응용 프로그램이 메서드를 호출할 수 있도록 해야 합니다. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf index 51f4dee3e919..8f765045a34d 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf @@ -1833,6 +1833,21 @@ Konwersje poszerzane i zdefiniowane przez użytkownika nie są obsługiwane w pr Metoda akcji {0} musi jawnie określać rodzaj żądania HTTP + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. Inicjatory modułów są przeznaczone do użycia przez kod aplikacji w celu zapewnienia, że składniki aplikacji zostaną zainicjowane przed rozpoczęciem wykonywania kodu aplikacji. Jeśli kod biblioteki deklaruje metodę za pomocą atrybutu „ModuleInitializer”, może zakłócać inicjowanie aplikacji, a także prowadzić do ograniczeń w możliwościach przycinania tej aplikacji. Zamiast używać metod oznaczonych atrybutem „ModuleInitializer”, biblioteka powinna uwidaczniać metody, których można użyć do zainicjowania składników w bibliotece i umożliwienia aplikacji wywołania metody podczas inicjowania aplikacji. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf index cb9dea8edaf1..c6ad03522b96 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf @@ -1833,6 +1833,21 @@ As ampliação e conversões definidas pelo usuário não são compatíveis com O método de ação {0} precisa especificar explicitamente o tipo de solicitação HTTP + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. Os inicializadores de módulo devem ser usados pelo código do aplicativo para garantir que os componentes de um aplicativo sejam inicializados antes que o código do aplicativo comece a ser executado. Se o código da biblioteca declara um método com o 'ModuleInitializerAttribute', ele pode interferir na inicialização do aplicativo e também levar a limitações nas habilidades de corte do aplicativo. Ao invés de usar métodos marcados com 'ModuleInitializerAttribute', a biblioteca deve expor os métodos que podem ser usados para inicializar quaisquer componentes dentro da biblioteca e permitir que o aplicativo invoque o método durante a inicialização do aplicativo. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf index 57538a5cb231..e1d90c4e038c 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf @@ -1833,6 +1833,21 @@ Widening and user defined conversions are not supported with generic types.В методе действия {0} необходимо явным образом указать тип HTTP-запроса/ + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. Инициализаторы модулей предназначены для использования кодом приложения, чтобы обеспечить инициализацию компонентов приложения до того, как код приложения начнет выполняться. Если код библиотеки объявляет метод с ''ModuleInitializerAttribute'', это может помешать инициализации приложения, а также привести к ограничениям возможностей обрезки этого приложения. Вместо использования методов, помеченных ''ModuleInitializerAttribute'', библиотека должна предоставлять методы, которые можно использовать для инициализации любых компонентов в библиотеке, и позволять приложению вызывать метод во время инициализации приложения. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf index de2ea9f502e1..f834b982f107 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf @@ -1833,6 +1833,21 @@ Genel türlerde genişletme ve kullanıcı tanımlı dönüştürmeler desteklen {0} eylem metodunun HTTP istek tipini açık olarak belirtmesi gerekir + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. Modül başlatıcılar, uygulama kodu yürütülmeye başlamadan önce uygulamanın bileşenlerinin başlatılmasını sağlamak için uygulama kodu tarafından kullanılmak içindir. Kitaplık kodu 'ModuleInitializerAttribute' öznitelikli bir yöntem bildirirse, uygulamanın başlatılmasına engel olabilir ve ayrıca bu uygulamanın kırpma becerileriyle ilgili sınırlamalara neden olabilir. Kitaplık, 'ModuleInitializerAttribute' özniteliği ile işaretli yöntemleri kullanmak yerine, içindeki bileşenlerin başlatılması için kullanılabilecek ve başlatılırken uygulamanın çağırabileceği yöntemleri kullanıma sunmalıdır. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf index 68f722d64e4f..6a5075b136b9 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf @@ -1833,6 +1833,21 @@ Enumerable.OfType<T> 使用的泛型类型检查(C# 'is' operator/IL 'isin 操作方法 {0} 需要显式指定 HTTP 请求类型 + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. 模块初始化表达式旨在由应用程序代码用于确保在应用程序代码开始执行之前初始化应用程序的组件。如果库代码使用 “ModuleInitializer” 声明方法，则可能干扰应用程序初始化，并且还会导致限制该应用程序的剪裁功能。因此库不应使用标记为 “ModuleInitializerAttribute” 的方法，而应公开可用于初始化库中任何组件的方法，并允许应用程序在应用程序初始化期间调用该方法。 diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf index 43db515c0d4b..bd41eeaa48ef 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf @@ -1833,6 +1833,21 @@ Enumerable.OfType<T> 使用的一般型別檢查 (C# 'is' operator/IL 'isi Action 方法 {0} 必須明確地指定 HTTP 要求種類 + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + + + File-based program entry point should start with '#!' + File-based program entry point should start with '#!' + + Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization. 模組初始設定式供應用程式程式碼使用，以確保應用程式程式碼開始執行前先初始化應用程式的元件。如果程式庫程式碼宣告擁有 'ModuleInitializerAttribute' 的方法，它可能會干擾應用程式初始化，而且也會導致該應用程式的截斷功能遭到限制。不使用標示為 'ModuleInitializerAttribute' 的方法，程式庫應該公開可用於初始化程式庫內任何元件的方法，並允許應用程式在應用程式初始化期間叫用方法。 diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/Compiler/DiagnosticCategoryAndIdRanges.txt b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/Compiler/DiagnosticCategoryAndIdRanges.txt index 84d171e834bd..c22f1703c19a 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/Compiler/DiagnosticCategoryAndIdRanges.txt +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/Compiler/DiagnosticCategoryAndIdRanges.txt @@ -14,7 +14,7 @@ Globalization: CA2101, CA1300-CA1311 Mobility: CA1600-CA1601 Performance: HA, CA1800-CA1875 Security: CA2100-CA2153, CA2300-CA2330, CA3000-CA3147, CA5300-CA5405 -Usage: CA1801, CA1806, CA1816, CA2200-CA2209, CA2211-CA2265 +Usage: CA1801, CA1806, CA1816, CA2200-CA2209, CA2211-CA2266 Naming: CA1700-CA1727 Interoperability: CA1400-CA1422 Maintainability: CA1500-CA1515 diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs new file mode 100644 index 000000000000..83a2ce506eb9 --- /dev/null +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs @@ -0,0 +1,107 @@ +// Copyright (c) Microsoft. All Rights Reserved. Licensed under the MIT license. See License.txt in the project root for license information. + +using System.Threading.Tasks; +using Microsoft.CodeAnalysis.Testing; +using Xunit; +using VerifyCS = Test.Utilities.CSharpSecurityCodeFixVerifier< + Microsoft.NetCore.CSharp.Analyzers.Runtime.CSharpMissingShebangInFileBasedProgram, + Microsoft.CodeAnalysis.Testing.EmptyCodeFixProvider>; + +namespace Microsoft.NetCore.Analyzers.Runtime.UnitTests +{ + public class MissingShebangInFileBasedProgramTests + { + private const string GlobalConfig = "is_global = true\r\nbuild_property.EntryPointFilePath = /0/Test0.cs"; + + [Fact] + public async Task EntryPointWithoutShebang_MultipleFiles_WarningAsync() + { + // Entry point file without shebang, multiple files - warning expected. + await new VerifyCS.Test + { + TestState = + { + Sources = + { + ("Test0.cs", """class Program { static void Main() { } }"""), + ("Util.cs", """class Util { public static string Greet() => "hello"; }"""), + }, + AnalyzerConfigFiles = { ("/.globalconfig", GlobalConfig) }, + ExpectedDiagnostics = + { + new DiagnosticResult(MissingShebangInFileBasedProgram.Rule).WithLocation("Test0.cs", 1, 1), + }, + }, + }.RunAsync(); + } + + [Fact] + public async Task NoEntryPointFilePath_NoDiagnosticAsync() + { + // No EntryPointFilePath - not a file-based program, no diagnostic. + await VerifyCS.VerifyAnalyzerAsync(""" + class Program + { + static void Main() + { + System.Console.WriteLine("hello"); + } + } + """); + } + + [Fact] + public async Task SingleFile_NoDiagnosticAsync() + { + // Single file - no need to distinguish entry point, no diagnostic. + await new VerifyCS.Test + { + TestState = + { + Sources = { ("Test0.cs", """class Program { static void Main() { } }""") }, + AnalyzerConfigFiles = { ("/.globalconfig", GlobalConfig) }, + }, + }.RunAsync(); + } + + [Fact] + public async Task NonEntryPointFile_MultipleFiles_NoDiagnosticAsync() + { + // Only the entry point gets the diagnostic, not other files. + await new VerifyCS.Test + { + TestState = + { + Sources = + { + ("Test0.cs", """class Program { static void Main() { Util.Greet(); } }"""), + ("Util.cs", """class Util { public static string Greet() => "hello"; }"""), + }, + AnalyzerConfigFiles = { ("/.globalconfig", GlobalConfig) }, + ExpectedDiagnostics = + { + new DiagnosticResult(MissingShebangInFileBasedProgram.Rule).WithLocation("Test0.cs", 1, 1), + }, + }, + }.RunAsync(); + } + + [Fact] + public async Task EmptyEntryPointFilePath_NoDiagnosticAsync() + { + // Empty EntryPointFilePath - not a file-based program, no diagnostic. + await new VerifyCS.Test + { + TestState = + { + Sources = + { + ("Test0.cs", """class Program { static void Main() { } }"""), + ("Util.cs", """class Util { }"""), + }, + AnalyzerConfigFiles = { ("/.globalconfig", "is_global = true\r\nbuild_property.EntryPointFilePath = ") }, + }, + }.RunAsync(); + } + } +} \ No newline at end of file diff --git a/src/Microsoft.DotNet.ProjectTools/VirtualProjectBuilder.cs b/src/Microsoft.DotNet.ProjectTools/VirtualProjectBuilder.cs index 0c2950fa03df..b4adf03ea70c 100644 --- a/src/Microsoft.DotNet.ProjectTools/VirtualProjectBuilder.cs +++ b/src/Microsoft.DotNet.ProjectTools/VirtualProjectBuilder.cs @@ -499,6 +499,7 @@ internal static void WriteProjectFile( artifacts/$(AssemblyName) artifacts/$(AssemblyName) true + {EscapeValue(entryPointFilePath)} {CSharpDirective.IncludeOrExclude.DefaultMappingString} false true diff --git a/src/Tasks/Microsoft.NET.Build.Tasks/targets/Microsoft.NET.Sdk.Analyzers.targets b/src/Tasks/Microsoft.NET.Build.Tasks/targets/Microsoft.NET.Sdk.Analyzers.targets index 0c206deb1e52..997e38042fd9 100644 --- a/src/Tasks/Microsoft.NET.Build.Tasks/targets/Microsoft.NET.Sdk.Analyzers.targets +++ b/src/Tasks/Microsoft.NET.Build.Tasks/targets/Microsoft.NET.Sdk.Analyzers.targets @@ -145,6 +145,7 @@ Copyright (c) .NET Foundation. All rights reserved. --> + diff --git a/test/dotnet.Tests/CommandTests/Run/RunFileTests.cs b/test/dotnet.Tests/CommandTests/Run/RunFileTests.cs index 585e5ab925bc..62355a3ae597 100644 --- a/test/dotnet.Tests/CommandTests/Run/RunFileTests.cs +++ b/test/dotnet.Tests/CommandTests/Run/RunFileTests.cs @@ -1,4 +1,4 @@ -// Licensed to the .NET Foundation under one or more agreements. +// Licensed to the .NET Foundation under one or more agreements. // The .NET Foundation licenses this file to you under the MIT license. using System.Collections.Immutable; @@ -1815,6 +1815,80 @@ public void Verbosity_CompilationDiagnostics() .And.HaveStdErrContaining(CliCommandStrings.RunCommandException); } + [Fact] + public void MissingShebangWarning() + { + var testInstance = _testAssetsManager.CreateTestDirectory(); + + File.WriteAllText(Path.Join(testInstance.Path, "Directory.Build.props"), """ + + + true + true + + + """); + + // Single-file program without shebang should NOT produce CA2266 + // (the warning only fires when there are multiple files via #:include). + File.WriteAllText(Path.Join(testInstance.Path, "Program.cs"), """ + Console.WriteLine("hello"); + """); + + new DotnetCommand(Log, "run", "Program.cs") + .WithWorkingDirectory(testInstance.Path) + .Execute() + .Should().Pass() + .And.NotHaveStdOutContaining("CA2266") + .And.HaveStdOutContaining("hello"); + + // Included file without shebang should not produce CA2266. + File.WriteAllText(Path.Join(testInstance.Path, "Util.cs"), """ + class Util { public static string Greet() => "hello"; } + """); + + // Entry point with shebang and #:include — no warning. + File.WriteAllText(Path.Join(testInstance.Path, "Program.cs"), """ + #!/usr/bin/env dotnet + #:include Util.cs + Console.WriteLine(Util.Greet()); + """); + + new DotnetCommand(Log, "run", "Program.cs") + .WithWorkingDirectory(testInstance.Path) + .Execute() + .Should().Pass() + .And.NotHaveStdOutContaining("CA2266") + .And.HaveStdOutContaining("hello"); + + // Entry point without shebang and #:include — CA2266 warning expected. + File.WriteAllText(Path.Join(testInstance.Path, "Program.cs"), """ + #:include Util.cs + Console.WriteLine(Util.Greet()); + """); + + new DotnetCommand(Log, "run", "Program.cs") + .WithWorkingDirectory(testInstance.Path) + .Execute() + .Should().Pass() + .And.HaveStdOutContaining("warning CA2266") + .And.HaveStdOutContaining("hello"); + + // CA2266 can be suppressed via NoWarn. + File.WriteAllText(Path.Join(testInstance.Path, "Program.cs"), """ + #:property NoWarn=CA2266 + #:include Util.cs + Console.WriteLine(Util.Greet()); + """); + + new DotnetCommand(Log, "run", "Program.cs") + .WithWorkingDirectory(testInstance.Path) + .Execute() + .Should().Pass() + .And.NotHaveStdOutContaining("CA2266") + .And.HaveStdOutContaining("hello"); + } + /// /// File-based projects using the default SDK do not include embedded resources by default. /// @@ -5734,6 +5808,7 @@ public void Api() artifacts/$(AssemblyName) artifacts/$(AssemblyName) true + {programPath} .cs=Compile;.resx=EmbeddedResource;.json=None;.razor=Content false true @@ -5826,6 +5901,7 @@ public void Api_Evaluation() artifacts/$(AssemblyName) artifacts/$(AssemblyName) true + {programPath} .cs=Compile;.resx=EmbeddedResource;.json=None;.razor=Content false true @@ -5901,6 +5977,7 @@ public void Api_Diagnostic_01() artifacts/$(AssemblyName) artifacts/$(AssemblyName) true + {programPath} .cs=Compile;.resx=EmbeddedResource;.json=None;.razor=Content false true @@ -5975,6 +6052,7 @@ public void Api_Diagnostic_02() artifacts/$(AssemblyName) artifacts/$(AssemblyName) true + {programPath} .cs=Compile;.resx=EmbeddedResource;.json=None;.razor=Content false true From a3d03daeedcc49e01e390c9e3874a2621c062752 Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Fri, 27 Mar 2026 14:04:46 +0100 Subject: [PATCH 02/11] Update doc and sarif files --- .../Microsoft.CodeAnalysis.NetAnalyzers.md | 12 ++++++++++++ .../Microsoft.CodeAnalysis.NetAnalyzers.sarif | 19 +++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.md b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.md index facf822421c6..a7c98667b9b2 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.md +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.md @@ -2742,6 +2742,18 @@ Comparing a span to 'null' or 'default' might not do what you intended. 'default |CodeFix|True| --- +## [CA2266](https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2266): File-based program entry point should start with '#!' + +When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. + +|Item|Value| +|-|-| +|Category|Usage| +|Enabled|True| +|Severity|Warning| +|CodeFix|False| +--- + ## [CA2300](https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2300): Do not use insecure deserializer BinaryFormatter The method '{0}' is insecure when deserializing untrusted data. If you need to instead detect BinaryFormatter deserialization without a SerializationBinder set, then disable rule CA2300, and enable rules CA2301 and CA2302. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif index 498b1e3a5e93..b2710e8f8fbd 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif @@ -589,6 +589,25 @@ ] } }, + "CA2266": { + "id": "CA2266", + "shortDescription": "File-based program entry point should start with '#!'", + "fullDescription": "When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2266", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "CSharpMissingShebangInFileBasedProgram", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, "CA2352": { "id": "CA2352", "shortDescription": "Unsafe DataSet or DataTable in serializable type can be vulnerable to remote code execution attacks", From 3e41a04cdbeb144e03f53d7c56fc6a77b7d8caba Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Fri, 27 Mar 2026 17:11:27 +0100 Subject: [PATCH 03/11] Fixup --- .../CSharpMissingShebangInFileBasedProgram.cs | 36 ++++++++++++------- .../Microsoft.CodeAnalysis.NetAnalyzers.sarif | 3 +- .../MissingShebangInFileBasedProgram.cs | 6 ++-- .../Options/MSBuildPropertyOptionNames.cs | 1 + .../MissingShebangInFileBasedProgramTests.cs | 2 +- .../CommandTests/Run/RunFileTests.cs | 1 + 6 files changed, 30 insertions(+), 19 deletions(-) diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs index 7e80ac955554..dac1efe585d2 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs @@ -1,7 +1,6 @@ // Copyright (c) Microsoft. All Rights Reserved. Licensed under the MIT license. See License.txt in the project root for license information. -using System; -using System.Linq; +using Analyzer.Utilities; using Analyzer.Utilities.Extensions; using Microsoft.CodeAnalysis; using Microsoft.CodeAnalysis.CSharp; @@ -10,7 +9,6 @@ namespace Microsoft.NetCore.CSharp.Analyzers.Runtime { - /// CA2026: [DiagnosticAnalyzer(LanguageNames.CSharp)] public sealed class CSharpMissingShebangInFileBasedProgram : MissingShebangInFileBasedProgram { @@ -21,22 +19,23 @@ public override void Initialize(AnalysisContext context) context.RegisterCompilationStartAction(context => { - var globalOptions = context.Options.AnalyzerConfigOptionsProvider.GlobalOptions; - if (!globalOptions.TryGetValue("build_property.EntryPointFilePath", out var entryPointFilePath) - || string.IsNullOrEmpty(entryPointFilePath)) + var entryPointFilePath = context.Options.GetMSBuildPropertyValue( + MSBuildPropertyOptionNames.EntryPointFilePath, context.Compilation); + if (string.IsNullOrEmpty(entryPointFilePath)) { return; } - // Only warn when there are multiple syntax trees (i.e., #:include directives are used). - // Single-file programs don't need a shebang to distinguish the entry point. - if (context.Compilation.SyntaxTrees.Count() <= 1) - { - return; - } + // Track whether there are multiple non-generated source files. + // ConfigureGeneratedCodeAnalysis(None) ensures that the SyntaxTreeAction + // is only called for non-generated trees, so we count those. + int nonGeneratedTreeCount = 0; + Diagnostic? pendingDiagnostic = null; context.RegisterSyntaxTreeAction(context => { + Interlocked.Increment(ref nonGeneratedTreeCount); + if (!context.Tree.FilePath.Equals(entryPointFilePath, StringComparison.OrdinalIgnoreCase)) { return; @@ -49,7 +48,18 @@ public override void Initialize(AnalysisContext context) } var location = root.GetFirstToken(includeZeroWidth: true).GetLocation(); - context.ReportDiagnostic(location.CreateDiagnostic(Rule)); + Interlocked.CompareExchange(ref pendingDiagnostic, location.CreateDiagnostic(Rule), null); + }); + + context.RegisterCompilationEndAction(context => + { + // Only report when there are multiple non-generated files + // (i.e., #:include directives are used). + // Single-file programs don't need a shebang to distinguish the entry point. + if (Volatile.Read(ref nonGeneratedTreeCount) > 1 && pendingDiagnostic is { } diagnostic) + { + context.ReportDiagnostic(diagnostic); + } }); }); } diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif index b2710e8f8fbd..1d2bb3538904 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif @@ -604,7 +604,8 @@ ], "tags": [ "Telemetry", - "EnabledRuleInAggressiveMode" + "EnabledRuleInAggressiveMode", + "CompilationEnd" ] } }, diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs index 04d53309e118..b527209c5ff8 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs @@ -9,9 +9,6 @@ namespace Microsoft.NetCore.Analyzers.Runtime { using static MicrosoftNetCoreAnalyzersResources; - /// - /// CA2266: - /// public abstract class MissingShebangInFileBasedProgram : DiagnosticAnalyzer { internal const string RuleId = "CA2266"; @@ -24,7 +21,8 @@ public abstract class MissingShebangInFileBasedProgram : DiagnosticAnalyzer RuleLevel.BuildWarning, CreateLocalizableResourceString(nameof(MissingShebangInFileBasedProgramDescription)), isPortedFxCopRule: false, - isDataflowRule: false); + isDataflowRule: false, + isReportedAtCompilationEnd: true); public sealed override ImmutableArray SupportedDiagnostics { get; } = ImmutableArray.Create(Rule); } diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/Compiler/Options/MSBuildPropertyOptionNames.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/Compiler/Options/MSBuildPropertyOptionNames.cs index 314f1ec6d51b..0d7db6ee7732 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/Compiler/Options/MSBuildPropertyOptionNames.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/Compiler/Options/MSBuildPropertyOptionNames.cs @@ -23,6 +23,7 @@ internal static class MSBuildPropertyOptionNames public const string InvariantGlobalization = nameof(InvariantGlobalization); public const string PlatformNeutralAssembly = nameof(PlatformNeutralAssembly); public const string EnforceExtendedAnalyzerRules = nameof(EnforceExtendedAnalyzerRules); + public const string EntryPointFilePath = nameof(EntryPointFilePath); } internal static class MSBuildPropertyOptionNamesHelpers diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs index 83a2ce506eb9..ec1a639aefc4 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs @@ -11,7 +11,7 @@ namespace Microsoft.NetCore.Analyzers.Runtime.UnitTests { public class MissingShebangInFileBasedProgramTests { - private const string GlobalConfig = "is_global = true\r\nbuild_property.EntryPointFilePath = /0/Test0.cs"; + private const string GlobalConfig = "is_global = true\r\nbuild_property.EntryPointFilePath = Test0.cs"; [Fact] public async Task EntryPointWithoutShebang_MultipleFiles_WarningAsync() diff --git a/test/dotnet.Tests/CommandTests/Run/RunFileTests.cs b/test/dotnet.Tests/CommandTests/Run/RunFileTests.cs index 62355a3ae597..8424e38ee8d0 100644 --- a/test/dotnet.Tests/CommandTests/Run/RunFileTests.cs +++ b/test/dotnet.Tests/CommandTests/Run/RunFileTests.cs @@ -1825,6 +1825,7 @@ public void MissingShebangWarning() true true + preview """); From 75365b8d1b4aed74a3eb776e130c870e027b36b1 Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Fri, 27 Mar 2026 17:20:11 +0100 Subject: [PATCH 04/11] Change namespace to Usage --- .../CSharpMissingShebangInFileBasedProgram.cs | 4 ++-- .../{Runtime => Usage}/MissingShebangInFileBasedProgram.cs | 2 +- .../MissingShebangInFileBasedProgramTests.cs | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) rename src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/{Runtime => Usage}/CSharpMissingShebangInFileBasedProgram.cs (96%) rename src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/{Runtime => Usage}/MissingShebangInFileBasedProgram.cs (96%) rename src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/{Runtime => Usage}/MissingShebangInFileBasedProgramTests.cs (96%) diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs similarity index 96% rename from src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs rename to src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs index dac1efe585d2..d8dcadea3a3d 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/CSharpMissingShebangInFileBasedProgram.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs @@ -5,9 +5,9 @@ using Microsoft.CodeAnalysis; using Microsoft.CodeAnalysis.CSharp; using Microsoft.CodeAnalysis.Diagnostics; -using Microsoft.NetCore.Analyzers.Runtime; +using Microsoft.NetCore.Analyzers.Usage; -namespace Microsoft.NetCore.CSharp.Analyzers.Runtime +namespace Microsoft.NetCore.CSharp.Analyzers.Usage { [DiagnosticAnalyzer(LanguageNames.CSharp)] public sealed class CSharpMissingShebangInFileBasedProgram : MissingShebangInFileBasedProgram diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.cs similarity index 96% rename from src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs rename to src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.cs index b527209c5ff8..58cb16d57002 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgram.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.cs @@ -5,7 +5,7 @@ using Microsoft.CodeAnalysis; using Microsoft.CodeAnalysis.Diagnostics; -namespace Microsoft.NetCore.Analyzers.Runtime +namespace Microsoft.NetCore.Analyzers.Usage { using static MicrosoftNetCoreAnalyzersResources; diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs similarity index 96% rename from src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs rename to src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs index ec1a639aefc4..f1aaad627cad 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Runtime/MissingShebangInFileBasedProgramTests.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs @@ -4,10 +4,10 @@ using Microsoft.CodeAnalysis.Testing; using Xunit; using VerifyCS = Test.Utilities.CSharpSecurityCodeFixVerifier< - Microsoft.NetCore.CSharp.Analyzers.Runtime.CSharpMissingShebangInFileBasedProgram, + Microsoft.NetCore.CSharp.Analyzers.Usage.CSharpMissingShebangInFileBasedProgram, Microsoft.CodeAnalysis.Testing.EmptyCodeFixProvider>; -namespace Microsoft.NetCore.Analyzers.Runtime.UnitTests +namespace Microsoft.NetCore.Analyzers.Usage.UnitTests { public class MissingShebangInFileBasedProgramTests { From f924d6368100e716f83383b4ce5cb57a1ed23543 Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Fri, 27 Mar 2026 17:22:53 +0100 Subject: [PATCH 05/11] Document EntryPointFilePath --- documentation/general/dotnet-run-file.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/documentation/general/dotnet-run-file.md b/documentation/general/dotnet-run-file.md index 2858846a3da2..9636bc0ff88b 100644 --- a/documentation/general/dotnet-run-file.md +++ b/documentation/general/dotnet-run-file.md @@ -52,6 +52,8 @@ Additionally, the implicit project file has the following customizations: string? directoryPath = AppContext.GetData("EntryPointFileDirectoryPath") as string; ``` + - `EntryPointFilePath` property is set to the entry-point file path and is made visible to analyzers via `CompilerVisibleProperty`. + - `FileBasedProgram` property is set to `true` and can be used by SDK targets to detect file-based apps. - `DisableDefaultItemsInProjectFolder` property is set to `true` which results in `EnableDefaultItems=false` by default From e44e29d906489770160cbf492f906e130802fe2f Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Fri, 27 Mar 2026 21:30:50 +0100 Subject: [PATCH 06/11] Add fixer --- ...pMissingShebangInFileBasedProgram.Fixer.cs | 53 + .../Microsoft.CodeAnalysis.NetAnalyzers.md | 2 +- .../MicrosoftNetCoreAnalyzersResources.resx | 3 + .../MissingShebangInFileBasedProgram.Fixer.cs | 14 + .../MicrosoftNetCoreAnalyzersResources.cs.xlf | 5 + .../MicrosoftNetCoreAnalyzersResources.de.xlf | 5 + .../MicrosoftNetCoreAnalyzersResources.es.xlf | 5 + .../MicrosoftNetCoreAnalyzersResources.fr.xlf | 5 + .../MicrosoftNetCoreAnalyzersResources.it.xlf | 5 + .../MicrosoftNetCoreAnalyzersResources.ja.xlf | 5 + .../MicrosoftNetCoreAnalyzersResources.ko.xlf | 5 + .../MicrosoftNetCoreAnalyzersResources.pl.xlf | 5 + ...crosoftNetCoreAnalyzersResources.pt-BR.xlf | 5 + .../MicrosoftNetCoreAnalyzersResources.ru.xlf | 5 + .../MicrosoftNetCoreAnalyzersResources.tr.xlf | 5 + ...osoftNetCoreAnalyzersResources.zh-Hans.xlf | 5 + ...osoftNetCoreAnalyzersResources.zh-Hant.xlf | 5 + ...-Microsoft.CodeAnalysis.NetAnalyzers.sarif | 7115 +++++++++++++++++ .../MissingShebangInFileBasedProgramTests.cs | 50 +- 19 files changed, 7298 insertions(+), 4 deletions(-) create mode 100644 src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.Fixer.cs create mode 100644 src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.Fixer.cs create mode 100644 src/Microsoft.CodeAnalysis.NetAnalyzers/src/temp-Microsoft.CodeAnalysis.NetAnalyzers.sarif diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.Fixer.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.Fixer.cs new file mode 100644 index 000000000000..e1191de30e7c --- /dev/null +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.Fixer.cs @@ -0,0 +1,53 @@ +// Copyright (c) Microsoft. All Rights Reserved. Licensed under the MIT license. See License.txt in the project root for license information. + +using System.Composition; +using Microsoft.CodeAnalysis; +using Microsoft.CodeAnalysis.CodeActions; +using Microsoft.CodeAnalysis.CodeFixes; +using Microsoft.CodeAnalysis.CSharp; +using Microsoft.CodeAnalysis.Text; +using Microsoft.NetCore.Analyzers; +using Microsoft.NetCore.Analyzers.Usage; + +namespace Microsoft.NetCore.CSharp.Analyzers.Usage +{ + [ExportCodeFixProvider(LanguageNames.CSharp), Shared] + public sealed class CSharpMissingShebangInFileBasedProgramFixer : MissingShebangInFileBasedProgramFixer + { + public override async Task RegisterCodeFixesAsync(CodeFixContext context) + { + var root = await context.Document.GetSyntaxRootAsync(context.CancellationToken).ConfigureAwait(false); + if (root is null) + { + return; + } + + var codeAction = CodeAction.Create( + MicrosoftNetCoreAnalyzersResources.MissingShebangInFileBasedProgramCodeFixTitle, + _ => + { + var eol = GetEndOfLine(root.SyntaxTree.GetText()); + var shebangTrivia = SyntaxFactory.ParseLeadingTrivia("#!/usr/bin/env dotnet" + eol); + var firstToken = root.GetFirstToken(includeZeroWidth: true); + var newFirstToken = firstToken.WithLeadingTrivia(shebangTrivia.AddRange(firstToken.LeadingTrivia)); + var newRoot = root.ReplaceToken(firstToken, newFirstToken); + return Task.FromResult(context.Document.WithSyntaxRoot(newRoot)); + }, + MicrosoftNetCoreAnalyzersResources.MissingShebangInFileBasedProgramCodeFixTitle); + context.RegisterCodeFix(codeAction, context.Diagnostics); + } + + private static string GetEndOfLine(SourceText sourceText) + { + foreach (var line in sourceText.Lines) + { + if (line.End < line.EndIncludingLineBreak) + { + return sourceText.ToString(TextSpan.FromBounds(line.End, line.EndIncludingLineBreak)); + } + } + + return Environment.NewLine; + } + } +} diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.md b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.md index a7c98667b9b2..e778cf1f2452 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.md +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.md @@ -2751,7 +2751,7 @@ When a file-based program consists of multiple files, the entry point file shoul |Category|Usage| |Enabled|True| |Severity|Warning| -|CodeFix|False| +|CodeFix|True| --- ## [CA2300](https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2300): Do not use insecure deserializer BinaryFormatter diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx index 1749547f5bb1..fc5b697e918e 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx @@ -2225,4 +2225,7 @@ Widening and user defined conversions are not supported with generic types. File-based program entry point should start with '#!' + + Add '#!' (shebang) + diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.Fixer.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.Fixer.cs new file mode 100644 index 000000000000..0e2284174d9c --- /dev/null +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.Fixer.cs @@ -0,0 +1,14 @@ +// Copyright (c) Microsoft. All Rights Reserved. Licensed under the MIT license. See License.txt in the project root for license information. + +using System.Collections.Immutable; +using Microsoft.CodeAnalysis.CodeFixes; + +namespace Microsoft.NetCore.Analyzers.Usage +{ + public abstract class MissingShebangInFileBasedProgramFixer : CodeFixProvider + { + public override ImmutableArray FixableDiagnosticIds { get; } = ImmutableArray.Create(MissingShebangInFileBasedProgram.RuleId); + + public override FixAllProvider GetFixAllProvider() => WellKnownFixAllProviders.BatchFixer; + } +} diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf index c6a9793fd82b..03f1e965d7b2 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf @@ -1833,6 +1833,11 @@ Rozšíření a uživatelem definované převody se u obecných typů nepodporuj Metoda akce {0} musí explicitně určit druh požadavku HTTP. + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf index 64a5a2f79bfb..cbc4ff561ee1 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf @@ -1833,6 +1833,11 @@ Erweiterungen und benutzerdefinierte Konvertierungen werden bei generischen Type Die Aktionsmethode "{0}" muss die Art der HTTP-Anforderung explizit angeben. + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf index 900593b59fb3..5896354af2af 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf @@ -1833,6 +1833,11 @@ La ampliación y las conversiones definidas por el usuario no se admiten con tip El método de acción {0} debe especificar la variante de solicitud HTTP de forma explícita. + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf index 5f30a08ca809..bed19cb8e096 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf @@ -1833,6 +1833,11 @@ Les conversions étendues et définies par l’utilisateur ne sont pas prises en La méthode d'action {0} doit spécifier explicitement le genre de requête HTTP + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf index 0149236f47d9..ea2f9539b9a1 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf @@ -1833,6 +1833,11 @@ L'ampliamento e le conversioni definite dall'utente non sono supportate con tipi Il metodo di azione {0} deve specificare in modo esplicito il tipo della richiesta HTTP + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf index 54dba869429d..f37c847af7f9 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf @@ -1833,6 +1833,11 @@ Enumerable.OfType<T> で使用されるジェネリック型チェック ( アクション メソッド {0} では、HTTP 要求の種類を明示的に指定する必要があります + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf index a8006a1199e5..8575638e2767 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf @@ -1833,6 +1833,11 @@ Enumerable.OfType<T>에서 사용하는 제네릭 형식 검사(C# 'is' 작업 메서드 {0}은(는) HTTP 요청 종류를 명시적으로 지정해야 합니다. + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf index 8f765045a34d..0e7b13760bac 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf @@ -1833,6 +1833,11 @@ Konwersje poszerzane i zdefiniowane przez użytkownika nie są obsługiwane w pr Metoda akcji {0} musi jawnie określać rodzaj żądania HTTP + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf index c6ad03522b96..a3fc46da599c 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf @@ -1833,6 +1833,11 @@ As ampliação e conversões definidas pelo usuário não são compatíveis com O método de ação {0} precisa especificar explicitamente o tipo de solicitação HTTP + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf index e1d90c4e038c..e97cb8f514af 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf @@ -1833,6 +1833,11 @@ Widening and user defined conversions are not supported with generic types.В методе действия {0} необходимо явным образом указать тип HTTP-запроса/ + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf index f834b982f107..095fec929995 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf @@ -1833,6 +1833,11 @@ Genel türlerde genişletme ve kullanıcı tanımlı dönüştürmeler desteklen {0} eylem metodunun HTTP istek tipini açık olarak belirtmesi gerekir + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf index 6a5075b136b9..40cccfbb4381 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf @@ -1833,6 +1833,11 @@ Enumerable.OfType<T> 使用的泛型类型检查(C# 'is' operator/IL 'isin 操作方法 {0} 需要显式指定 HTTP 请求类型 + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf index bd41eeaa48ef..0e95e70cea6b 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf @@ -1833,6 +1833,11 @@ Enumerable.OfType<T> 使用的一般型別檢查 (C# 'is' operator/IL 'isi Action 方法 {0} 必須明確地指定 HTTP 要求種類 + + Add '#!' (shebang) + Add '#!' (shebang) + + When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files. diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/temp-Microsoft.CodeAnalysis.NetAnalyzers.sarif b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/temp-Microsoft.CodeAnalysis.NetAnalyzers.sarif new file mode 100644 index 000000000000..1d2bb3538904 --- /dev/null +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/temp-Microsoft.CodeAnalysis.NetAnalyzers.sarif @@ -0,0 +1,7115 @@ +{ + "$schema": "http://json.schemastore.org/sarif-1.0.0", + "version": "1.0.0", + "runs": [ + { + "tool": { + "name": "Microsoft.CodeAnalysis.CSharp.NetAnalyzers", + "version": "10.0.300", + "language": "en-US" + }, + "rules": { + "CA1032": { + "id": "CA1032", + "shortDescription": "Implement standard exception constructors", + "fullDescription": "Failure to provide the full set of constructors can make it difficult to correctly handle exceptions.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1032", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "CSharpImplementStandardExceptionConstructorsAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1200": { + "id": "CA1200", + "shortDescription": "Avoid using cref tags with a prefix", + "fullDescription": "Use of cref tags with prefixes should be avoided, since it prevents the compiler from verifying references and the IDE from updating references during refactorings. It is permissible to suppress this error at a single documentation site if the cref must use a prefix because the type being mentioned is not findable by the compiler. For example, if a cref is mentioning a special attribute in the full framework but you're in a file that compiles against the portable framework, or if you want to reference a type at higher layer of Roslyn, you should suppress the error. You should not suppress the error just because you want to take a shortcut and avoid using the full syntax.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1200", + "properties": { + "category": "Documentation", + "isEnabledByDefault": true, + "typeName": "CSharpAvoidUsingCrefTagsWithAPrefixAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1309": { + "id": "CA1309", + "shortDescription": "Use ordinal string comparison", + "fullDescription": "A string comparison operation that is nonlinguistic does not set the StringComparison parameter to either Ordinal or OrdinalIgnoreCase. By explicitly setting the parameter to either StringComparison.Ordinal or StringComparison.OrdinalIgnoreCase, your code often gains speed, becomes more correct, and becomes more reliable.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1309", + "properties": { + "category": "Globalization", + "isEnabledByDefault": true, + "typeName": "CSharpUseOrdinalStringComparisonAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1311": { + "id": "CA1311", + "shortDescription": "Specify a culture or use an invariant version", + "fullDescription": "Specify culture to help avoid accidental implicit dependency on current culture. Using an invariant version yields consistent results regardless of the culture of an application.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1311", + "properties": { + "category": "Globalization", + "isEnabledByDefault": true, + "typeName": "CSharpSpecifyCultureForToLowerAndToUpperAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1507": { + "id": "CA1507", + "shortDescription": "Use nameof to express symbol names", + "fullDescription": "Using nameof helps keep your code valid when refactoring.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1507", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": true, + "typeName": "CSharpUseNameofInPlaceOfStringAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1508": { + "id": "CA1508", + "shortDescription": "Avoid dead conditional code", + "fullDescription": "'{0}' is never '{1}'. Remove or refactor the condition(s) to avoid dead code.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1508", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": false, + "typeName": "CSharpAvoidDeadConditionalCode", + "languages": [ + "C#" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1515": { + "id": "CA1515", + "shortDescription": "Consider making public types internal", + "fullDescription": "Unlike a class library, an application's API isn't typically referenced publicly, so types can be marked internal.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1515", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": false, + "typeName": "CSharpMakeTypesInternal", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1516": { + "id": "CA1516", + "shortDescription": "Use cross-platform intrinsics", + "fullDescription": "This rule detects usage of platform-specific intrinsics that can be replaced with an equivalent cross-platform intrinsic instead.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1516", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": true, + "typeName": "CSharpUseCrossPlatformIntrinsicsAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1802": { + "id": "CA1802", + "shortDescription": "Use literals where appropriate", + "fullDescription": "A field is declared static and read-only (Shared and ReadOnly in Visual Basic), and is initialized by using a value that is computable at compile time. Because the value that is assigned to the targeted field is computable at compile time, change the declaration to a const (Const in Visual Basic) field so that the value is computed at compile time instead of at runtime.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1802", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "CSharpUseLiteralsWhereAppropriate", + "languages": [ + "C#" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1805": { + "id": "CA1805", + "shortDescription": "Do not initialize unnecessarily", + "fullDescription": "The .NET runtime initializes all fields of reference types to their default values before running the constructor. In most cases, explicitly initializing a field to its default value in a constructor is redundant, adding maintenance costs and potentially degrading performance (such as with increased assembly size), and the explicit initialization can be removed. In some cases, such as with static readonly fields that permanently retain their default value, consider instead changing them to be constants or properties.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1805", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpDoNotInitializeUnnecessarilyAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1812": { + "id": "CA1812", + "shortDescription": "Avoid uninstantiated internal classes", + "fullDescription": "An instance of an assembly-level type is not created by code in the assembly.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1812", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "CSharpAvoidUninstantiatedInternalClasses", + "languages": [ + "C#" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA1824": { + "id": "CA1824", + "shortDescription": "Mark assemblies with NeutralResourcesLanguageAttribute", + "fullDescription": "The NeutralResourcesLanguage attribute informs the ResourceManager of the language that was used to display the resources of a neutral culture for an assembly. This improves lookup performance for the first resource that you load and can reduce your working set.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1824", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpMarkAssembliesWithNeutralResourcesLanguageAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1825": { + "id": "CA1825", + "shortDescription": "Avoid zero-length array allocations", + "fullDescription": "Avoid unnecessary zero-length array allocations. Use {0} instead.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1825", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpAvoidZeroLengthArrayAllocationsAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1841": { + "id": "CA1841", + "shortDescription": "Prefer Dictionary.Contains methods", + "fullDescription": "Many dictionary implementations lazily initialize the Values collection. To avoid unnecessary allocations, prefer 'ContainsValue' over 'Values.Contains'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1841", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpPreferDictionaryContainsMethods", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1845": { + "id": "CA1845", + "shortDescription": "Use span-based 'string.Concat'", + "fullDescription": "It is more efficient to use 'AsSpan' and 'string.Concat', instead of 'Substring' and a concatenation operator.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1845", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpUseSpanBasedStringConcat", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1851": { + "id": "CA1851", + "shortDescription": "Possible multiple enumerations of 'IEnumerable' collection", + "fullDescription": "Possible multiple enumerations of 'IEnumerable' collection. Consider using an implementation that avoids multiple enumerations.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1851", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "CSharpAvoidMultipleEnumerationsAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1855": { + "id": "CA1855", + "shortDescription": "Prefer 'Clear' over 'Fill'", + "fullDescription": "It is more efficient to use 'Clear', instead of 'Fill' with default value.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1855", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpUseSpanClearInsteadOfFillAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1856": { + "id": "CA1856", + "shortDescription": "Incorrect usage of ConstantExpected attribute", + "fullDescription": "ConstantExpected attribute is not applied correctly on the parameter.", + "defaultLevel": "error", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1856", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpConstantExpectedAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1857": { + "id": "CA1857", + "shortDescription": "A constant is expected for the parameter", + "fullDescription": "The parameter expects a constant for optimal performance.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1857", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpConstantExpectedAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1865": { + "id": "CA1865", + "shortDescription": "Use char overload", + "fullDescription": "The char overload is a better performing overload than a string with a single char.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1865", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpUseStringMethodCharOverloadWithSingleCharacters", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1866": { + "id": "CA1866", + "shortDescription": "Use char overload", + "fullDescription": "The char overload is a better performing overload than a string with a single char.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1866", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpUseStringMethodCharOverloadWithSingleCharacters", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1867": { + "id": "CA1867", + "shortDescription": "Use char overload", + "fullDescription": "The char overload is a better performing overload than a string with a single char.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1867", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "CSharpUseStringMethodCharOverloadWithSingleCharacters", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1870": { + "id": "CA1870", + "shortDescription": "Use a cached 'SearchValues' instance", + "fullDescription": "Using a cached 'SearchValues' instance is more efficient than passing values to 'IndexOfAny'/'ContainsAny' directly.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1870", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "CSharpUseSearchValuesAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2014": { + "id": "CA2014", + "shortDescription": "Do not use stackalloc in loops", + "fullDescription": "Stack space allocated by a stackalloc is only released at the end of the current method's invocation. Using it in a loop can result in unbounded stack growth and eventual stack overflow conditions.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2014", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "CSharpDoNotUseStackallocInLoopsAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2016": { + "id": "CA2016", + "shortDescription": "Forward the 'CancellationToken' parameter to methods", + "fullDescription": "Forward the 'CancellationToken' parameter to methods to ensure the operation cancellation notifications gets properly propagated, or pass in 'CancellationToken.None' explicitly to indicate intentionally not propagating the token.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2016", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "CSharpForwardCancellationTokenToInvocationsAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2020": { + "id": "CA2020", + "shortDescription": "Prevent behavioral change", + "fullDescription": "Some built-in operators added in .NET 7 behave differently when overflowing than did the corresponding user-defined operators in .NET 6 and earlier versions. Some operators that previously threw in an unchecked context now don't throw unless wrapped within a checked context. Also, some operators that did not previously throw in a checked context now throw unless wrapped in an unchecked context.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2020", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "CSharpPreventNumericIntPtrUIntPtrBehavioralChanges", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2234": { + "id": "CA2234", + "shortDescription": "Pass system uri objects instead of strings", + "fullDescription": "A call is made to a method that has a string parameter whose name contains \"uri\", \"URI\", \"urn\", \"URN\", \"url\", or \"URL\". The declaring type of the method contains a corresponding method overload that has a System.Uri parameter.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2234", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "CSharpPassSystemUriObjectsInsteadOfStringsAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2252": { + "id": "CA2252", + "shortDescription": "This API requires opting into preview features", + "fullDescription": "An assembly has to opt into preview features before using them.", + "defaultLevel": "error", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2252", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "CSharpDetectPreviewFeatureAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2260": { + "id": "CA2260", + "shortDescription": "Use correct type parameter", + "fullDescription": "Generic math interfaces require the derived type itself to be used for the self recurring type parameter.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2260", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "CSharpImplementGenericMathInterfacesCorrectly", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2263": { + "id": "CA2263", + "shortDescription": "Prefer generic overload when type is known", + "fullDescription": "Using a generic overload is preferable to the 'System.Type' overload when the type is known, promoting cleaner and more type-safe code with improved compile-time checks.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2263", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "CSharpPreferGenericOverloadsAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2266": { + "id": "CA2266", + "shortDescription": "File-based program entry point should start with '#!'", + "fullDescription": "When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2266", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "CSharpMissingShebangInFileBasedProgram", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2352": { + "id": "CA2352", + "shortDescription": "Unsafe DataSet or DataTable in serializable type can be vulnerable to remote code execution attacks", + "fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2352", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "CSharpDataSetDataTableInSerializableTypeAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2353": { + "id": "CA2353", + "shortDescription": "Unsafe DataSet or DataTable in serializable type", + "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2353", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "CSharpDataSetDataTableInSerializableTypeAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2354": { + "id": "CA2354", + "shortDescription": "Unsafe DataSet or DataTable in deserialized object graph can be vulnerable to remote code execution attacks", + "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2354", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "CSharpDataSetDataTableInIFormatterSerializableObjectGraphAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2355": { + "id": "CA2355", + "shortDescription": "Unsafe DataSet or DataTable type found in deserializable object graph", + "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2355", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "CSharpDataSetDataTableInSerializableObjectGraphAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2356": { + "id": "CA2356", + "shortDescription": "Unsafe DataSet or DataTable type in web deserializable object graph", + "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2356", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "CSharpDataSetDataTableInWebSerializableObjectGraphAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2362": { + "id": "CA2362", + "shortDescription": "Unsafe DataSet or DataTable in auto-generated serializable type can be vulnerable to remote code execution attacks", + "fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the auto-generated type is never deserialized with untrusted data.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2362", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "CSharpDataSetDataTableInSerializableTypeAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + } + } + }, + { + "tool": { + "name": "Microsoft.CodeAnalysis.NetAnalyzers", + "version": "10.0.300", + "language": "en-US" + }, + "rules": { + "CA1000": { + "id": "CA1000", + "shortDescription": "Do not declare static members on generic types", + "fullDescription": "When a static member of a generic type is called, the type argument must be specified for the type. When a generic instance member that does not support inference is called, the type argument must be specified for the member. In these two cases, the syntax for specifying the type argument is different and easily confused.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1000", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "DoNotDeclareStaticMembersOnGenericTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1001": { + "id": "CA1001", + "shortDescription": "Types that own disposable fields should be disposable", + "fullDescription": "A class declares and implements an instance field that is a System.IDisposable type, and the class does not implement IDisposable. A class that declares an IDisposable field indirectly owns an unmanaged resource and should implement the IDisposable interface.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1001", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "TypesThatOwnDisposableFieldsShouldBeDisposableAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1002": { + "id": "CA1002", + "shortDescription": "Do not expose generic lists", + "fullDescription": "System.Collections.Generic.List is a generic collection that's designed for performance and not inheritance. List does not contain virtual members that make it easier to change the behavior of an inherited class.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1002", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "DoNotExposeGenericLists", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1003": { + "id": "CA1003", + "shortDescription": "Use generic event handler instances", + "fullDescription": "A type contains an event that declares an EventHandler delegate that returns void, whose signature contains two parameters (the first an object and the second a type that is assignable to EventArgs), and the containing assembly targets Microsoft .NET Framework?2.0.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1003", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "UseGenericEventHandlerInstancesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1005": { + "id": "CA1005", + "shortDescription": "Avoid excessive parameters on generic types", + "fullDescription": "The more type parameters a generic type contains, the more difficult it is to know and remember what each type parameter represents.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1005", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "AvoidExcessiveParametersOnGenericTypes", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry" + ] + } + }, + "CA1008": { + "id": "CA1008", + "shortDescription": "Enums should have zero value", + "fullDescription": "The default value of an uninitialized enumeration, just as other value types, is zero. A nonflags-attributed enumeration should define a member by using the value of zero so that the default value is a valid value of the enumeration. If an enumeration that has the FlagsAttribute attribute applied defines a zero-valued member, its name should be \"\"None\"\" to indicate that no values have been set in the enumeration.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1008", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "EnumsShouldHaveZeroValueAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode", + "RuleNoZero" + ] + } + }, + "CA1010": { + "id": "CA1010", + "shortDescription": "Generic interface should also be implemented", + "fullDescription": "To broaden the usability of a type, implement one of the generic interfaces. This is especially true for collections as they can then be used to populate generic collection types.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1010", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "CollectionsShouldImplementGenericInterfaceAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1012": { + "id": "CA1012", + "shortDescription": "Abstract types should not have public constructors", + "fullDescription": "Constructors on abstract types can be called only by derived types. Because public constructors create instances of a type, and you cannot create instances of an abstract type, an abstract type that has a public constructor is incorrectly designed.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1012", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "AbstractTypesShouldNotHaveConstructorsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1014": { + "id": "CA1014", + "shortDescription": "Mark assemblies with CLSCompliant", + "fullDescription": "The Common Language Specification (CLS) defines naming restrictions, data types, and rules to which assemblies must conform if they will be used across programming languages. Good design dictates that all assemblies explicitly indicate CLS compliance by using CLSCompliantAttribute . If this attribute is not present on an assembly, the assembly is not compliant.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1014", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "MarkAssembliesWithAttributesDiagnosticAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "CompilationEnd" + ] + } + }, + "CA1016": { + "id": "CA1016", + "shortDescription": "Mark assemblies with assembly version", + "fullDescription": "The .NET Framework uses the version number to uniquely identify an assembly, and to bind to types in strongly named assemblies. The version number is used together with version and publisher policy. By default, applications run only with the assembly version with which they were built.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1016", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "MarkAssembliesWithAttributesDiagnosticAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA1017": { + "id": "CA1017", + "shortDescription": "Mark assemblies with ComVisible", + "fullDescription": "ComVisibleAttribute determines how COM clients access managed code. Good design dictates that assemblies explicitly indicate COM visibility. COM visibility can be set for the whole assembly and then overridden for individual types and type members. If this attribute is not present, the contents of the assembly are visible to COM clients.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1017", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "MarkAssembliesWithComVisibleAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "CompilationEnd" + ] + } + }, + "CA1018": { + "id": "CA1018", + "shortDescription": "Mark attributes with AttributeUsageAttribute", + "fullDescription": "Specify AttributeUsage on {0}", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1018", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "MarkAttributesWithAttributeUsageAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1019": { + "id": "CA1019", + "shortDescription": "Define accessors for attribute arguments", + "fullDescription": "Remove the property setter from {0} or reduce its accessibility because it corresponds to positional argument {1}", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1019", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "DefineAccessorsForAttributeArgumentsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1021": { + "id": "CA1021", + "shortDescription": "Avoid out parameters", + "fullDescription": "Passing types by reference (using 'out' or 'ref') requires experience with pointers, understanding how value types and reference types differ, and handling methods with multiple return values. Also, the difference between 'out' and 'ref' parameters is not widely understood.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1021", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "AvoidOutParameters", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry" + ] + } + }, + "CA1024": { + "id": "CA1024", + "shortDescription": "Use properties where appropriate", + "fullDescription": "A public or protected method has a name that starts with \"\"Get\"\", takes no parameters, and returns a value that is not an array. The method might be a good candidate to become a property.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1024", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "UsePropertiesWhereAppropriateAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1027": { + "id": "CA1027", + "shortDescription": "Mark enums with FlagsAttribute", + "fullDescription": "An enumeration is a value type that defines a set of related named constants. Apply FlagsAttribute to an enumeration when its named constants can be meaningfully combined.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1027", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "EnumWithFlagsAttributeAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1028": { + "id": "CA1028", + "shortDescription": "Enum Storage should be Int32", + "fullDescription": "An enumeration is a value type that defines a set of related named constants. By default, the System.Int32 data type is used to store the constant value. Although you can change this underlying type, it is not required or recommended for most scenarios.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1028", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "EnumStorageShouldBeInt32Analyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1030": { + "id": "CA1030", + "shortDescription": "Use events where appropriate", + "fullDescription": "This rule detects methods that have names that ordinarily would be used for events. If a method is called in response to a clearly defined state change, the method should be invoked by an event handler. Objects that call the method should raise events instead of calling the method directly.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1030", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "UseEventsWhereAppropriateAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1031": { + "id": "CA1031", + "shortDescription": "Do not catch general exception types", + "fullDescription": "A general exception such as System.Exception or System.SystemException or a disallowed exception type is caught in a catch statement, or a general catch clause is used. General and disallowed exceptions should not be caught.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1031", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "DoNotCatchGeneralExceptionTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1033": { + "id": "CA1033", + "shortDescription": "Interface methods should be callable by child types", + "fullDescription": "An unsealed externally visible type provides an explicit method implementation of a public interface and does not provide an alternative externally visible method that has the same name.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1033", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "InterfaceMethodsShouldBeCallableByChildTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1034": { + "id": "CA1034", + "shortDescription": "Nested types should not be visible", + "fullDescription": "A nested type is a type that is declared in the scope of another type. Nested types are useful to encapsulate private implementation details of the containing type. Used for this purpose, nested types should not be externally visible.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1034", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "NestedTypesShouldNotBeVisibleAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1036": { + "id": "CA1036", + "shortDescription": "Override methods on comparable types", + "fullDescription": "A public or protected type implements the System.IComparable interface. It does not override Object.Equals nor does it overload the language-specific operator for equality, inequality, less than, less than or equal, greater than or greater than or equal.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1036", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "OverrideMethodsOnComparableTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1040": { + "id": "CA1040", + "shortDescription": "Avoid empty interfaces", + "fullDescription": "Interfaces define members that provide a behavior or usage contract. The functionality that is described by the interface can be adopted by any type, regardless of where the type appears in the inheritance hierarchy. A type implements an interface by providing implementations for the members of the interface. An empty interface does not define any members; therefore, it does not define a contract that can be implemented.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1040", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "AvoidEmptyInterfacesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1041": { + "id": "CA1041", + "shortDescription": "Provide ObsoleteAttribute message", + "fullDescription": "A type or member is marked by using a System.ObsoleteAttribute attribute that does not have its ObsoleteAttribute.Message property specified. When a type or member that is marked by using ObsoleteAttribute is compiled, the Message property of the attribute is displayed. This gives the user information about the obsolete type or member.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1041", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "ProvideObsoleteAttributeMessageAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1043": { + "id": "CA1043", + "shortDescription": "Use Integral Or String Argument For Indexers", + "fullDescription": "Indexers, that is, indexed properties, should use integer or string types for the index. These types are typically used for indexing data structures and increase the usability of the library. Use of the Object type should be restricted to those cases where the specific integer or string type cannot be specified at design time. If the design requires other types for the index, reconsider whether the type represents a logical data store. If it does not represent a logical data store, use a method.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1043", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "UseIntegralOrStringArgumentForIndexersAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1044": { + "id": "CA1044", + "shortDescription": "Properties should not be write only", + "fullDescription": "Although it is acceptable and often necessary to have a read-only property, the design guidelines prohibit the use of write-only properties. This is because letting a user set a value, and then preventing the user from viewing that value, does not provide any security. Also, without read access, the state of shared objects cannot be viewed, which limits their usefulness.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1044", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "PropertiesShouldNotBeWriteOnlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1045": { + "id": "CA1045", + "shortDescription": "Do not pass types by reference", + "fullDescription": "Passing types by reference (using out or ref) requires experience with pointers, understanding how value types and reference types differ, and handling methods that have multiple return values. Also, the difference between out and ref parameters is not widely understood.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1045", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "DoNotPassTypesByReference", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry" + ] + } + }, + "CA1046": { + "id": "CA1046", + "shortDescription": "Do not overload equality operator on reference types", + "fullDescription": "For reference types, the default implementation of the equality operator is almost always correct. By default, two references are equal only if they point to the same object. If the operator is providing meaningful value equality, the type should implement the generic 'System.IEquatable' interface.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1046", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "DoNotOverloadOperatorEqualsOnReferenceTypes", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1047": { + "id": "CA1047", + "shortDescription": "Do not declare protected member in sealed type", + "fullDescription": "Types declare protected members so that inheriting types can access or override the member. By definition, you cannot inherit from a sealed type, which means that protected methods on sealed types cannot be called.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1047", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "DoNotDeclareProtectedMembersInSealedTypes", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1050": { + "id": "CA1050", + "shortDescription": "Declare types in namespaces", + "fullDescription": "Types are declared in namespaces to prevent name collisions and as a way to organize related types in an object hierarchy.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1050", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "DeclareTypesInNamespacesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1051": { + "id": "CA1051", + "shortDescription": "Do not declare visible instance fields", + "fullDescription": "The primary use of a field should be as an implementation detail. Fields should be private or internal and should be exposed by using properties.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1051", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "DoNotDeclareVisibleInstanceFieldsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1052": { + "id": "CA1052", + "shortDescription": "Static holder types should be Static or NotInheritable", + "fullDescription": "Type '{0}' is a static holder type but is neither static nor NotInheritable", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1052", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "StaticHolderTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1054": { + "id": "CA1054", + "shortDescription": "URI-like parameters should not be strings", + "fullDescription": "This rule assumes that the parameter represents a Uniform Resource Identifier (URI). A string representation or a URI is prone to parsing and encoding errors, and can lead to security vulnerabilities. 'System.Uri' class provides these services in a safe and secure manner.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1054", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "UriParametersShouldNotBeStringsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1055": { + "id": "CA1055", + "shortDescription": "URI-like return values should not be strings", + "fullDescription": "This rule assumes that the method returns a URI. A string representation of a URI is prone to parsing and encoding errors, and can lead to security vulnerabilities. The System.Uri class provides these services in a safe and secure manner.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1055", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "UriReturnValuesShouldNotBeStringsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1056": { + "id": "CA1056", + "shortDescription": "URI-like properties should not be strings", + "fullDescription": "This rule assumes that the property represents a Uniform Resource Identifier (URI). A string representation of a URI is prone to parsing and encoding errors, and can lead to security vulnerabilities. The System.Uri class provides these services in a safe and secure manner.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1056", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "UriPropertiesShouldNotBeStringsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1058": { + "id": "CA1058", + "shortDescription": "Types should not extend certain base types", + "fullDescription": "An externally visible type extends certain base types. Use one of the alternatives.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1058", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "TypesShouldNotExtendCertainBaseTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1060": { + "id": "CA1060", + "shortDescription": "Move pinvokes to native methods class", + "fullDescription": "Platform Invocation methods, such as those that are marked by using the System.Runtime.InteropServices.DllImportAttribute attribute, or methods that are defined by using the Declare keyword in Visual Basic, access unmanaged code. These methods should be of the NativeMethods, SafeNativeMethods, or UnsafeNativeMethods class.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1060", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "MovePInvokesToNativeMethodsClassAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry" + ] + } + }, + "CA1061": { + "id": "CA1061", + "shortDescription": "Do not hide base class methods", + "fullDescription": "A method in a base type is hidden by an identically named method in a derived type when the parameter signature of the derived method differs only by types that are more weakly derived than the corresponding types in the parameter signature of the base method.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1061", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "DoNotHideBaseClassMethodsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1062": { + "id": "CA1062", + "shortDescription": "Validate arguments of public methods", + "fullDescription": "An externally visible method dereferences one of its reference arguments without verifying whether that argument is 'null' ('Nothing' in Visual Basic). All reference arguments that are passed to externally visible methods should be checked against 'null'. If appropriate, throw an 'ArgumentNullException' when the argument is 'null'. If the method is designed to be called only by known assemblies, you should make the method internal.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1062", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "ValidateArgumentsOfPublicMethods", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1063": { + "id": "CA1063", + "shortDescription": "Implement IDisposable Correctly", + "fullDescription": "All IDisposable types should implement the Dispose pattern correctly.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1063", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "ImplementIDisposableCorrectlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1064": { + "id": "CA1064", + "shortDescription": "Exceptions should be public", + "fullDescription": "An internal exception is visible only inside its own internal scope. After the exception falls outside the internal scope, only the base exception can be used to catch the exception. If the internal exception is inherited from T:System.Exception, T:System.SystemException, or T:System.ApplicationException, the external code will not have sufficient information to know what to do with the exception.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1064", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "ExceptionsShouldBePublicAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1065": { + "id": "CA1065", + "shortDescription": "Do not raise exceptions in unexpected locations", + "fullDescription": "A method that is not expected to throw exceptions throws an exception.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1065", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "DoNotRaiseExceptionsInUnexpectedLocationsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1066": { + "id": "CA1066", + "shortDescription": "Implement IEquatable when overriding Object.Equals", + "fullDescription": "When a type T overrides Object.Equals(object), the implementation must cast the object argument to the correct type T before performing the comparison. If the type implements IEquatable, and therefore offers the method T.Equals(T), and if the argument is known at compile time to be of type T, then the compiler can call IEquatable.Equals(T) instead of Object.Equals(object), and no cast is necessary, improving performance.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1066", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "EquatableAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1067": { + "id": "CA1067", + "shortDescription": "Override Object.Equals(object) when implementing IEquatable", + "fullDescription": "When a type T implements the interface IEquatable, it suggests to a user who sees a call to the Equals method in source code that an instance of the type can be equated with an instance of any other type. The user might be confused if their attempt to equate the type with an instance of another type fails to compile. This violates the \"principle of least surprise\".", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1067", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "EquatableAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1068": { + "id": "CA1068", + "shortDescription": "CancellationToken parameters must come last", + "fullDescription": "Method '{0}' should take CancellationToken as the last parameter", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1068", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "CancellationTokenParametersMustComeLastAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1069": { + "id": "CA1069", + "shortDescription": "Enums values should not be duplicated", + "fullDescription": "The field reference '{0}' is duplicated in this bitwise initialization", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1069", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "EnumShouldNotHaveDuplicatedValues", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1070": { + "id": "CA1070", + "shortDescription": "Do not declare event fields as virtual", + "fullDescription": "Do not declare virtual events in a base class. Overridden events in a derived class have undefined behavior. The C# compiler does not handle this correctly and it is unpredictable whether a subscriber to the derived event will actually be subscribing to the base class event.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1070", + "properties": { + "category": "Design", + "isEnabledByDefault": true, + "typeName": "DoNotDeclareEventFieldsAsVirtual", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1303": { + "id": "CA1303", + "shortDescription": "Do not pass literals as localized parameters", + "fullDescription": "A method passes a string literal as a parameter to a constructor or method in the .NET Framework class library and that string should be localizable. To fix a violation of this rule, replace the string literal with a string retrieved through an instance of the ResourceManager class.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1303", + "properties": { + "category": "Globalization", + "isEnabledByDefault": false, + "typeName": "DoNotPassLiteralsAsLocalizedParameters", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1304": { + "id": "CA1304", + "shortDescription": "Specify CultureInfo", + "fullDescription": "A method or constructor calls a member that has an overload that accepts a System.Globalization.CultureInfo parameter, and the method or constructor does not call the overload that takes the CultureInfo parameter. When a CultureInfo or System.IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales. If the result will be displayed to the user, specify 'CultureInfo.CurrentCulture' as the 'CultureInfo' parameter. Otherwise, if the result will be stored and accessed by software, such as when it is persisted to disk or to a database, specify 'CultureInfo.InvariantCulture'.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1304", + "properties": { + "category": "Globalization", + "isEnabledByDefault": true, + "typeName": "SpecifyCultureInfoAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1305": { + "id": "CA1305", + "shortDescription": "Specify IFormatProvider", + "fullDescription": "A method or constructor calls one or more members that have overloads that accept a System.IFormatProvider parameter, and the method or constructor does not call the overload that takes the IFormatProvider parameter. When a System.Globalization.CultureInfo or IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales. If the result will be based on the input from/output displayed to the user, specify 'CultureInfo.CurrentCulture' as the 'IFormatProvider'. Otherwise, if the result will be stored and accessed by software, such as when it is loaded from disk/database and when it is persisted to disk/database, specify 'CultureInfo.InvariantCulture'.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1305", + "properties": { + "category": "Globalization", + "isEnabledByDefault": true, + "typeName": "SpecifyIFormatProviderAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1307": { + "id": "CA1307", + "shortDescription": "Specify StringComparison for clarity", + "fullDescription": "A string comparison operation uses a method overload that does not set a StringComparison parameter. It is recommended to use the overload with StringComparison parameter for clarity of intent. If the result will be displayed to the user, such as when sorting a list of items for display in a list box, specify 'StringComparison.CurrentCulture' or 'StringComparison.CurrentCultureIgnoreCase' as the 'StringComparison' parameter. If comparing case-insensitive identifiers, such as file paths, environment variables, or registry keys and values, specify 'StringComparison.OrdinalIgnoreCase'. Otherwise, if comparing case-sensitive identifiers, specify 'StringComparison.Ordinal'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1307", + "properties": { + "category": "Globalization", + "isEnabledByDefault": false, + "typeName": "SpecifyStringComparisonAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1308": { + "id": "CA1308", + "shortDescription": "Normalize strings to uppercase", + "fullDescription": "Strings should be normalized to uppercase. A small group of characters cannot make a round trip when they are converted to lowercase. To make a round trip means to convert the characters from one locale to another locale that represents character data differently, and then to accurately retrieve the original characters from the converted characters.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1308", + "properties": { + "category": "Globalization", + "isEnabledByDefault": false, + "typeName": "NormalizeStringsToUppercaseAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1310": { + "id": "CA1310", + "shortDescription": "Specify StringComparison for correctness", + "fullDescription": "A string comparison operation uses a method overload that does not set a StringComparison parameter, hence its behavior could vary based on the current user's locale settings. It is strongly recommended to use the overload with StringComparison parameter for correctness and clarity of intent. If the result will be displayed to the user, such as when sorting a list of items for display in a list box, specify 'StringComparison.CurrentCulture' or 'StringComparison.CurrentCultureIgnoreCase' as the 'StringComparison' parameter. If comparing case-insensitive identifiers, such as file paths, environment variables, or registry keys and values, specify 'StringComparison.OrdinalIgnoreCase'. Otherwise, if comparing case-sensitive identifiers, specify 'StringComparison.Ordinal'.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1310", + "properties": { + "category": "Globalization", + "isEnabledByDefault": true, + "typeName": "SpecifyStringComparisonAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1401": { + "id": "CA1401", + "shortDescription": "P/Invokes should not be visible", + "fullDescription": "A public or protected method in a public type has the System.Runtime.InteropServices.DllImportAttribute attribute (also implemented by the Declare keyword in Visual Basic). Such methods should not be exposed.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1401", + "properties": { + "category": "Interoperability", + "isEnabledByDefault": true, + "typeName": "PInvokeDiagnosticAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1416": { + "id": "CA1416", + "shortDescription": "Validate platform compatibility", + "fullDescription": "Using platform dependent API on a component makes the code no longer work across all platforms.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1416", + "properties": { + "category": "Interoperability", + "isEnabledByDefault": true, + "typeName": "PlatformCompatibilityAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1417": { + "id": "CA1417", + "shortDescription": "Do not use 'OutAttribute' on string parameters for P/Invokes", + "fullDescription": "String parameters passed by value with the 'OutAttribute' can destabilize the runtime if the string is an interned string.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1417", + "properties": { + "category": "Interoperability", + "isEnabledByDefault": true, + "typeName": "DoNotUseOutAttributeStringPInvokeParametersAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1418": { + "id": "CA1418", + "shortDescription": "Use valid platform string", + "fullDescription": "Platform compatibility analyzer requires a valid platform name and version.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1418", + "properties": { + "category": "Interoperability", + "isEnabledByDefault": true, + "typeName": "UseValidPlatformString", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1419": { + "id": "CA1419", + "shortDescription": "Provide a parameterless constructor that is as visible as the containing type for concrete types derived from 'System.Runtime.InteropServices.SafeHandle'", + "fullDescription": "Providing a parameterless constructor that is as visible as the containing type for a type derived from 'System.Runtime.InteropServices.SafeHandle' enables better performance and usage with source-generated interop solutions.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1419", + "properties": { + "category": "Interoperability", + "isEnabledByDefault": true, + "typeName": "ProvidePublicParameterlessSafeHandleConstructorAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1420": { + "id": "CA1420", + "shortDescription": "Property, type, or attribute requires runtime marshalling", + "fullDescription": "Using features that require runtime marshalling when runtime marshalling is disabled will result in runtime exceptions.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1420", + "properties": { + "category": "Interoperability", + "isEnabledByDefault": true, + "typeName": "DisableRuntimeMarshallingAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1421": { + "id": "CA1421", + "shortDescription": "This method uses runtime marshalling even when the 'DisableRuntimeMarshallingAttribute' is applied", + "fullDescription": "This method uses runtime marshalling even when runtime marshalling is disabled, which can cause unexpected behavior differences at runtime due to different expectations of a type's native layout.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1421", + "properties": { + "category": "Interoperability", + "isEnabledByDefault": true, + "typeName": "DisableRuntimeMarshallingAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1422": { + "id": "CA1422", + "shortDescription": "Validate platform compatibility", + "fullDescription": "Using platform dependent API on a component makes the code no longer work across all platforms.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1422", + "properties": { + "category": "Interoperability", + "isEnabledByDefault": true, + "typeName": "PlatformCompatibilityAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1501": { + "id": "CA1501", + "shortDescription": "Avoid excessive inheritance", + "fullDescription": "Deeply nested type hierarchies can be difficult to follow, understand, and maintain. This rule limits analysis to hierarchies in the same module. To fix a violation of this rule, derive the type from a base type that is less deep in the inheritance hierarchy or eliminate some of the intermediate base types.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1501", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": false, + "typeName": "CodeMetricsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "CompilationEnd" + ] + } + }, + "CA1502": { + "id": "CA1502", + "shortDescription": "Avoid excessive complexity", + "fullDescription": "Cyclomatic complexity measures the number of linearly independent paths through the method, which is determined by the number and complexity of conditional branches. A low cyclomatic complexity generally indicates a method that is easy to understand, test, and maintain. The cyclomatic complexity is calculated from a control flow graph of the method and is given as follows: `cyclomatic complexity = the number of edges - the number of nodes + 1`, where a node represents a logic branch point and an edge represents a line between nodes.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1502", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": false, + "typeName": "CodeMetricsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "CompilationEnd" + ] + } + }, + "CA1505": { + "id": "CA1505", + "shortDescription": "Avoid unmaintainable code", + "fullDescription": "The maintainability index is calculated by using the following metrics: lines of code, program volume, and cyclomatic complexity. Program volume is a measure of the difficulty of understanding of a symbol that is based on the number of operators and operands in the code. Cyclomatic complexity is a measure of the structural complexity of the type or method. A low maintainability index indicates that code is probably difficult to maintain and would be a good candidate to redesign.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1505", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": false, + "typeName": "CodeMetricsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "CompilationEnd" + ] + } + }, + "CA1506": { + "id": "CA1506", + "shortDescription": "Avoid excessive class coupling", + "fullDescription": "This rule measures class coupling by counting the number of unique type references that a symbol contains. Symbols that have a high degree of class coupling can be difficult to maintain. It is a good practice to have types and methods that exhibit low coupling and high cohesion. To fix this violation, try to redesign the code to reduce the number of types to which it is coupled.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1506", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": false, + "typeName": "CodeMetricsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "CompilationEnd" + ] + } + }, + "CA1509": { + "id": "CA1509", + "shortDescription": "Invalid entry in code metrics rule specification file", + "fullDescription": "Invalid entry in code metrics rule specification file.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1509", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": false, + "typeName": "CodeMetricsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "CompilationEnd" + ] + } + }, + "CA1510": { + "id": "CA1510", + "shortDescription": "Use ArgumentNullException throw helper", + "fullDescription": "Throw helpers are simpler and more efficient than an if block constructing a new exception instance.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1510", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": true, + "typeName": "UseExceptionThrowHelpers", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1511": { + "id": "CA1511", + "shortDescription": "Use ArgumentException throw helper", + "fullDescription": "Throw helpers are simpler and more efficient than an if block constructing a new exception instance.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1511", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": true, + "typeName": "UseExceptionThrowHelpers", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1512": { + "id": "CA1512", + "shortDescription": "Use ArgumentOutOfRangeException throw helper", + "fullDescription": "Throw helpers are simpler and more efficient than an if block constructing a new exception instance.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1512", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": true, + "typeName": "UseExceptionThrowHelpers", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1513": { + "id": "CA1513", + "shortDescription": "Use ObjectDisposedException throw helper", + "fullDescription": "Throw helpers are simpler and more efficient than an if block constructing a new exception instance.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1513", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": true, + "typeName": "UseExceptionThrowHelpers", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1514": { + "id": "CA1514", + "shortDescription": "Avoid redundant length argument", + "fullDescription": "An explicit length calculation can be error-prone and can be avoided when slicing to end of the buffer.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1514", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": true, + "typeName": "AvoidLengthCalculationWhenSlicingToEndAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1700": { + "id": "CA1700", + "shortDescription": "Do not name enum values 'Reserved'", + "fullDescription": "This rule assumes that an enumeration member that has a name that contains \"reserved\" is not currently used but is a placeholder to be renamed or removed in a future version. Renaming or removing a member is a breaking change.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1700", + "properties": { + "category": "Naming", + "isEnabledByDefault": false, + "typeName": "DoNotNameEnumValuesReserved", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1707": { + "id": "CA1707", + "shortDescription": "Identifiers should not contain underscores", + "fullDescription": "By convention, identifier names do not contain the underscore (_) character. This rule checks namespaces, types, members, and parameters.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1707", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "IdentifiersShouldNotContainUnderscoresAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1708": { + "id": "CA1708", + "shortDescription": "Identifiers should differ by more than case", + "fullDescription": "Identifiers for namespaces, types, members, and parameters cannot differ only by case because languages that target the common language runtime are not required to be case-sensitive.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1708", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "IdentifiersShouldDifferByMoreThanCaseAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1710": { + "id": "CA1710", + "shortDescription": "Identifiers should have correct suffix", + "fullDescription": "By convention, the names of types that extend certain base types or that implement certain interfaces, or types that are derived from these types, have a suffix that is associated with the base type or interface.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1710", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "IdentifiersShouldHaveCorrectSuffixAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1711": { + "id": "CA1711", + "shortDescription": "Identifiers should not have incorrect suffix", + "fullDescription": "By convention, only the names of types that extend certain base types or that implement certain interfaces, or types that are derived from these types, should end with specific reserved suffixes. Other type names should not use these reserved suffixes.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1711", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "IdentifiersShouldNotHaveIncorrectSuffixAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1712": { + "id": "CA1712", + "shortDescription": "Do not prefix enum values with type name", + "fullDescription": "An enumeration's values should not start with the type name of the enumeration.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1712", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "DoNotPrefixEnumValuesWithTypeNameAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1713": { + "id": "CA1713", + "shortDescription": "Events should not have 'Before' or 'After' prefix", + "fullDescription": "Event names should describe the action that raises the event. To name related events that are raised in a specific sequence, use the present or past tense to indicate the relative position in the sequence of actions. For example, when naming a pair of events that is raised when closing a resource, you might name it 'Closing' and 'Closed', instead of 'BeforeClose' and 'AfterClose'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1713", + "properties": { + "category": "Naming", + "isEnabledByDefault": false, + "typeName": "EventsShouldNotHaveBeforeOrAfterPrefix", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1715": { + "id": "CA1715", + "shortDescription": "Identifiers should have correct prefix", + "fullDescription": "The name of an externally visible interface does not start with an uppercase \"\"I\"\". The name of a generic type parameter on an externally visible type or method does not start with an uppercase \"\"T\"\".", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1715", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "IdentifiersShouldHaveCorrectPrefixAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1716": { + "id": "CA1716", + "shortDescription": "Identifiers should not match keywords", + "fullDescription": "A namespace name or a type name matches a reserved keyword in a programming language. Identifiers for namespaces and types should not match keywords that are defined by languages that target the common language runtime.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1716", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "IdentifiersShouldNotMatchKeywordsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1720": { + "id": "CA1720", + "shortDescription": "Identifier contains type name", + "fullDescription": "Names of parameters and members are better used to communicate their meaning than to describe their type, which is expected to be provided by development tools. For names of members, if a data type name must be used, use a language-independent name instead of a language-specific one.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1720", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "IdentifiersShouldNotContainTypeNames", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1721": { + "id": "CA1721", + "shortDescription": "Property names should not match get methods", + "fullDescription": "The name of a public or protected member starts with \"\"Get\"\" and otherwise matches the name of a public or protected property. \"\"Get\"\" methods and properties should have names that clearly distinguish their function.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1721", + "properties": { + "category": "Naming", + "isEnabledByDefault": false, + "typeName": "PropertyNamesShouldNotMatchGetMethodsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1724": { + "id": "CA1724", + "shortDescription": "Type names should not match namespaces", + "fullDescription": "Type names should not match the names of namespaces that are defined in the .NET Framework class library. Violating this rule can reduce the usability of the library.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1724", + "properties": { + "category": "Naming", + "isEnabledByDefault": false, + "typeName": "TypeNamesShouldNotMatchNamespacesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA1725": { + "id": "CA1725", + "shortDescription": "Parameter names should match base declaration", + "fullDescription": "Consistent naming of parameters in an override hierarchy increases the usability of the method overrides. A parameter name in a derived method that differs from the name in the base declaration can cause confusion about whether the method is an override of the base method or a new overload of the method.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1725", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "ParameterNamesShouldMatchBaseDeclarationAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1727": { + "id": "CA1727", + "shortDescription": "Use PascalCase for named placeholders", + "fullDescription": "Use PascalCase for named placeholders in the logging message template.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1727", + "properties": { + "category": "Naming", + "isEnabledByDefault": true, + "typeName": "LoggerMessageDefineAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1806": { + "id": "CA1806", + "shortDescription": "Do not ignore method results", + "fullDescription": "A new object is created but never used; or a method that creates and returns a new string is called and the new string is never used; or a COM or P/Invoke method returns an HRESULT or error code that is never used.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1806", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "DoNotIgnoreMethodResultsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1810": { + "id": "CA1810", + "shortDescription": "Initialize reference type static fields inline", + "fullDescription": "A reference type declares an explicit static constructor. To fix a violation of this rule, initialize all static data when it is declared and remove the static constructor.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1810", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "InitializeStaticFieldsInlineAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1813": { + "id": "CA1813", + "shortDescription": "Avoid unsealed attributes", + "fullDescription": "The .NET Framework class library provides methods for retrieving custom attributes. By default, these methods search the attribute inheritance hierarchy. Sealing the attribute eliminates the search through the inheritance hierarchy and can improve performance.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1813", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "AvoidUnsealedAttributesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1814": { + "id": "CA1814", + "shortDescription": "Prefer jagged arrays over multidimensional", + "fullDescription": "A jagged array is an array whose elements are arrays. The arrays that make up the elements can be of different sizes, leading to less wasted space for some sets of data.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1814", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "PreferJaggedArraysOverMultidimensionalAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1815": { + "id": "CA1815", + "shortDescription": "Override equals and operator equals on value types", + "fullDescription": "For value types, the inherited implementation of Equals uses the Reflection library and compares the contents of all fields. Reflection is computationally expensive, and comparing every field for equality might be unnecessary. If you expect users to compare or sort instances, or to use instances as hash table keys, your value type should implement Equals.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1815", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "OverrideEqualsAndOperatorEqualsOnValueTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1816": { + "id": "CA1816", + "shortDescription": "Dispose methods should call SuppressFinalize", + "fullDescription": "A method that is an implementation of Dispose does not call GC.SuppressFinalize; or a method that is not an implementation of Dispose calls GC.SuppressFinalize; or a method calls GC.SuppressFinalize and passes something other than this (Me in Visual Basic).", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1816", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "CallGCSuppressFinalizeCorrectlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1819": { + "id": "CA1819", + "shortDescription": "Properties should not return arrays", + "fullDescription": "Arrays that are returned by properties are not write-protected, even when the property is read-only. To keep the array tamper-proof, the property must return a copy of the array. Typically, users will not understand the adverse performance implications of calling such a property.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1819", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "PropertiesShouldNotReturnArraysAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1820": { + "id": "CA1820", + "shortDescription": "Test for empty strings using string length", + "fullDescription": "Comparing strings by using the String.Length property or the String.IsNullOrEmpty method is significantly faster than using Equals.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1820", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "TestForEmptyStringsUsingStringLengthAnalyzer", + "languages": [ + "C#" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1821": { + "id": "CA1821", + "shortDescription": "Remove empty Finalizers", + "fullDescription": "Finalizers should be avoided where possible, to avoid the additional performance overhead involved in tracking object lifetime.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1821", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "RemoveEmptyFinalizersAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1822": { + "id": "CA1822", + "shortDescription": "Mark members as static", + "fullDescription": "Members that do not access instance data or call instance methods can be marked as static. After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1822", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "MarkMembersAsStaticAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1823": { + "id": "CA1823", + "shortDescription": "Avoid unused private fields", + "fullDescription": "Private fields were detected that do not appear to be accessed in the assembly.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1823", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "AvoidUnusedPrivateFieldsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1826": { + "id": "CA1826", + "shortDescription": "Do not use Enumerable methods on indexable collections", + "fullDescription": "This collection is directly indexable. Going through LINQ here causes unnecessary allocations and CPU work.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1826", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "DoNotUseEnumerableMethodsOnIndexableCollectionsInsteadUseTheCollectionDirectlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1827": { + "id": "CA1827", + "shortDescription": "Do not use Count() or LongCount() when Any() can be used", + "fullDescription": "For non-empty collections, Count() and LongCount() enumerate the entire sequence, while Any() stops at the first item or the first item that satisfies a condition.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1827", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseCountProperlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1828": { + "id": "CA1828", + "shortDescription": "Do not use CountAsync() or LongCountAsync() when AnyAsync() can be used", + "fullDescription": "For non-empty collections, CountAsync() and LongCountAsync() enumerate the entire sequence, while AnyAsync() stops at the first item or the first item that satisfies a condition.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1828", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseCountProperlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1829": { + "id": "CA1829", + "shortDescription": "Use Length/Count property instead of Count() when available", + "fullDescription": "Enumerable.Count() potentially enumerates the sequence while a Length/Count property is a direct access.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1829", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseCountProperlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1830": { + "id": "CA1830", + "shortDescription": "Prefer strongly-typed Append and Insert method overloads on StringBuilder", + "fullDescription": "StringBuilder.Append and StringBuilder.Insert provide overloads for multiple types beyond System.String. When possible, prefer the strongly-typed overloads over using ToString() and the string-based overload.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1830", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "PreferTypedStringBuilderAppendOverloads", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1831": { + "id": "CA1831", + "shortDescription": "Use AsSpan or AsMemory instead of Range-based indexers when appropriate", + "fullDescription": "The Range-based indexer on string values produces a copy of requested portion of the string. This copy is usually unnecessary when it is implicitly used as a ReadOnlySpan or ReadOnlyMemory value. Use the AsSpan method to avoid the unnecessary copy.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1831", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseAsSpanInsteadOfRangeIndexerAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1832": { + "id": "CA1832", + "shortDescription": "Use AsSpan or AsMemory instead of Range-based indexers when appropriate", + "fullDescription": "The Range-based indexer on array values produces a copy of requested portion of the array. This copy is usually unnecessary when it is implicitly used as a ReadOnlySpan or ReadOnlyMemory value. Use the AsSpan method to avoid the unnecessary copy.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1832", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseAsSpanInsteadOfRangeIndexerAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1833": { + "id": "CA1833", + "shortDescription": "Use AsSpan or AsMemory instead of Range-based indexers when appropriate", + "fullDescription": "The Range-based indexer on array values produces a copy of requested portion of the array. This copy is often unwanted when it is implicitly used as a Span or Memory value. Use the AsSpan method to avoid the copy.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1833", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseAsSpanInsteadOfRangeIndexerAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1834": { + "id": "CA1834", + "shortDescription": "Consider using 'StringBuilder.Append(char)' when applicable", + "fullDescription": "'StringBuilder.Append(char)' is more efficient than 'StringBuilder.Append(string)' when the string is a single character. When calling 'Append' with a constant, prefer using a constant char rather than a constant string containing one character.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1834", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "PreferConstCharOverConstUnitStringAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1835": { + "id": "CA1835", + "shortDescription": "Prefer the 'Memory'-based overloads for 'ReadAsync' and 'WriteAsync'", + "fullDescription": "'Stream' has a 'ReadAsync' overload that takes a 'Memory' as the first argument, and a 'WriteAsync' overload that takes a 'ReadOnlyMemory' as the first argument. Prefer calling the memory based overloads, which are more efficient.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1835", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "PreferStreamAsyncMemoryOverloads", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1836": { + "id": "CA1836", + "shortDescription": "Prefer IsEmpty over Count", + "fullDescription": "For determining whether the object contains or not any items, prefer using 'IsEmpty' property rather than retrieving the number of items from the 'Count' property and comparing it to 0 or 1.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1836", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseCountProperlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1837": { + "id": "CA1837", + "shortDescription": "Use 'Environment.ProcessId'", + "fullDescription": "'Environment.ProcessId' is simpler and faster than 'Process.GetCurrentProcess().Id'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1837", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseEnvironmentMembers", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1838": { + "id": "CA1838", + "shortDescription": "Avoid 'StringBuilder' parameters for P/Invokes", + "fullDescription": "Marshalling of 'StringBuilder' always creates a native buffer copy, resulting in multiple allocations for one marshalling operation.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1838", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "AvoidStringBuilderPInvokeParametersAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1839": { + "id": "CA1839", + "shortDescription": "Use 'Environment.ProcessPath'", + "fullDescription": "'Environment.ProcessPath' is simpler and faster than 'Process.GetCurrentProcess().MainModule.FileName'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1839", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseEnvironmentMembers", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1840": { + "id": "CA1840", + "shortDescription": "Use 'Environment.CurrentManagedThreadId'", + "fullDescription": "'Environment.CurrentManagedThreadId' is simpler and faster than 'Thread.CurrentThread.ManagedThreadId'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1840", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseEnvironmentMembers", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1842": { + "id": "CA1842", + "shortDescription": "Do not use 'WhenAll' with a single task", + "fullDescription": "Using 'WhenAll' with a single task may result in performance loss, await or return the task instead.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1842", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "DoNotUseWhenAllOrWaitAllWithSingleArgument", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1843": { + "id": "CA1843", + "shortDescription": "Do not use 'WaitAll' with a single task", + "fullDescription": "Using 'WaitAll' with a single task may result in performance loss, await or return the task instead.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1843", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "DoNotUseWhenAllOrWaitAllWithSingleArgument", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1844": { + "id": "CA1844", + "shortDescription": "Provide memory-based overrides of async methods when subclassing 'Stream'", + "fullDescription": "To improve performance, override the memory-based async methods when subclassing 'Stream'. Then implement the array-based methods in terms of the memory-based methods.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1844", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "ProvideStreamMemoryBasedAsyncOverrides", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1846": { + "id": "CA1846", + "shortDescription": "Prefer 'AsSpan' over 'Substring'", + "fullDescription": "'AsSpan' is more efficient than 'Substring'. 'Substring' performs an O(n) string copy, while 'AsSpan' does not and has a constant cost.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1846", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "PreferAsSpanOverSubstring", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1847": { + "id": "CA1847", + "shortDescription": "Use char literal for a single character lookup", + "fullDescription": "'string.Contains(char)' is available as a better performing overload for single char lookup.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1847", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseStringContainsCharOverloadWithSingleCharactersAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1848": { + "id": "CA1848", + "shortDescription": "Use the LoggerMessage delegates", + "fullDescription": "For improved performance, use the LoggerMessage delegates.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1848", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "LoggerMessageDefineAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1849": { + "id": "CA1849", + "shortDescription": "Call async methods when in an async method", + "fullDescription": "When inside a Task-returning method, use the async version of methods, if they exist.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1849", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "UseAsyncMethodInAsyncContext", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1850": { + "id": "CA1850", + "shortDescription": "Prefer static 'HashData' method over 'ComputeHash'", + "fullDescription": "It is more efficient to use the static 'HashData' method over creating and managing a HashAlgorithm instance to call 'ComputeHash'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1850", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "PreferHashDataOverComputeHashAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1852": { + "id": "CA1852", + "shortDescription": "Seal internal types", + "fullDescription": "When a type is not accessible outside its assembly and has no subtypes within its containing assembly, it can be safely sealed. Sealing types can improve performance.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1852", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "SealInternalTypes", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA1853": { + "id": "CA1853", + "shortDescription": "Unnecessary call to 'Dictionary.ContainsKey(key)'", + "fullDescription": "Do not guard 'Dictionary.Remove(key)' with 'Dictionary.ContainsKey(key)'. The former already checks whether the key exists, and will not throw if it does not.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1853", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "DoNotGuardCallAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1854": { + "id": "CA1854", + "shortDescription": "Prefer the 'IDictionary.TryGetValue(TKey, out TValue)' method", + "fullDescription": "Prefer a 'TryGetValue' call over a Dictionary indexer access guarded by a 'ContainsKey' check. 'ContainsKey' and the indexer both would lookup the key under the hood, so using 'TryGetValue' removes the extra lookup.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1854", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "PreferDictionaryTryMethodsOverContainsKeyGuardAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1858": { + "id": "CA1858", + "shortDescription": "Use 'StartsWith' instead of 'IndexOf'", + "fullDescription": "It is both clearer and faster to use 'StartsWith' instead of comparing the result of 'IndexOf' to zero.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1858", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseStartsWithInsteadOfIndexOfComparisonWithZero", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1859": { + "id": "CA1859", + "shortDescription": "Use concrete types when possible for improved performance", + "fullDescription": "Using concrete types avoids virtual or interface call overhead and enables inlining.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1859", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseConcreteTypeAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1860": { + "id": "CA1860", + "shortDescription": "Avoid using 'Enumerable.Any()' extension method", + "fullDescription": "Prefer using 'IsEmpty', 'Count' or 'Length' properties whichever available, rather than calling 'Enumerable.Any()'. The intent is clearer and it is more performant than using 'Enumerable.Any()' extension method.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1860", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "PreferLengthCountIsEmptyOverAnyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1861": { + "id": "CA1861", + "shortDescription": "Avoid constant arrays as arguments", + "fullDescription": "Constant arrays passed as arguments are not reused when called repeatedly, which implies a new array is created each time. Consider extracting them to 'static readonly' fields to improve performance if the passed array is not mutated within the called method.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1861", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "AvoidConstArraysAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1862": { + "id": "CA1862", + "shortDescription": "Use the 'StringComparison' method overloads to perform case-insensitive string comparisons", + "fullDescription": "Avoid calling 'ToLower', 'ToUpper', 'ToLowerInvariant' and 'ToUpperInvariant' to perform case-insensitive string comparisons, as in 'string.ToLower() == string.ToLower()', because they lead to an allocation. Instead, use 'string.Equals(string, StringComparison)' to perform case-insensitive comparisons. Switching to using an overload that takes a 'StringComparison' might cause subtle changes in behavior, so it's important to conduct thorough testing after applying the suggestion. Additionally, if a culturally sensitive comparison is not required, consider using 'StringComparison.OrdinalIgnoreCase'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1862", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "RecommendCaseInsensitiveStringComparisonAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1863": { + "id": "CA1863", + "shortDescription": "Use 'CompositeFormat'", + "fullDescription": "Cache and use a 'CompositeFormat' instance as the argument to this formatting operation, rather than passing in the original format string. This reduces the cost of the formatting operation.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1863", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseCompositeFormatAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1864": { + "id": "CA1864", + "shortDescription": "Prefer the 'IDictionary.TryAdd(TKey, TValue)' method", + "fullDescription": "Prefer a 'TryAdd' call over an 'Add' call guarded by a 'ContainsKey' check. 'TryAdd' behaves the same as 'Add', except that when the specified key already exists, it returns 'false' instead of throwing an exception.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1864", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "PreferDictionaryTryMethodsOverContainsKeyGuardAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1868": { + "id": "CA1868", + "shortDescription": "Unnecessary call to 'Contains(item)'", + "fullDescription": "Do not guard 'Add(item)' or 'Remove(item)' with 'Contains(item)' for the set. The former two already check whether the item exists and will return if it was added or removed.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1868", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "DoNotGuardCallAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1869": { + "id": "CA1869", + "shortDescription": "Cache and reuse 'JsonSerializerOptions' instances", + "fullDescription": "Avoid creating a new 'JsonSerializerOptions' instance for every serialization operation. Cache and reuse instances instead. Single use 'JsonSerializerOptions' instances can substantially degrade the performance of your application.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1869", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "AvoidSingleUseOfLocalJsonSerializerOptions", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1871": { + "id": "CA1871", + "shortDescription": "Do not pass a nullable struct to 'ArgumentNullException.ThrowIfNull'", + "fullDescription": "'ArgumentNullException.ThrowIfNull' accepts an 'object', so passing a nullable struct may cause the value to be boxed.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1871", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "DoNotPassNonNullableValueToArgumentNullExceptionThrowIfNull", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1872": { + "id": "CA1872", + "shortDescription": "Prefer 'Convert.ToHexString' and 'Convert.ToHexStringLower' over call chains based on 'BitConverter.ToString'", + "fullDescription": "Use 'Convert.ToHexString' or 'Convert.ToHexStringLower' when encoding bytes to a hexadecimal string representation. These methods are more efficient and allocation-friendly than using 'BitConverter.ToString' in combination with 'String.Replace' to replace dashes and 'String.ToLower'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1872", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "PreferConvertToHexStringOverBitConverterAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1873": { + "id": "CA1873", + "shortDescription": "Avoid potentially expensive logging", + "fullDescription": "In many situations, logging is disabled or set to a log level that results in an unnecessary evaluation for this argument.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1873", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "AvoidPotentiallyExpensiveCallWhenLoggingAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1874": { + "id": "CA1874", + "shortDescription": "Use 'Regex.IsMatch'", + "fullDescription": "'Regex.IsMatch' is simpler and faster than 'Regex.Match(...).Success'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1874", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseRegexMembers", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1875": { + "id": "CA1875", + "shortDescription": "Use 'Regex.Count'", + "fullDescription": "'Regex.Count' is simpler and faster than 'Regex.Matches(...).Count'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1875", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "UseRegexMembers", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2000": { + "id": "CA2000", + "shortDescription": "Dispose objects before losing scope", + "fullDescription": "If a disposable object is not explicitly disposed before all references to it are out of scope, the object will be disposed at some indeterminate time when the garbage collector runs the finalizer of the object. Because an exceptional event might occur that will prevent the finalizer of the object from running, the object should be explicitly disposed instead.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2000", + "properties": { + "category": "Reliability", + "isEnabledByDefault": false, + "typeName": "DisposeObjectsBeforeLosingScope", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2002": { + "id": "CA2002", + "shortDescription": "Do not lock on objects with weak identity", + "fullDescription": "An object is said to have a weak identity when it can be directly accessed across application domain boundaries. A thread that tries to acquire a lock on an object that has a weak identity can be blocked by a second thread in a different application domain that has a lock on the same object.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2002", + "properties": { + "category": "Reliability", + "isEnabledByDefault": false, + "typeName": "DoNotLockOnObjectsWithWeakIdentityAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2007": { + "id": "CA2007", + "shortDescription": "Consider calling ConfigureAwait on the awaited task", + "fullDescription": "When an asynchronous method awaits a Task directly, continuation occurs in the same thread that created the task. Consider calling Task.ConfigureAwait(Boolean) to signal your intention for continuation. Call ConfigureAwait(false) on the task to schedule continuations to the thread pool, thereby avoiding a deadlock on the UI thread. Passing false is a good option for app-independent libraries. Calling ConfigureAwait(true) on the task has the same behavior as not explicitly calling ConfigureAwait. By explicitly calling this method, you're letting readers know you intentionally want to perform the continuation on the original synchronization context.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2007", + "properties": { + "category": "Reliability", + "isEnabledByDefault": false, + "typeName": "DoNotDirectlyAwaitATaskAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2008": { + "id": "CA2008", + "shortDescription": "Do not create tasks without passing a TaskScheduler", + "fullDescription": "Do not create tasks unless you are using one of the overloads that takes a TaskScheduler. The default is to schedule on TaskScheduler.Current, which would lead to deadlocks. Either use TaskScheduler.Default to schedule on the thread pool, or explicitly pass TaskScheduler.Current to make your intentions clear.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2008", + "properties": { + "category": "Reliability", + "isEnabledByDefault": false, + "typeName": "DoNotCreateTasksWithoutPassingATaskSchedulerAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2009": { + "id": "CA2009", + "shortDescription": "Do not call ToImmutableCollection on an ImmutableCollection value", + "fullDescription": "Do not call {0} on an {1} value", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2009", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "DoNotCallToImmutableCollectionOnAnImmutableCollectionValueAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2011": { + "id": "CA2011", + "shortDescription": "Avoid infinite recursion", + "fullDescription": "Do not assign the property within its setter. This call might result in an infinite recursion.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2011", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "AvoidInfiniteRecursion", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2012": { + "id": "CA2012", + "shortDescription": "Use ValueTasks correctly", + "fullDescription": "ValueTasks returned from member invocations are intended to be directly awaited. Attempts to consume a ValueTask multiple times or to directly access one's result before it's known to be completed may result in an exception or corruption. Ignoring such a ValueTask is likely an indication of a functional bug and may degrade performance.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2012", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "UseValueTasksCorrectlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2013": { + "id": "CA2013", + "shortDescription": "Do not use ReferenceEquals with value types", + "fullDescription": "Value type typed arguments are uniquely boxed for each call to this method, therefore the result can be unexpected.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2013", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "DoNotUseReferenceEqualsWithValueTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2015": { + "id": "CA2015", + "shortDescription": "Do not define finalizers for types derived from MemoryManager", + "fullDescription": "Adding a finalizer to a type derived from MemoryManager may permit memory to be freed while it is still in use by a Span.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2015", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "DoNotDefineFinalizersForTypesDerivedFromMemoryManager", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2017": { + "id": "CA2017", + "shortDescription": "Parameter count mismatch", + "fullDescription": "Number of parameters supplied in the logging message template do not match the number of named placeholders.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2017", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "LoggerMessageDefineAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2018": { + "id": "CA2018", + "shortDescription": "'Buffer.BlockCopy' expects the number of bytes to be copied for the 'count' argument", + "fullDescription": "'Buffer.BlockCopy' expects the number of bytes to be copied for the 'count' argument. Using 'Array.Length' may not match the number of bytes that needs to be copied.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2018", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "BufferBlockCopyLengthAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2019": { + "id": "CA2019", + "shortDescription": "Improper 'ThreadStatic' field initialization", + "fullDescription": "'ThreadStatic' fields should be initialized lazily on use, not with inline initialization nor explicitly in a static constructor, which would only initialize the field on the thread that runs the type's static constructor.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2019", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "UseThreadStaticCorrectly", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2021": { + "id": "CA2021", + "shortDescription": "Do not call Enumerable.Cast or Enumerable.OfType with incompatible types", + "fullDescription": "Enumerable.Cast and Enumerable.OfType require compatible types to function expectedly. \u000aThe generic cast (IL 'unbox.any') used by the sequence returned by Enumerable.Cast will throw InvalidCastException at runtime on elements of the types specified. \u000aThe generic type check (C# 'is' operator/IL 'isinst') used by Enumerable.OfType will never succeed with elements of types specified, resulting in an empty sequence. \u000aWidening and user defined conversions are not supported with generic types.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2021", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "DoNotCallEnumerableCastOrOfTypeWithIncompatibleTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2022": { + "id": "CA2022", + "shortDescription": "Avoid inexact read with 'Stream.Read'", + "fullDescription": "A call to 'Stream.Read' may return fewer bytes than requested, resulting in unreliable code if the return value is not checked.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2022", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "AvoidUnreliableStreamReadAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2023": { + "id": "CA2023", + "shortDescription": "Invalid braces in message template", + "fullDescription": "The braces present in the message template are invalid. Ensure any braces in the message template are valid opening/closing braces, or are escaped.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2023", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "LoggerMessageDefineAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2024": { + "id": "CA2024", + "shortDescription": "Do not use 'StreamReader.EndOfStream' in async methods", + "fullDescription": "The property 'StreamReader.EndOfStream' can cause unintended synchronous blocking when no data is buffered. Instead, use 'StreamReader.ReadLineAsync' directly, which returns 'null' when reaching the end of the stream.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2024", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "DoNotUseEndOfStreamInAsyncMethodsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2025": { + "id": "CA2025", + "shortDescription": "Do not pass 'IDisposable' instances into unawaited tasks", + "fullDescription": "Unawaited tasks that use 'IDisposable' instances may use those instances long after they have been disposed. Ensure tasks using those instances are completed before the instances are disposed.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2025", + "properties": { + "category": "Reliability", + "isEnabledByDefault": false, + "typeName": "DoNotPassDisposablesIntoUnawaitedTasksAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2100": { + "id": "CA2100", + "shortDescription": "Review SQL queries for security vulnerabilities", + "fullDescription": "SQL queries that directly use user input can be vulnerable to SQL injection attacks. Review this SQL query for potential vulnerabilities, and consider using a parameterized SQL query.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2100", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewSqlQueriesForSecurityVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2101": { + "id": "CA2101", + "shortDescription": "Specify marshaling for P/Invoke string arguments", + "fullDescription": "A platform invoke member allows partially trusted callers, has a string parameter, and does not explicitly marshal the string. This can cause a potential security vulnerability.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2101", + "properties": { + "category": "Globalization", + "isEnabledByDefault": true, + "typeName": "PInvokeDiagnosticAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2119": { + "id": "CA2119", + "shortDescription": "Seal methods that satisfy private interfaces", + "fullDescription": "An inheritable public type provides an overridable method implementation of an internal (Friend in Visual Basic) interface. To fix a violation of this rule, prevent the method from being overridden outside the assembly.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2119", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "SealMethodsThatSatisfyPrivateInterfacesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2153": { + "id": "CA2153", + "shortDescription": "Do Not Catch Corrupted State Exceptions", + "fullDescription": "Catching corrupted state exceptions could mask errors (such as access violations), resulting in inconsistent state of execution or making it easier for attackers to compromise system. Instead, catch and handle a more specific set of exception type(s) or re-throw the exception.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2153", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotCatchCorruptedStateExceptionsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2200": { + "id": "CA2200", + "shortDescription": "Rethrow to preserve stack details", + "fullDescription": "Re-throwing caught exception changes stack information", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2200", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "RethrowToPreserveStackDetailsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2201": { + "id": "CA2201", + "shortDescription": "Do not raise reserved exception types", + "fullDescription": "An exception of type that is not sufficiently specific or reserved by the runtime should never be raised by user code. This makes the original error difficult to detect and debug. If this exception instance might be thrown, use a different exception type.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2201", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DoNotRaiseReservedExceptionTypesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2207": { + "id": "CA2207", + "shortDescription": "Initialize value type static fields inline", + "fullDescription": "A value type declares an explicit static constructor. To fix a violation of this rule, initialize all static data when it is declared and remove the static constructor.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2207", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "InitializeStaticFieldsInlineAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2208": { + "id": "CA2208", + "shortDescription": "Instantiate argument exceptions correctly", + "fullDescription": "A call is made to the default (parameterless) constructor of an exception type that is or derives from ArgumentException, or an incorrect string argument is passed to a parameterized constructor of an exception type that is or derives from ArgumentException.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2208", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "InstantiateArgumentExceptionsCorrectlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2211": { + "id": "CA2211", + "shortDescription": "Non-constant fields should not be visible", + "fullDescription": "Static fields that are neither constants nor read-only are not thread-safe. Access to such a field must be carefully controlled and requires advanced programming techniques to synchronize access to the class object.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2211", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "NonConstantFieldsShouldNotBeVisibleAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2213": { + "id": "CA2213", + "shortDescription": "Disposable fields should be disposed", + "fullDescription": "A type that implements System.IDisposable declares fields that are of types that also implement IDisposable. The Dispose method of the field is not called by the Dispose method of the declaring type. To fix a violation of this rule, call Dispose on fields that are of types that implement IDisposable if you are responsible for allocating and releasing the unmanaged resources held by the field.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2213", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "DisposableFieldsShouldBeDisposed", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2214": { + "id": "CA2214", + "shortDescription": "Do not call overridable methods in constructors", + "fullDescription": "Virtual methods defined on the class should not be called from constructors. If a derived class has overridden the method, the derived class version will be called (before the derived class constructor is called).", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2214", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "DoNotCallOverridableMethodsInConstructorsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2215": { + "id": "CA2215", + "shortDescription": "Dispose methods should call base class dispose", + "fullDescription": "A type that implements System.IDisposable inherits from a type that also implements IDisposable. The Dispose method of the inheriting type does not call the Dispose method of the parent type. To fix a violation of this rule, call base.Dispose in your Dispose method.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2215", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DisposeMethodsShouldCallBaseClassDispose", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2216": { + "id": "CA2216", + "shortDescription": "Disposable types should declare finalizer", + "fullDescription": "A type that implements System.IDisposable and has fields that suggest the use of unmanaged resources does not implement a finalizer, as described by Object.Finalize.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2216", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "DisposableTypesShouldDeclareFinalizerAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2217": { + "id": "CA2217", + "shortDescription": "Do not mark enums with FlagsAttribute", + "fullDescription": "An externally visible enumeration is marked by using FlagsAttribute, and it has one or more values that are not powers of two or a combination of the other defined values on the enumeration.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2217", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "EnumWithFlagsAttributeAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2219": { + "id": "CA2219", + "shortDescription": "Do not raise exceptions in finally clauses", + "fullDescription": "When an exception is raised in a finally clause, the new exception hides the active exception. This makes the original error difficult to detect and debug.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2219", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DoNotRaiseExceptionsInExceptionClausesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2225": { + "id": "CA2225", + "shortDescription": "Operator overloads have named alternates", + "fullDescription": "An operator overload was detected, and the expected named alternative method was not found. The named alternative member provides access to the same functionality as the operator and is provided for developers who program in languages that do not support overloaded operators.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2225", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "OperatorOverloadsHaveNamedAlternatesAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2226": { + "id": "CA2226", + "shortDescription": "Operators should have symmetrical overloads", + "fullDescription": "A type implements the equality or inequality operator and does not implement the opposite operator.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2226", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "OperatorsShouldHaveSymmetricalOverloadsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2227": { + "id": "CA2227", + "shortDescription": "Collection properties should be read only", + "fullDescription": "A writable collection property allows a user to replace the collection with a different collection. A read-only property stops the collection from being replaced but still allows the individual members to be set.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2227", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "CollectionPropertiesShouldBeReadOnlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2231": { + "id": "CA2231", + "shortDescription": "Overload operator equals on overriding value type Equals", + "fullDescription": "In most programming languages there is no default implementation of the equality operator (==) for value types. If your programming language supports operator overloads, you should consider implementing the equality operator. Its behavior should be identical to that of Equals.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2231", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "OverloadOperatorEqualsOnOverridingValueTypeEqualsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2235": { + "id": "CA2235", + "shortDescription": "Mark all non-serializable fields", + "fullDescription": "An instance field of a type that is not serializable is declared in a type that is serializable.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2235", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "SerializationRulesDiagnosticAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2237": { + "id": "CA2237", + "shortDescription": "Mark ISerializable types with serializable", + "fullDescription": "To be recognized by the common language runtime as serializable, types must be marked by using the SerializableAttribute attribute even when the type uses a custom serialization routine through implementation of the ISerializable interface.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2237", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "SerializationRulesDiagnosticAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2241": { + "id": "CA2241", + "shortDescription": "Provide correct arguments to formatting methods", + "fullDescription": "The format argument that is passed to System.String.Format does not contain a format item that corresponds to each object argument, or vice versa.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2241", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "ProvideCorrectArgumentsToFormattingMethodsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2242": { + "id": "CA2242", + "shortDescription": "Test for NaN correctly", + "fullDescription": "This expression tests a value against Single.Nan or Double.Nan. Use Single.IsNan(Single) or Double.IsNan(Double) to test the value.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2242", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "TestForNaNCorrectlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2243": { + "id": "CA2243", + "shortDescription": "Attribute string literals should parse correctly", + "fullDescription": "The string literal parameter of an attribute does not parse correctly for a URL, a GUID, or a version.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2243", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "AttributeStringLiteralsShouldParseCorrectlyAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2244": { + "id": "CA2244", + "shortDescription": "Do not duplicate indexed element initializations", + "fullDescription": "Indexed elements in objects initializers must initialize unique elements. A duplicate index might overwrite a previous element initialization.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2244", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "AvoidDuplicateElementInitialization", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2245": { + "id": "CA2245", + "shortDescription": "Do not assign a property to itself", + "fullDescription": "The property {0} should not be assigned to itself", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2245", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "AvoidPropertySelfAssignment", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2246": { + "id": "CA2246", + "shortDescription": "Assigning symbol and its member in the same statement", + "fullDescription": "Assigning to a symbol and its member (field/property) in the same statement is not recommended. It is not clear if the member access was intended to use symbol's old value prior to the assignment or new value from the assignment in this statement. For clarity, consider splitting the assignments into separate statements.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2246", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "AssigningSymbolAndItsMemberInSameStatement", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2247": { + "id": "CA2247", + "shortDescription": "Argument passed to TaskCompletionSource constructor should be TaskCreationOptions enum instead of TaskContinuationOptions enum", + "fullDescription": "TaskCompletionSource has constructors that take TaskCreationOptions that control the underlying Task, and constructors that take object state that's stored in the task. Accidentally passing a TaskContinuationOptions instead of a TaskCreationOptions will result in the call treating the options as state.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2247", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DoNotCreateTaskCompletionSourceWithWrongArguments", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2248": { + "id": "CA2248", + "shortDescription": "Provide correct 'enum' argument to 'Enum.HasFlag'", + "fullDescription": "'Enum.HasFlag' method expects the 'enum' argument to be of the same 'enum' type as the instance on which the method is invoked and that this 'enum' is marked with 'System.FlagsAttribute'. If these are different 'enum' types, an unhandled exception will be thrown at runtime. If the 'enum' type is not marked with 'System.FlagsAttribute' the call will always return 'false' at runtime.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2248", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "ProvideCorrectArgumentToEnumHasFlag", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2249": { + "id": "CA2249", + "shortDescription": "Consider using 'string.Contains' instead of 'string.IndexOf'", + "fullDescription": "Calls to 'string.IndexOf' where the result is used to check for the presence/absence of a substring can be replaced by 'string.Contains'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2249", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "PreferStringContainsOverIndexOfAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2250": { + "id": "CA2250", + "shortDescription": "Use 'ThrowIfCancellationRequested'", + "fullDescription": "'ThrowIfCancellationRequested' automatically checks whether the token has been canceled, and throws an 'OperationCanceledException' if it has.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2250", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "UseCancellationTokenThrowIfCancellationRequested", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2251": { + "id": "CA2251", + "shortDescription": "Use 'string.Equals'", + "fullDescription": "It is both clearer and likely faster to use 'string.Equals' instead of comparing the result of 'string.Compare' to zero.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2251", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "UseStringEqualsOverStringCompare", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2253": { + "id": "CA2253", + "shortDescription": "Named placeholders should not be numeric values", + "fullDescription": "Named placeholders in the logging message template should not be comprised of only numeric characters.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2253", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "LoggerMessageDefineAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2254": { + "id": "CA2254", + "shortDescription": "Template should be a static expression", + "fullDescription": "The logging message template should not vary between calls.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2254", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "LoggerMessageDefineAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2255": { + "id": "CA2255", + "shortDescription": "The 'ModuleInitializer' attribute should not be used in libraries", + "fullDescription": "Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2255", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "ModuleInitializerAttributeShouldNotBeUsedInLibraries", + "languages": [ + "C#" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2256": { + "id": "CA2256", + "shortDescription": "All members declared in parent interfaces must have an implementation in a DynamicInterfaceCastableImplementation-attributed interface", + "fullDescription": "Types attributed with 'DynamicInterfaceCastableImplementationAttribute' act as an interface implementation for a type that implements the 'IDynamicInterfaceCastable' type. As a result, it must provide an implementation of all of the members defined in the inherited interfaces, because the type that implements 'IDynamicInterfaceCastable' will not provide them otherwise.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2256", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DynamicInterfaceCastableImplementationAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2257": { + "id": "CA2257", + "shortDescription": "Members defined on an interface with the 'DynamicInterfaceCastableImplementationAttribute' should be 'static'", + "fullDescription": "Since a type that implements 'IDynamicInterfaceCastable' may not implement a dynamic interface in metadata, calls to an instance interface member that is not an explicit implementation defined on this type are likely to fail at runtime. Mark new interface members 'static' to avoid runtime errors.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2257", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DynamicInterfaceCastableImplementationAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2258": { + "id": "CA2258", + "shortDescription": "Providing a 'DynamicInterfaceCastableImplementation' interface in Visual Basic is unsupported", + "fullDescription": "Providing a functional 'DynamicInterfaceCastableImplementationAttribute'-attributed interface requires the Default Interface Members feature, which is unsupported in Visual Basic.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2258", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DynamicInterfaceCastableImplementationAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2259": { + "id": "CA2259", + "shortDescription": "'ThreadStatic' only affects static fields", + "fullDescription": "'ThreadStatic' only affects static fields. When applied to instance fields, it has no impact on behavior.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2259", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "UseThreadStaticCorrectly", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2261": { + "id": "CA2261", + "shortDescription": "Do not use ConfigureAwaitOptions.SuppressThrowing with Task", + "fullDescription": "The ConfigureAwaitOptions.SuppressThrowing option is only supported with the non-generic Task, not a Task. To use it with a Task, first cast to the base Task.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2261", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DoNotUseConfigureAwaitWithSuppressThrowing", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2262": { + "id": "CA2262", + "shortDescription": "Set 'MaxResponseHeadersLength' properly", + "fullDescription": "The property 'MaxResponseHeadersLength' is measured in kilobytes, not in bytes. The provided value is multiplied by 1024, which might be greater than your intended maximum length.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2262", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "ProvideHttpClientHandlerMaxResponseHeaderLengthValueCorrectly", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2264": { + "id": "CA2264", + "shortDescription": "Do not pass a non-nullable value to 'ArgumentNullException.ThrowIfNull'", + "fullDescription": "'ArgumentNullException.ThrowIfNull' throws when the passed argument is 'null'. Certain constructs like non-nullable structs, 'nameof()' and 'new' expressions are known to never be null, so 'ArgumentNullException.ThrowIfNull' will never throw.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2264", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DoNotPassNonNullableValueToArgumentNullExceptionThrowIfNull", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2265": { + "id": "CA2265", + "shortDescription": "Do not compare Span to 'null' or 'default'", + "fullDescription": "Comparing a span to 'null' or 'default' might not do what you intended. 'default' and the 'null' literal are implicitly converted to 'Span.Empty'. Remove the redundant comparison or make the code more explicit by using 'IsEmpty'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2265", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "DoNotCompareSpanToNullAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2300": { + "id": "CA2300", + "shortDescription": "Do not use insecure deserializer BinaryFormatter", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data. If you need to instead detect BinaryFormatter deserialization without a SerializationBinder set, then disable rule CA2300, and enable rules CA2301 and CA2302.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2300", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerBinaryFormatterMethods", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2301": { + "id": "CA2301", + "shortDescription": "Do not call BinaryFormatter.Deserialize without first setting BinaryFormatter.Binder", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2301", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerBinaryFormatterWithoutBinder", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2302": { + "id": "CA2302", + "shortDescription": "Ensure BinaryFormatter.Binder is set before calling BinaryFormatter.Deserialize", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2302", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerBinaryFormatterWithoutBinder", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2305": { + "id": "CA2305", + "shortDescription": "Do not use insecure deserializer LosFormatter", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2305", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerLosFormatter", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2310": { + "id": "CA2310", + "shortDescription": "Do not use insecure deserializer NetDataContractSerializer", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data. If you need to instead detect NetDataContractSerializer deserialization without a SerializationBinder set, then disable rule CA2310, and enable rules CA2311 and CA2312.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2310", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerNetDataContractSerializerMethods", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2311": { + "id": "CA2311", + "shortDescription": "Do not deserialize without first setting NetDataContractSerializer.Binder", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2311", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerNetDataContractSerializerWithoutBinder", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2312": { + "id": "CA2312", + "shortDescription": "Ensure NetDataContractSerializer.Binder is set before deserializing", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2312", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerNetDataContractSerializerWithoutBinder", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2315": { + "id": "CA2315", + "shortDescription": "Do not use insecure deserializer ObjectStateFormatter", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2315", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerObjectStateFormatter", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2321": { + "id": "CA2321", + "shortDescription": "Do not deserialize with JavaScriptSerializer using a SimpleTypeResolver", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data with a JavaScriptSerializer initialized with a SimpleTypeResolver. Initialize JavaScriptSerializer without a JavaScriptTypeResolver specified, or initialize with a JavaScriptTypeResolver that limits the types of objects in the deserialized object graph.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2321", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerJavaScriptSerializerWithSimpleTypeResolver", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2322": { + "id": "CA2322", + "shortDescription": "Ensure JavaScriptSerializer is not initialized with SimpleTypeResolver before deserializing", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data with a JavaScriptSerializer initialized with a SimpleTypeResolver. Ensure that the JavaScriptSerializer is initialized without a JavaScriptTypeResolver specified, or initialized with a JavaScriptTypeResolver that limits the types of objects in the deserialized object graph.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2322", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerJavaScriptSerializerWithSimpleTypeResolver", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2326": { + "id": "CA2326", + "shortDescription": "Do not use TypeNameHandling values other than None", + "fullDescription": "Deserializing JSON when using a TypeNameHandling value other than None can be insecure. If you need to instead detect Json.NET deserialization when a SerializationBinder isn't specified, then disable rule CA2326, and enable rules CA2327, CA2328, CA2329, and CA2330.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2326", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "JsonNetTypeNameHandling", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2327": { + "id": "CA2327", + "shortDescription": "Do not use insecure JsonSerializerSettings", + "fullDescription": "When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using JsonSerializerSettings, use TypeNameHandling.None, or for values other than None, restrict deserialized types with a SerializationBinder.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2327", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureSettingsForJsonNet", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2328": { + "id": "CA2328", + "shortDescription": "Ensure that JsonSerializerSettings are secure", + "fullDescription": "When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using JsonSerializerSettings, ensure TypeNameHandling.None is specified, or for values other than None, ensure a SerializationBinder is specified to restrict deserialized types.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2328", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureSettingsForJsonNet", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2329": { + "id": "CA2329", + "shortDescription": "Do not deserialize with JsonSerializer using an insecure configuration", + "fullDescription": "When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using deserializing JsonSerializer, use TypeNameHandling.None, or for values other than None, restrict deserialized types with a SerializationBinder.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2329", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerJsonNetWithoutBinder", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2330": { + "id": "CA2330", + "shortDescription": "Ensure that JsonSerializer has a secure configuration when deserializing", + "fullDescription": "When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using deserializing JsonSerializer, use TypeNameHandling.None, or for values other than None, restrict deserialized types with a SerializationBinder.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2330", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureDeserializerJsonNetWithoutBinder", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA2350": { + "id": "CA2350", + "shortDescription": "Do not use DataTable.ReadXml() with untrusted data", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2350", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseDataTableReadXml", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2351": { + "id": "CA2351", + "shortDescription": "Do not use DataSet.ReadXml() with untrusted data", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2351", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseDataSetReadXml", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2361": { + "id": "CA2361", + "shortDescription": "Ensure auto-generated class containing DataSet.ReadXml() is not used with untrusted data", + "fullDescription": "The method '{0}' is insecure when deserializing untrusted data. Make sure that auto-generated class containing the '{0}' call is not deserialized with untrusted data.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2361", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseDataSetReadXml", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3001": { + "id": "CA3001", + "shortDescription": "Review code for SQL injection vulnerabilities", + "fullDescription": "Potential SQL injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3001", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForSqlInjectionVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3002": { + "id": "CA3002", + "shortDescription": "Review code for XSS vulnerabilities", + "fullDescription": "Potential cross-site scripting (XSS) vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3002", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForXssVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3003": { + "id": "CA3003", + "shortDescription": "Review code for file path injection vulnerabilities", + "fullDescription": "Potential file path injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3003", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForFilePathInjectionVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3004": { + "id": "CA3004", + "shortDescription": "Review code for information disclosure vulnerabilities", + "fullDescription": "Potential information disclosure vulnerability was found where '{0}' in method '{1}' may contain unintended information from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3004", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForInformationDisclosureVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3005": { + "id": "CA3005", + "shortDescription": "Review code for LDAP injection vulnerabilities", + "fullDescription": "Potential LDAP injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3005", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForLdapInjectionVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3006": { + "id": "CA3006", + "shortDescription": "Review code for process command injection vulnerabilities", + "fullDescription": "Potential process command injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3006", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForCommandExecutionVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3007": { + "id": "CA3007", + "shortDescription": "Review code for open redirect vulnerabilities", + "fullDescription": "Potential open redirect vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3007", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForOpenRedirectVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3008": { + "id": "CA3008", + "shortDescription": "Review code for XPath injection vulnerabilities", + "fullDescription": "Potential XPath injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3008", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForXPathInjectionVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3009": { + "id": "CA3009", + "shortDescription": "Review code for XML injection vulnerabilities", + "fullDescription": "Potential XML injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3009", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForXmlInjectionVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3010": { + "id": "CA3010", + "shortDescription": "Review code for XAML injection vulnerabilities", + "fullDescription": "Potential XAML injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3010", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForXamlInjectionVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3011": { + "id": "CA3011", + "shortDescription": "Review code for DLL injection vulnerabilities", + "fullDescription": "Potential DLL injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3011", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForDllInjectionVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3012": { + "id": "CA3012", + "shortDescription": "Review code for regex injection vulnerabilities", + "fullDescription": "Potential regex injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3012", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ReviewCodeForRegexInjectionVulnerabilities", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3061": { + "id": "CA3061", + "shortDescription": "Do Not Add Schema By URL", + "fullDescription": "This overload of XmlSchemaCollection.Add method internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3061", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotAddSchemaByURL", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3075": { + "id": "CA3075", + "shortDescription": "Insecure DTD processing in XML", + "fullDescription": "Using XmlTextReader.Load(), creating an insecure XmlReaderSettings instance when invoking XmlReader.Create(), setting the InnerXml property of the XmlDocument and enabling DTD processing using XmlUrlResolver insecurely can lead to information disclosure. Replace it with a call to the Load() method overload that takes an XmlReader instance, use XmlReader.Create() to accept XmlReaderSettings arguments or consider explicitly setting secure values. The DataViewSettingCollectionString property of DataViewManager should always be assigned from a trusted source, the DtdProcessing property should be set to false, and the XmlResolver property should be changed to XmlSecureResolver or null.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3075", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseInsecureDtdProcessingAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3076": { + "id": "CA3076", + "shortDescription": "Insecure XSLT script processing", + "fullDescription": "Providing an insecure XsltSettings instance and an insecure XmlResolver instance to XslCompiledTransform.Load method is potentially unsafe as it allows processing script within XSL, which on an untrusted XSL input may lead to malicious code execution. Either replace the insecure XsltSettings argument with XsltSettings.Default or an instance that has disabled document function and script execution, or replace the XmlResolver argument with null or an XmlSecureResolver instance. This message may be suppressed if the input is known to be from a trusted source and external resource resolution from locations that are not known in advance must be supported.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3076", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseInsecureXSLTScriptExecutionAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3077": { + "id": "CA3077", + "shortDescription": "Insecure Processing in API Design, XmlDocument and XmlTextReader", + "fullDescription": "Enabling DTD processing on all instances derived from XmlTextReader or  XmlDocument and using XmlUrlResolver for resolving external XML entities may lead to information disclosure. Ensure to set the XmlResolver property to null, create an instance of XmlSecureResolver when processing untrusted input, or use XmlReader.Create method with a secure XmlReaderSettings argument. Unless you need to enable it, ensure the DtdProcessing property is set to false.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3077", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseInsecureDtdProcessingInApiDesignAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA3147": { + "id": "CA3147", + "shortDescription": "Mark Verb Handlers With Validate Antiforgery Token", + "fullDescription": "Missing ValidateAntiForgeryTokenAttribute on controller action {0}", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3147", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "MarkVerbHandlersWithValidateAntiforgeryTokenAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5350": { + "id": "CA5350", + "shortDescription": "Do Not Use Weak Cryptographic Algorithms", + "fullDescription": "Cryptographic algorithms degrade over time as attacks become for advances to attacker get access to more computation. Depending on the type and application of this cryptographic algorithm, further degradation of the cryptographic strength of it may allow attackers to read enciphered messages, tamper with enciphered  messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA-2 512, SHA-2 384, or SHA-2 256.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5350", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseInsecureCryptographicAlgorithmsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5351": { + "id": "CA5351", + "shortDescription": "Do Not Use Broken Cryptographic Algorithms", + "fullDescription": "An attack making it computationally feasible to break this algorithm exists. This allows attackers to break the cryptographic guarantees it is designed to provide. Depending on the type and application of this cryptographic algorithm, this may allow attackers to read enciphered messages, tamper with enciphered  messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA512, SHA384, or SHA256. Replace digital signature uses with RSA with a key length greater than or equal to 2048-bits, or ECDSA with a key length greater than or equal to 256 bits.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5351", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseInsecureCryptographicAlgorithmsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5358": { + "id": "CA5358", + "shortDescription": "Review cipher mode usage with cryptography experts", + "fullDescription": "These cipher modes might be vulnerable to attacks. Consider using recommended modes (CBC, CTS).", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5358", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "ApprovedCipherModeAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5359": { + "id": "CA5359", + "shortDescription": "Do Not Disable Certificate Validation", + "fullDescription": "A certificate can help authenticate the identity of the server. Clients should validate the server certificate to ensure requests are sent to the intended server. If the ServerCertificateValidationCallback always returns 'true', any certificate will pass validation.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5359", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotDisableCertificateValidation", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5360": { + "id": "CA5360", + "shortDescription": "Do Not Call Dangerous Methods In Deserialization", + "fullDescription": "Insecure Deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application, inflict a Denial-of-Service (DoS) attack, or even execute arbitrary code upon it being deserialized. It’s frequently possible for malicious users to abuse these deserialization features when the application is deserializing untrusted data which is under their control. Specifically, invoke dangerous methods in the process of deserialization. Successful insecure deserialization attacks could allow an attacker to carry out attacks such as DoS attacks, authentication bypasses, and remote code execution.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5360", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotCallDangerousMethodsInDeserialization", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5361": { + "id": "CA5361", + "shortDescription": "Do Not Disable SChannel Use of Strong Crypto", + "fullDescription": "Starting with the .NET Framework 4.6, the System.Net.ServicePointManager and System.Net.Security.SslStream classes are recommended to use new protocols. The old ones have protocol weaknesses and are not supported. Setting Switch.System.Net.DontEnableSchUseStrongCrypto with true will use the old weak crypto check and opt out of the protocol migration.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5361", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotSetSwitch", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5362": { + "id": "CA5362", + "shortDescription": "Potential reference cycle in deserialized object graph", + "fullDescription": "Review code that processes untrusted deserialized data for handling of unexpected reference cycles. An unexpected reference cycle should not cause the code to enter an infinite loop. Otherwise, an unexpected reference cycle can allow an attacker to DOS or exhaust the memory of the process when deserializing untrusted data.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5362", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "PotentialReferenceCycleInDeserializedObjectGraph", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5363": { + "id": "CA5363", + "shortDescription": "Do Not Disable Request Validation", + "fullDescription": "Request validation is a feature in ASP.NET that examines HTTP requests and determines whether they contain potentially dangerous content. This check adds protection from markup or code in the URL query string, cookies, or posted form values that might have been added for malicious purposes. So, it is generally desirable and should be left enabled for defense in depth.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5363", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotDisableRequestValidation", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5364": { + "id": "CA5364", + "shortDescription": "Do Not Use Deprecated Security Protocols", + "fullDescription": "Using a deprecated security protocol rather than the system default is risky.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5364", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseDeprecatedSecurityProtocols", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5365": { + "id": "CA5365", + "shortDescription": "Do Not Disable HTTP Header Checking", + "fullDescription": "HTTP header checking enables encoding of the carriage return and newline characters, \\r and \\n, that are found in response headers. This encoding can help to avoid injection attacks that exploit an application that echoes untrusted data contained by the header.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5365", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotDisableHTTPHeaderChecking", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5366": { + "id": "CA5366", + "shortDescription": "Use XmlReader for 'DataSet.ReadXml()'", + "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5366", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "UseXmlReaderForDataSetReadXml", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5367": { + "id": "CA5367", + "shortDescription": "Do Not Serialize Types With Pointer Fields", + "fullDescription": "Pointers are not \"type safe\" in the sense that you cannot guarantee the correctness of the memory they point at. So, serializing types with pointer fields is dangerous, as it may allow an attacker to control the pointer.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5367", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotSerializeTypeWithPointerFields", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5368": { + "id": "CA5368", + "shortDescription": "Set ViewStateUserKey For Classes Derived From Page", + "fullDescription": "Setting the ViewStateUserKey property can help you prevent attacks on your application by allowing you to assign an identifier to the view-state variable for individual users so that they cannot use the variable to generate an attack. Otherwise, there will be cross-site request forgery vulnerabilities.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5368", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "SetViewStateUserKey", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5369": { + "id": "CA5369", + "shortDescription": "Use XmlReader for 'XmlSerializer.Deserialize()'", + "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5369", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "UseXmlReaderForDeserialize", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5370": { + "id": "CA5370", + "shortDescription": "Use XmlReader for XmlValidatingReader constructor", + "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5370", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "UseXmlReaderForValidatingReader", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5371": { + "id": "CA5371", + "shortDescription": "Use XmlReader for 'XmlSchema.Read()'", + "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5371", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "UseXmlReaderForSchemaRead", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5372": { + "id": "CA5372", + "shortDescription": "Use XmlReader for XPathDocument constructor", + "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5372", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "UseXmlReaderForXPathDocument", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5373": { + "id": "CA5373", + "shortDescription": "Do not use obsolete key derivation function", + "fullDescription": "Password-based key derivation should use PBKDF2 with SHA-2. Avoid using PasswordDeriveBytes since it generates a PBKDF1 key. Avoid using Rfc2898DeriveBytes.CryptDeriveKey since it doesn't use the iteration count or salt.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5373", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseObsoleteKDFAlgorithm", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5374": { + "id": "CA5374", + "shortDescription": "Do Not Use XslTransform", + "fullDescription": "Do not use XslTransform. It does not restrict potentially dangerous external references.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5374", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseXslTransform", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5375": { + "id": "CA5375", + "shortDescription": "Do Not Use Account Shared Access Signature", + "fullDescription": "Shared Access Signatures(SAS) are a vital part of the security model for any application using Azure Storage, they should provide limited and safe permissions to your storage account to clients that don't have the account key. All of the operations available via a service SAS are also available via an account SAS, that is, account SAS is too powerful. So it is recommended to use Service SAS to delegate access more carefully.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5375", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseAccountSAS", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5376": { + "id": "CA5376", + "shortDescription": "Use SharedAccessProtocol HttpsOnly", + "fullDescription": "HTTPS encrypts network traffic. Use HttpsOnly, rather than HttpOrHttps, to ensure network traffic is always encrypted to help prevent disclosure of sensitive data.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5376", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "UseSharedAccessProtocolHttpsOnly", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5377": { + "id": "CA5377", + "shortDescription": "Use Container Level Access Policy", + "fullDescription": "No access policy identifier is specified, making tokens non-revocable.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5377", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "UseContainerLevelAccessPolicy", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5378": { + "id": "CA5378", + "shortDescription": "Do not disable ServicePointManagerSecurityProtocols", + "fullDescription": "Do not set Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols to true. Setting this switch limits Windows Communication Framework (WCF) to using Transport Layer Security (TLS) 1.0, which is insecure and obsolete.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5378", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotSetSwitch", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5379": { + "id": "CA5379", + "shortDescription": "Ensure Key Derivation Function algorithm is sufficiently strong", + "fullDescription": "Some implementations of the Rfc2898DeriveBytes class allow for a hash algorithm to be specified in a constructor parameter or overwritten in the HashAlgorithm property. If a hash algorithm is specified, then it should be SHA-256 or higher.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5379", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseWeakKDFAlgorithm", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5380": { + "id": "CA5380", + "shortDescription": "Do Not Add Certificates To Root Store", + "fullDescription": "By default, the Trusted Root Certification Authorities certificate store is configured with a set of public CAs that has met the requirements of the Microsoft Root Certificate Program. Since all trusted root CAs can issue certificates for any domain, an attacker can pick a weak or coercible CA that you install by yourself to target for an attack - and a single vulnerable, malicious or coercible CA undermines the security of the entire system. To make matters worse, these attacks can go unnoticed quite easily.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5380", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotInstallRootCert", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5381": { + "id": "CA5381", + "shortDescription": "Ensure Certificates Are Not Added To Root Store", + "fullDescription": "By default, the Trusted Root Certification Authorities certificate store is configured with a set of public CAs that has met the requirements of the Microsoft Root Certificate Program. Since all trusted root CAs can issue certificates for any domain, an attacker can pick a weak or coercible CA that you install by yourself to target for an attack - and a single vulnerable, malicious or coercible CA undermines the security of the entire system. To make matters worse, these attacks can go unnoticed quite easily.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5381", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotInstallRootCert", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5382": { + "id": "CA5382", + "shortDescription": "Use Secure Cookies In ASP.NET Core", + "fullDescription": "Applications available over HTTPS must use secure cookies.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5382", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "UseSecureCookiesASPNetCore", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5383": { + "id": "CA5383", + "shortDescription": "Ensure Use Secure Cookies In ASP.NET Core", + "fullDescription": "Applications available over HTTPS must use secure cookies.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5383", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "UseSecureCookiesASPNetCore", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5384": { + "id": "CA5384", + "shortDescription": "Do Not Use Digital Signature Algorithm (DSA)", + "fullDescription": "DSA is too weak to use.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5384", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "DoNotUseDSA", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5385": { + "id": "CA5385", + "shortDescription": "Use Rivest-Shamir-Adleman (RSA) Algorithm With Sufficient Key Size", + "fullDescription": "Encryption algorithms are vulnerable to brute force attacks when too small a key size is used.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5385", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "UseRSAWithSufficientKeySize", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5386": { + "id": "CA5386", + "shortDescription": "Avoid hardcoding SecurityProtocolType value", + "fullDescription": "Avoid hardcoding SecurityProtocolType {0}, and instead use SecurityProtocolType.SystemDefault to allow the operating system to choose the best Transport Layer Security protocol to use.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5386", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseDeprecatedSecurityProtocols", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5387": { + "id": "CA5387", + "shortDescription": "Do Not Use Weak Key Derivation Function With Insufficient Iteration Count", + "fullDescription": "When deriving cryptographic keys from user-provided inputs such as password, use sufficient iteration count (at least 100k).", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5387", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseWeakKDFInsufficientIterationCount", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5388": { + "id": "CA5388", + "shortDescription": "Ensure Sufficient Iteration Count When Using Weak Key Derivation Function", + "fullDescription": "When deriving cryptographic keys from user-provided inputs such as password, use sufficient iteration count (at least 100k).", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5388", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseWeakKDFInsufficientIterationCount", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5389": { + "id": "CA5389", + "shortDescription": "Do Not Add Archive Item's Path To The Target File System Path", + "fullDescription": "When extracting files from an archive and using the archive item's path, check if the path is safe. Archive path can be relative and can lead to file system access outside of the expected file system target path, leading to malicious config changes and remote code execution via lay-and-wait technique.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5389", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotAddArchiveItemPathToTheTargetFileSystemPath", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5390": { + "id": "CA5390", + "shortDescription": "Do not hard-code encryption key", + "fullDescription": "SymmetricAlgorithm's .Key property, or a method's rgbKey parameter, should never be a hard-coded value.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5390", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotHardCodeEncryptionKey", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5391": { + "id": "CA5391", + "shortDescription": "Use antiforgery tokens in ASP.NET Core MVC controllers", + "fullDescription": "Handling a POST, PUT, PATCH, or DELETE request without validating an antiforgery token may be vulnerable to cross-site request forgery attacks. A cross-site request forgery attack can send malicious requests from an authenticated user to your ASP.NET Core MVC controller.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5391", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "UseAutoValidateAntiforgeryToken", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5392": { + "id": "CA5392", + "shortDescription": "Use DefaultDllImportSearchPaths attribute for P/Invokes", + "fullDescription": "By default, P/Invokes using DllImportAttribute probe a number of directories, including the current working directory for the library to load. This can be a security issue for certain applications, leading to DLL hijacking.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5392", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "UseDefaultDllImportSearchPathsAttribute", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5393": { + "id": "CA5393", + "shortDescription": "Do not use unsafe DllImportSearchPath value", + "fullDescription": "There could be a malicious DLL in the default DLL search directories. Or, depending on where your application is run from, there could be a malicious DLL in the application's directory. Use a DllImportSearchPath value that specifies an explicit search path instead. The DllImportSearchPath flags that this rule looks for can be configured in .editorconfig.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5393", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "UseDefaultDllImportSearchPathsAttribute", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5394": { + "id": "CA5394", + "shortDescription": "Do not use insecure randomness", + "fullDescription": "Using a cryptographically weak pseudo-random number generator may allow an attacker to predict what security-sensitive value will be generated. Use a cryptographically strong random number generator if an unpredictable value is required, or ensure that weak pseudo-random numbers aren't used in a security-sensitive manner.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5394", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseInsecureRandomness", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5395": { + "id": "CA5395", + "shortDescription": "Miss HttpVerb attribute for action methods", + "fullDescription": "All the methods that create, edit, delete, or otherwise modify data do so in the [HttpPost] overload of the method, which needs to be protected with the anti forgery attribute from request forgery. Performing a GET operation should be a safe operation that has no side effects and doesn't modify your persisted data.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5395", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "UseAutoValidateAntiforgeryToken", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5396": { + "id": "CA5396", + "shortDescription": "Set HttpOnly to true for HttpCookie", + "fullDescription": "As a defense in depth measure, ensure security sensitive HTTP cookies are marked as HttpOnly. This indicates web browsers should disallow scripts from accessing the cookies. Injected malicious scripts are a common way of stealing cookies.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5396", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "SetHttpOnlyForHttpCookie", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5397": { + "id": "CA5397", + "shortDescription": "Do not use deprecated SslProtocols values", + "fullDescription": "Older protocol versions of Transport Layer Security (TLS) are less secure than TLS 1.2 and TLS 1.3, and are more likely to have new vulnerabilities. Avoid older protocol versions to minimize risk.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5397", + "properties": { + "category": "Security", + "isEnabledByDefault": true, + "typeName": "SslProtocolsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5398": { + "id": "CA5398", + "shortDescription": "Avoid hardcoded SslProtocols values", + "fullDescription": "Current Transport Layer Security protocol versions may become deprecated if vulnerabilities are found. Avoid hardcoding SslProtocols values to keep your application secure. Use 'None' to let the Operating System choose a version.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5398", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "SslProtocolsAnalyzer", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5399": { + "id": "CA5399", + "shortDescription": "HttpClients should enable certificate revocation list checks", + "fullDescription": "Using HttpClient without providing a platform specific handler (WinHttpHandler or CurlHandler or HttpClientHandler) where the CheckCertificateRevocationList property is set to true, will allow revoked certificates to be accepted by the HttpClient as valid.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5399", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotDisableHttpClientCRLCheck", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5400": { + "id": "CA5400", + "shortDescription": "Ensure HttpClient certificate revocation list check is not disabled", + "fullDescription": "Using HttpClient without providing a platform specific handler (WinHttpHandler or CurlHandler or HttpClientHandler) where the CheckCertificateRevocationList property is set to true, will allow revoked certificates to be accepted by the HttpClient as valid.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5400", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotDisableHttpClientCRLCheck", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5401": { + "id": "CA5401", + "shortDescription": "Do not use CreateEncryptor with non-default IV", + "fullDescription": "Symmetric encryption should always use a non-repeatable initialization vector to prevent dictionary attacks.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5401", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseCreateEncryptorWithNonDefaultIV", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5402": { + "id": "CA5402", + "shortDescription": "Use CreateEncryptor with the default IV", + "fullDescription": "Symmetric encryption should always use a non-repeatable initialization vector to prevent dictionary attacks.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5402", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotUseCreateEncryptorWithNonDefaultIV", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA5403": { + "id": "CA5403", + "shortDescription": "Do not hard-code certificate", + "fullDescription": "Hard-coded certificates in source code are vulnerable to being exploited.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5403", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotHardCodeCertificate", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5404": { + "id": "CA5404", + "shortDescription": "Do not disable token validation checks", + "fullDescription": "Token validation checks ensure that while validating tokens, all aspects are analyzed and verified. Turning off validation can lead to security holes by allowing untrusted tokens to make it through validation.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5404", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotDisableTokenValidationChecks", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA5405": { + "id": "CA5405", + "shortDescription": "Do not always skip token validation in delegates", + "fullDescription": "By setting critical TokenValidationParameter validation delegates to true, important authentication safeguards are disabled which can lead to tokens from any issuer or expired tokens being wrongly validated.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5405", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "DoNotAlwaysSkipTokenValidationInDelegates", + "languages": [ + "C#", + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + } + } + }, + { + "tool": { + "name": "Microsoft.CodeAnalysis.VisualBasic.NetAnalyzers", + "version": "10.0.300", + "language": "en-US" + }, + "rules": { + "CA1032": { + "id": "CA1032", + "shortDescription": "Implement standard exception constructors", + "fullDescription": "Failure to provide the full set of constructors can make it difficult to correctly handle exceptions.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1032", + "properties": { + "category": "Design", + "isEnabledByDefault": false, + "typeName": "BasicImplementStandardExceptionConstructorsAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1200": { + "id": "CA1200", + "shortDescription": "Avoid using cref tags with a prefix", + "fullDescription": "Use of cref tags with prefixes should be avoided, since it prevents the compiler from verifying references and the IDE from updating references during refactorings. It is permissible to suppress this error at a single documentation site if the cref must use a prefix because the type being mentioned is not findable by the compiler. For example, if a cref is mentioning a special attribute in the full framework but you're in a file that compiles against the portable framework, or if you want to reference a type at higher layer of Roslyn, you should suppress the error. You should not suppress the error just because you want to take a shortcut and avoid using the full syntax.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1200", + "properties": { + "category": "Documentation", + "isEnabledByDefault": true, + "typeName": "BasicAvoidUsingCrefTagsWithAPrefixAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1309": { + "id": "CA1309", + "shortDescription": "Use ordinal string comparison", + "fullDescription": "A string comparison operation that is nonlinguistic does not set the StringComparison parameter to either Ordinal or OrdinalIgnoreCase. By explicitly setting the parameter to either StringComparison.Ordinal or StringComparison.OrdinalIgnoreCase, your code often gains speed, becomes more correct, and becomes more reliable.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1309", + "properties": { + "category": "Globalization", + "isEnabledByDefault": true, + "typeName": "BasicUseOrdinalStringComparisonAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1311": { + "id": "CA1311", + "shortDescription": "Specify a culture or use an invariant version", + "fullDescription": "Specify culture to help avoid accidental implicit dependency on current culture. Using an invariant version yields consistent results regardless of the culture of an application.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1311", + "properties": { + "category": "Globalization", + "isEnabledByDefault": true, + "typeName": "BasicSpecifyCultureForToLowerAndToUpperAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1507": { + "id": "CA1507", + "shortDescription": "Use nameof to express symbol names", + "fullDescription": "Using nameof helps keep your code valid when refactoring.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1507", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": true, + "typeName": "BasicUseNameofInPlaceOfStringAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1508": { + "id": "CA1508", + "shortDescription": "Avoid dead conditional code", + "fullDescription": "'{0}' is never '{1}'. Remove or refactor the condition(s) to avoid dead code.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1508", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": false, + "typeName": "BasicAvoidDeadConditionalCode", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1515": { + "id": "CA1515", + "shortDescription": "Consider making public types internal", + "fullDescription": "Unlike a class library, an application's API isn't typically referenced publicly, so types can be marked internal.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1515", + "properties": { + "category": "Maintainability", + "isEnabledByDefault": false, + "typeName": "BasicMakeTypesInternal", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1802": { + "id": "CA1802", + "shortDescription": "Use literals where appropriate", + "fullDescription": "A field is declared static and read-only (Shared and ReadOnly in Visual Basic), and is initialized by using a value that is computable at compile time. Because the value that is assigned to the targeted field is computable at compile time, change the declaration to a const (Const in Visual Basic) field so that the value is computed at compile time instead of at runtime.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1802", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "BasicUseLiteralsWhereAppropriate", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1805": { + "id": "CA1805", + "shortDescription": "Do not initialize unnecessarily", + "fullDescription": "The .NET runtime initializes all fields of reference types to their default values before running the constructor. In most cases, explicitly initializing a field to its default value in a constructor is redundant, adding maintenance costs and potentially degrading performance (such as with increased assembly size), and the explicit initialization can be removed. In some cases, such as with static readonly fields that permanently retain their default value, consider instead changing them to be constants or properties.", + "defaultLevel": "hidden", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1805", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "BasicDoNotInitializeUnnecessarilyAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1812": { + "id": "CA1812", + "shortDescription": "Avoid uninstantiated internal classes", + "fullDescription": "An instance of an assembly-level type is not created by code in the assembly.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1812", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "BasicAvoidUninstantiatedInternalClasses", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode", + "CompilationEnd" + ] + } + }, + "CA1824": { + "id": "CA1824", + "shortDescription": "Mark assemblies with NeutralResourcesLanguageAttribute", + "fullDescription": "The NeutralResourcesLanguage attribute informs the ResourceManager of the language that was used to display the resources of a neutral culture for an assembly. This improves lookup performance for the first resource that you load and can reduce your working set.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1824", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "BasicMarkAssembliesWithNeutralResourcesLanguageAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1825": { + "id": "CA1825", + "shortDescription": "Avoid zero-length array allocations", + "fullDescription": "Avoid unnecessary zero-length array allocations. Use {0} instead.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1825", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "BasicAvoidZeroLengthArrayAllocationsAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1841": { + "id": "CA1841", + "shortDescription": "Prefer Dictionary.Contains methods", + "fullDescription": "Many dictionary implementations lazily initialize the Values collection. To avoid unnecessary allocations, prefer 'ContainsValue' over 'Values.Contains'.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1841", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "BasicPreferDictionaryContainsMethods", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1845": { + "id": "CA1845", + "shortDescription": "Use span-based 'string.Concat'", + "fullDescription": "It is more efficient to use 'AsSpan' and 'string.Concat', instead of 'Substring' and a concatenation operator.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1845", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "BasicUseSpanBasedStringConcat", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1851": { + "id": "CA1851", + "shortDescription": "Possible multiple enumerations of 'IEnumerable' collection", + "fullDescription": "Possible multiple enumerations of 'IEnumerable' collection. Consider using an implementation that avoids multiple enumerations.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1851", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "BasicAvoidMultipleEnumerationsAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Dataflow", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1865": { + "id": "CA1865", + "shortDescription": "Use char overload", + "fullDescription": "The char overload is a better performing overload than a string with a single char.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1865", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "BasicUseStringMethodCharOverloadWithSingleCharacters", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1866": { + "id": "CA1866", + "shortDescription": "Use char overload", + "fullDescription": "The char overload is a better performing overload than a string with a single char.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1866", + "properties": { + "category": "Performance", + "isEnabledByDefault": true, + "typeName": "BasicUseStringMethodCharOverloadWithSingleCharacters", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA1867": { + "id": "CA1867", + "shortDescription": "Use char overload", + "fullDescription": "The char overload is a better performing overload than a string with a single char.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1867", + "properties": { + "category": "Performance", + "isEnabledByDefault": false, + "typeName": "BasicUseStringMethodCharOverloadWithSingleCharacters", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2016": { + "id": "CA2016", + "shortDescription": "Forward the 'CancellationToken' parameter to methods", + "fullDescription": "Forward the 'CancellationToken' parameter to methods to ensure the operation cancellation notifications gets properly propagated, or pass in 'CancellationToken.None' explicitly to indicate intentionally not propagating the token.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2016", + "properties": { + "category": "Reliability", + "isEnabledByDefault": true, + "typeName": "BasicForwardCancellationTokenToInvocationsAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2218": { + "id": "CA2218", + "shortDescription": "Override GetHashCode on overriding Equals", + "fullDescription": "GetHashCode returns a value, based on the current instance, that is suited for hashing algorithms and data structures such as a hash table. Two objects that are the same type and are equal must return the same hash code.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2218", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "BasicOverrideGetHashCodeOnOverridingEqualsAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2224": { + "id": "CA2224", + "shortDescription": "Override Equals on overloading operator equals", + "fullDescription": "A public type implements the equality operator but does not override Object.Equals.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2224", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "BasicOverrideEqualsOnOverloadingOperatorEqualsAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2234": { + "id": "CA2234", + "shortDescription": "Pass system uri objects instead of strings", + "fullDescription": "A call is made to a method that has a string parameter whose name contains \"uri\", \"URI\", \"urn\", \"URN\", \"url\", or \"URL\". The declaring type of the method contains a corresponding method overload that has a System.Uri parameter.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2234", + "properties": { + "category": "Usage", + "isEnabledByDefault": false, + "typeName": "BasicPassSystemUriObjectsInsteadOfStringsAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "PortedFromFxCop", + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2252": { + "id": "CA2252", + "shortDescription": "This API requires opting into preview features", + "fullDescription": "An assembly has to opt into preview features before using them.", + "defaultLevel": "error", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2252", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "BasicDetectPreviewFeatureAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2263": { + "id": "CA2263", + "shortDescription": "Prefer generic overload when type is known", + "fullDescription": "Using a generic overload is preferable to the 'System.Type' overload when the type is known, promoting cleaner and more type-safe code with improved compile-time checks.", + "defaultLevel": "note", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2263", + "properties": { + "category": "Usage", + "isEnabledByDefault": true, + "typeName": "BasicPreferGenericOverloadsAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2352": { + "id": "CA2352", + "shortDescription": "Unsafe DataSet or DataTable in serializable type can be vulnerable to remote code execution attacks", + "fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2352", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "BasicDataSetDataTableInSerializableTypeAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2353": { + "id": "CA2353", + "shortDescription": "Unsafe DataSet or DataTable in serializable type", + "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2353", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "BasicDataSetDataTableInSerializableTypeAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2354": { + "id": "CA2354", + "shortDescription": "Unsafe DataSet or DataTable in deserialized object graph can be vulnerable to remote code execution attacks", + "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2354", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "BasicDataSetDataTableInIFormatterSerializableObjectGraphAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2355": { + "id": "CA2355", + "shortDescription": "Unsafe DataSet or DataTable type found in deserializable object graph", + "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2355", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "BasicDataSetDataTableInSerializableObjectGraphAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2356": { + "id": "CA2356", + "shortDescription": "Unsafe DataSet or DataTable type in web deserializable object graph", + "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2356", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "BasicDataSetDataTableInWebSerializableObjectGraphAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + }, + "CA2362": { + "id": "CA2362", + "shortDescription": "Unsafe DataSet or DataTable in auto-generated serializable type can be vulnerable to remote code execution attacks", + "fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the auto-generated type is never deserialized with untrusted data.", + "defaultLevel": "warning", + "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2362", + "properties": { + "category": "Security", + "isEnabledByDefault": false, + "typeName": "BasicDataSetDataTableInSerializableTypeAnalyzer", + "languages": [ + "Visual Basic" + ], + "tags": [ + "Telemetry", + "EnabledRuleInAggressiveMode" + ] + } + } + } + } + ] +} \ No newline at end of file diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs index f1aaad627cad..cf46b2cfad44 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs @@ -1,11 +1,10 @@ // Copyright (c) Microsoft. All Rights Reserved. Licensed under the MIT license. See License.txt in the project root for license information. -using System.Threading.Tasks; +using Microsoft.CodeAnalysis.CSharp; using Microsoft.CodeAnalysis.Testing; -using Xunit; using VerifyCS = Test.Utilities.CSharpSecurityCodeFixVerifier< Microsoft.NetCore.CSharp.Analyzers.Usage.CSharpMissingShebangInFileBasedProgram, - Microsoft.CodeAnalysis.Testing.EmptyCodeFixProvider>; + Microsoft.NetCore.CSharp.Analyzers.Usage.CSharpMissingShebangInFileBasedProgramFixer>; namespace Microsoft.NetCore.Analyzers.Usage.UnitTests { @@ -86,6 +85,51 @@ public async Task NonEntryPointFile_MultipleFiles_NoDiagnosticAsync() }.RunAsync(); } + [Fact] + public async Task EntryPointWithoutShebang_CodeFixAddsShebangAsync() + { + // Verify that the code fix prepends a shebang line. + await new VerifyCS.Test + { + TestState = + { + Sources = + { + ("Test0.cs", """class Program { static void Main() { } }"""), + ("Util.cs", """class Util { public static string Greet() => "hello"; }"""), + }, + AnalyzerConfigFiles = { ("/.globalconfig", GlobalConfig) }, + ExpectedDiagnostics = + { + new DiagnosticResult(MissingShebangInFileBasedProgram.Rule).WithLocation("Test0.cs", 1, 1), + }, + }, + FixedState = + { + Sources = + { + ("Test0.cs", """ + #!/usr/bin/env dotnet + class Program { static void Main() { } } + """), + ("Util.cs", """class Util { public static string Greet() => "hello"; }"""), + }, + }, + CodeFixTestBehaviors = CodeFixTestBehaviors.SkipLocalDiagnosticCheck, + SolutionTransforms = + { + (solution, projectId) => + { + // Enable #! shebang support in the parser. + var parseOptions = (CSharpParseOptions)solution.GetProject(projectId)!.ParseOptions!; + return solution.WithProjectParseOptions(projectId, + parseOptions.WithFeatures(parseOptions.Features.Concat( + [new KeyValuePair("FileBasedProgram", "true")]))); + }, + }, + }.RunAsync(); + } + [Fact] public async Task EmptyEntryPointFilePath_NoDiagnosticAsync() { From e9f62547b09250f4fbacec1d570701802c079e9b Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Sat, 28 Mar 2026 11:30:55 +0100 Subject: [PATCH 07/11] Fixup --- src/Cli/dotnet/Commands/Run/CSharpCompilerCommand.Generated.cs | 2 +- .../targets/Microsoft.NET.Sdk.Analyzers.targets | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/src/Cli/dotnet/Commands/Run/CSharpCompilerCommand.Generated.cs b/src/Cli/dotnet/Commands/Run/CSharpCompilerCommand.Generated.cs index 26691640b7db..235b8ce8501b 100644 --- a/src/Cli/dotnet/Commands/Run/CSharpCompilerCommand.Generated.cs +++ b/src/Cli/dotnet/Commands/Run/CSharpCompilerCommand.Generated.cs @@ -165,12 +165,12 @@ private string GetGeneratedMSBuildEditorConfigContent() build_property.InvariantGlobalization = build_property.PlatformNeutralAssembly = build_property.EnforceExtendedAnalyzerRules = +build_property.EntryPointFilePath = {EntryPointFileFullPath} build_property._SupportedPlatformList = Linux,macOS,Windows build_property.RootNamespace = {FileNameWithoutExtension} build_property.ProjectDir = {BaseDirectoryWithTrailingSeparator} build_property.EnableComHosting = build_property.EnableGeneratedComInterfaceComImportInterop = false -build_property.EntryPointFilePath = {EntryPointFileFullPath} build_property.EffectiveAnalysisLevelStyle = {TargetFrameworkVersion} build_property.EnableCodeStyleSeverity = diff --git a/src/Tasks/Microsoft.NET.Build.Tasks/targets/Microsoft.NET.Sdk.Analyzers.targets b/src/Tasks/Microsoft.NET.Build.Tasks/targets/Microsoft.NET.Sdk.Analyzers.targets index 997e38042fd9..0c206deb1e52 100644 --- a/src/Tasks/Microsoft.NET.Build.Tasks/targets/Microsoft.NET.Sdk.Analyzers.targets +++ b/src/Tasks/Microsoft.NET.Build.Tasks/targets/Microsoft.NET.Sdk.Analyzers.targets @@ -145,7 +145,6 @@ Copyright (c) .NET Foundation. All rights reserved. --> - From 39f4c9568808f1a2d02272cceb3f1d7970d46d5f Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Sat, 28 Mar 2026 11:32:45 +0100 Subject: [PATCH 08/11] Remove tmp file --- ...-Microsoft.CodeAnalysis.NetAnalyzers.sarif | 7115 ----------------- 1 file changed, 7115 deletions(-) delete mode 100644 src/Microsoft.CodeAnalysis.NetAnalyzers/src/temp-Microsoft.CodeAnalysis.NetAnalyzers.sarif diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/temp-Microsoft.CodeAnalysis.NetAnalyzers.sarif b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/temp-Microsoft.CodeAnalysis.NetAnalyzers.sarif deleted file mode 100644 index 1d2bb3538904..000000000000 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/temp-Microsoft.CodeAnalysis.NetAnalyzers.sarif +++ /dev/null @@ -1,7115 +0,0 @@ -{ - "$schema": "http://json.schemastore.org/sarif-1.0.0", - "version": "1.0.0", - "runs": [ - { - "tool": { - "name": "Microsoft.CodeAnalysis.CSharp.NetAnalyzers", - "version": "10.0.300", - "language": "en-US" - }, - "rules": { - "CA1032": { - "id": "CA1032", - "shortDescription": "Implement standard exception constructors", - "fullDescription": "Failure to provide the full set of constructors can make it difficult to correctly handle exceptions.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1032", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "CSharpImplementStandardExceptionConstructorsAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1200": { - "id": "CA1200", - "shortDescription": "Avoid using cref tags with a prefix", - "fullDescription": "Use of cref tags with prefixes should be avoided, since it prevents the compiler from verifying references and the IDE from updating references during refactorings. It is permissible to suppress this error at a single documentation site if the cref must use a prefix because the type being mentioned is not findable by the compiler. For example, if a cref is mentioning a special attribute in the full framework but you're in a file that compiles against the portable framework, or if you want to reference a type at higher layer of Roslyn, you should suppress the error. You should not suppress the error just because you want to take a shortcut and avoid using the full syntax.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1200", - "properties": { - "category": "Documentation", - "isEnabledByDefault": true, - "typeName": "CSharpAvoidUsingCrefTagsWithAPrefixAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1309": { - "id": "CA1309", - "shortDescription": "Use ordinal string comparison", - "fullDescription": "A string comparison operation that is nonlinguistic does not set the StringComparison parameter to either Ordinal or OrdinalIgnoreCase. By explicitly setting the parameter to either StringComparison.Ordinal or StringComparison.OrdinalIgnoreCase, your code often gains speed, becomes more correct, and becomes more reliable.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1309", - "properties": { - "category": "Globalization", - "isEnabledByDefault": true, - "typeName": "CSharpUseOrdinalStringComparisonAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1311": { - "id": "CA1311", - "shortDescription": "Specify a culture or use an invariant version", - "fullDescription": "Specify culture to help avoid accidental implicit dependency on current culture. Using an invariant version yields consistent results regardless of the culture of an application.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1311", - "properties": { - "category": "Globalization", - "isEnabledByDefault": true, - "typeName": "CSharpSpecifyCultureForToLowerAndToUpperAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1507": { - "id": "CA1507", - "shortDescription": "Use nameof to express symbol names", - "fullDescription": "Using nameof helps keep your code valid when refactoring.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1507", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": true, - "typeName": "CSharpUseNameofInPlaceOfStringAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1508": { - "id": "CA1508", - "shortDescription": "Avoid dead conditional code", - "fullDescription": "'{0}' is never '{1}'. Remove or refactor the condition(s) to avoid dead code.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1508", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": false, - "typeName": "CSharpAvoidDeadConditionalCode", - "languages": [ - "C#" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1515": { - "id": "CA1515", - "shortDescription": "Consider making public types internal", - "fullDescription": "Unlike a class library, an application's API isn't typically referenced publicly, so types can be marked internal.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1515", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": false, - "typeName": "CSharpMakeTypesInternal", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1516": { - "id": "CA1516", - "shortDescription": "Use cross-platform intrinsics", - "fullDescription": "This rule detects usage of platform-specific intrinsics that can be replaced with an equivalent cross-platform intrinsic instead.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1516", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": true, - "typeName": "CSharpUseCrossPlatformIntrinsicsAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1802": { - "id": "CA1802", - "shortDescription": "Use literals where appropriate", - "fullDescription": "A field is declared static and read-only (Shared and ReadOnly in Visual Basic), and is initialized by using a value that is computable at compile time. Because the value that is assigned to the targeted field is computable at compile time, change the declaration to a const (Const in Visual Basic) field so that the value is computed at compile time instead of at runtime.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1802", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "CSharpUseLiteralsWhereAppropriate", - "languages": [ - "C#" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1805": { - "id": "CA1805", - "shortDescription": "Do not initialize unnecessarily", - "fullDescription": "The .NET runtime initializes all fields of reference types to their default values before running the constructor. In most cases, explicitly initializing a field to its default value in a constructor is redundant, adding maintenance costs and potentially degrading performance (such as with increased assembly size), and the explicit initialization can be removed. In some cases, such as with static readonly fields that permanently retain their default value, consider instead changing them to be constants or properties.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1805", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpDoNotInitializeUnnecessarilyAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1812": { - "id": "CA1812", - "shortDescription": "Avoid uninstantiated internal classes", - "fullDescription": "An instance of an assembly-level type is not created by code in the assembly.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1812", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "CSharpAvoidUninstantiatedInternalClasses", - "languages": [ - "C#" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA1824": { - "id": "CA1824", - "shortDescription": "Mark assemblies with NeutralResourcesLanguageAttribute", - "fullDescription": "The NeutralResourcesLanguage attribute informs the ResourceManager of the language that was used to display the resources of a neutral culture for an assembly. This improves lookup performance for the first resource that you load and can reduce your working set.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1824", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpMarkAssembliesWithNeutralResourcesLanguageAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1825": { - "id": "CA1825", - "shortDescription": "Avoid zero-length array allocations", - "fullDescription": "Avoid unnecessary zero-length array allocations. Use {0} instead.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1825", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpAvoidZeroLengthArrayAllocationsAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1841": { - "id": "CA1841", - "shortDescription": "Prefer Dictionary.Contains methods", - "fullDescription": "Many dictionary implementations lazily initialize the Values collection. To avoid unnecessary allocations, prefer 'ContainsValue' over 'Values.Contains'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1841", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpPreferDictionaryContainsMethods", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1845": { - "id": "CA1845", - "shortDescription": "Use span-based 'string.Concat'", - "fullDescription": "It is more efficient to use 'AsSpan' and 'string.Concat', instead of 'Substring' and a concatenation operator.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1845", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpUseSpanBasedStringConcat", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1851": { - "id": "CA1851", - "shortDescription": "Possible multiple enumerations of 'IEnumerable' collection", - "fullDescription": "Possible multiple enumerations of 'IEnumerable' collection. Consider using an implementation that avoids multiple enumerations.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1851", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "CSharpAvoidMultipleEnumerationsAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1855": { - "id": "CA1855", - "shortDescription": "Prefer 'Clear' over 'Fill'", - "fullDescription": "It is more efficient to use 'Clear', instead of 'Fill' with default value.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1855", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpUseSpanClearInsteadOfFillAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1856": { - "id": "CA1856", - "shortDescription": "Incorrect usage of ConstantExpected attribute", - "fullDescription": "ConstantExpected attribute is not applied correctly on the parameter.", - "defaultLevel": "error", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1856", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpConstantExpectedAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1857": { - "id": "CA1857", - "shortDescription": "A constant is expected for the parameter", - "fullDescription": "The parameter expects a constant for optimal performance.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1857", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpConstantExpectedAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1865": { - "id": "CA1865", - "shortDescription": "Use char overload", - "fullDescription": "The char overload is a better performing overload than a string with a single char.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1865", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpUseStringMethodCharOverloadWithSingleCharacters", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1866": { - "id": "CA1866", - "shortDescription": "Use char overload", - "fullDescription": "The char overload is a better performing overload than a string with a single char.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1866", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpUseStringMethodCharOverloadWithSingleCharacters", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1867": { - "id": "CA1867", - "shortDescription": "Use char overload", - "fullDescription": "The char overload is a better performing overload than a string with a single char.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1867", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "CSharpUseStringMethodCharOverloadWithSingleCharacters", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1870": { - "id": "CA1870", - "shortDescription": "Use a cached 'SearchValues' instance", - "fullDescription": "Using a cached 'SearchValues' instance is more efficient than passing values to 'IndexOfAny'/'ContainsAny' directly.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1870", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "CSharpUseSearchValuesAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2014": { - "id": "CA2014", - "shortDescription": "Do not use stackalloc in loops", - "fullDescription": "Stack space allocated by a stackalloc is only released at the end of the current method's invocation. Using it in a loop can result in unbounded stack growth and eventual stack overflow conditions.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2014", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "CSharpDoNotUseStackallocInLoopsAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2016": { - "id": "CA2016", - "shortDescription": "Forward the 'CancellationToken' parameter to methods", - "fullDescription": "Forward the 'CancellationToken' parameter to methods to ensure the operation cancellation notifications gets properly propagated, or pass in 'CancellationToken.None' explicitly to indicate intentionally not propagating the token.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2016", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "CSharpForwardCancellationTokenToInvocationsAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2020": { - "id": "CA2020", - "shortDescription": "Prevent behavioral change", - "fullDescription": "Some built-in operators added in .NET 7 behave differently when overflowing than did the corresponding user-defined operators in .NET 6 and earlier versions. Some operators that previously threw in an unchecked context now don't throw unless wrapped within a checked context. Also, some operators that did not previously throw in a checked context now throw unless wrapped in an unchecked context.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2020", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "CSharpPreventNumericIntPtrUIntPtrBehavioralChanges", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2234": { - "id": "CA2234", - "shortDescription": "Pass system uri objects instead of strings", - "fullDescription": "A call is made to a method that has a string parameter whose name contains \"uri\", \"URI\", \"urn\", \"URN\", \"url\", or \"URL\". The declaring type of the method contains a corresponding method overload that has a System.Uri parameter.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2234", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "CSharpPassSystemUriObjectsInsteadOfStringsAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2252": { - "id": "CA2252", - "shortDescription": "This API requires opting into preview features", - "fullDescription": "An assembly has to opt into preview features before using them.", - "defaultLevel": "error", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2252", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "CSharpDetectPreviewFeatureAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2260": { - "id": "CA2260", - "shortDescription": "Use correct type parameter", - "fullDescription": "Generic math interfaces require the derived type itself to be used for the self recurring type parameter.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2260", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "CSharpImplementGenericMathInterfacesCorrectly", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2263": { - "id": "CA2263", - "shortDescription": "Prefer generic overload when type is known", - "fullDescription": "Using a generic overload is preferable to the 'System.Type' overload when the type is known, promoting cleaner and more type-safe code with improved compile-time checks.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2263", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "CSharpPreferGenericOverloadsAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2266": { - "id": "CA2266", - "shortDescription": "File-based program entry point should start with '#!'", - "fullDescription": "When a file-based program consists of multiple files, the entry point file should start with a shebang ('#!') line to clearly distinguish it from other included files.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2266", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "CSharpMissingShebangInFileBasedProgram", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2352": { - "id": "CA2352", - "shortDescription": "Unsafe DataSet or DataTable in serializable type can be vulnerable to remote code execution attacks", - "fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2352", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "CSharpDataSetDataTableInSerializableTypeAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2353": { - "id": "CA2353", - "shortDescription": "Unsafe DataSet or DataTable in serializable type", - "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2353", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "CSharpDataSetDataTableInSerializableTypeAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2354": { - "id": "CA2354", - "shortDescription": "Unsafe DataSet or DataTable in deserialized object graph can be vulnerable to remote code execution attacks", - "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2354", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "CSharpDataSetDataTableInIFormatterSerializableObjectGraphAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2355": { - "id": "CA2355", - "shortDescription": "Unsafe DataSet or DataTable type found in deserializable object graph", - "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2355", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "CSharpDataSetDataTableInSerializableObjectGraphAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2356": { - "id": "CA2356", - "shortDescription": "Unsafe DataSet or DataTable type in web deserializable object graph", - "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2356", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "CSharpDataSetDataTableInWebSerializableObjectGraphAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2362": { - "id": "CA2362", - "shortDescription": "Unsafe DataSet or DataTable in auto-generated serializable type can be vulnerable to remote code execution attacks", - "fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the auto-generated type is never deserialized with untrusted data.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2362", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "CSharpDataSetDataTableInSerializableTypeAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - } - } - }, - { - "tool": { - "name": "Microsoft.CodeAnalysis.NetAnalyzers", - "version": "10.0.300", - "language": "en-US" - }, - "rules": { - "CA1000": { - "id": "CA1000", - "shortDescription": "Do not declare static members on generic types", - "fullDescription": "When a static member of a generic type is called, the type argument must be specified for the type. When a generic instance member that does not support inference is called, the type argument must be specified for the member. In these two cases, the syntax for specifying the type argument is different and easily confused.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1000", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "DoNotDeclareStaticMembersOnGenericTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1001": { - "id": "CA1001", - "shortDescription": "Types that own disposable fields should be disposable", - "fullDescription": "A class declares and implements an instance field that is a System.IDisposable type, and the class does not implement IDisposable. A class that declares an IDisposable field indirectly owns an unmanaged resource and should implement the IDisposable interface.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1001", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "TypesThatOwnDisposableFieldsShouldBeDisposableAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1002": { - "id": "CA1002", - "shortDescription": "Do not expose generic lists", - "fullDescription": "System.Collections.Generic.List is a generic collection that's designed for performance and not inheritance. List does not contain virtual members that make it easier to change the behavior of an inherited class.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1002", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "DoNotExposeGenericLists", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1003": { - "id": "CA1003", - "shortDescription": "Use generic event handler instances", - "fullDescription": "A type contains an event that declares an EventHandler delegate that returns void, whose signature contains two parameters (the first an object and the second a type that is assignable to EventArgs), and the containing assembly targets Microsoft .NET Framework?2.0.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1003", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "UseGenericEventHandlerInstancesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1005": { - "id": "CA1005", - "shortDescription": "Avoid excessive parameters on generic types", - "fullDescription": "The more type parameters a generic type contains, the more difficult it is to know and remember what each type parameter represents.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1005", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "AvoidExcessiveParametersOnGenericTypes", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry" - ] - } - }, - "CA1008": { - "id": "CA1008", - "shortDescription": "Enums should have zero value", - "fullDescription": "The default value of an uninitialized enumeration, just as other value types, is zero. A nonflags-attributed enumeration should define a member by using the value of zero so that the default value is a valid value of the enumeration. If an enumeration that has the FlagsAttribute attribute applied defines a zero-valued member, its name should be \"\"None\"\" to indicate that no values have been set in the enumeration.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1008", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "EnumsShouldHaveZeroValueAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode", - "RuleNoZero" - ] - } - }, - "CA1010": { - "id": "CA1010", - "shortDescription": "Generic interface should also be implemented", - "fullDescription": "To broaden the usability of a type, implement one of the generic interfaces. This is especially true for collections as they can then be used to populate generic collection types.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1010", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "CollectionsShouldImplementGenericInterfaceAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1012": { - "id": "CA1012", - "shortDescription": "Abstract types should not have public constructors", - "fullDescription": "Constructors on abstract types can be called only by derived types. Because public constructors create instances of a type, and you cannot create instances of an abstract type, an abstract type that has a public constructor is incorrectly designed.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1012", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "AbstractTypesShouldNotHaveConstructorsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1014": { - "id": "CA1014", - "shortDescription": "Mark assemblies with CLSCompliant", - "fullDescription": "The Common Language Specification (CLS) defines naming restrictions, data types, and rules to which assemblies must conform if they will be used across programming languages. Good design dictates that all assemblies explicitly indicate CLS compliance by using CLSCompliantAttribute . If this attribute is not present on an assembly, the assembly is not compliant.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1014", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "MarkAssembliesWithAttributesDiagnosticAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "CompilationEnd" - ] - } - }, - "CA1016": { - "id": "CA1016", - "shortDescription": "Mark assemblies with assembly version", - "fullDescription": "The .NET Framework uses the version number to uniquely identify an assembly, and to bind to types in strongly named assemblies. The version number is used together with version and publisher policy. By default, applications run only with the assembly version with which they were built.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1016", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "MarkAssembliesWithAttributesDiagnosticAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA1017": { - "id": "CA1017", - "shortDescription": "Mark assemblies with ComVisible", - "fullDescription": "ComVisibleAttribute determines how COM clients access managed code. Good design dictates that assemblies explicitly indicate COM visibility. COM visibility can be set for the whole assembly and then overridden for individual types and type members. If this attribute is not present, the contents of the assembly are visible to COM clients.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1017", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "MarkAssembliesWithComVisibleAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "CompilationEnd" - ] - } - }, - "CA1018": { - "id": "CA1018", - "shortDescription": "Mark attributes with AttributeUsageAttribute", - "fullDescription": "Specify AttributeUsage on {0}", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1018", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "MarkAttributesWithAttributeUsageAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1019": { - "id": "CA1019", - "shortDescription": "Define accessors for attribute arguments", - "fullDescription": "Remove the property setter from {0} or reduce its accessibility because it corresponds to positional argument {1}", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1019", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "DefineAccessorsForAttributeArgumentsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1021": { - "id": "CA1021", - "shortDescription": "Avoid out parameters", - "fullDescription": "Passing types by reference (using 'out' or 'ref') requires experience with pointers, understanding how value types and reference types differ, and handling methods with multiple return values. Also, the difference between 'out' and 'ref' parameters is not widely understood.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1021", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "AvoidOutParameters", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry" - ] - } - }, - "CA1024": { - "id": "CA1024", - "shortDescription": "Use properties where appropriate", - "fullDescription": "A public or protected method has a name that starts with \"\"Get\"\", takes no parameters, and returns a value that is not an array. The method might be a good candidate to become a property.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1024", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "UsePropertiesWhereAppropriateAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1027": { - "id": "CA1027", - "shortDescription": "Mark enums with FlagsAttribute", - "fullDescription": "An enumeration is a value type that defines a set of related named constants. Apply FlagsAttribute to an enumeration when its named constants can be meaningfully combined.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1027", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "EnumWithFlagsAttributeAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1028": { - "id": "CA1028", - "shortDescription": "Enum Storage should be Int32", - "fullDescription": "An enumeration is a value type that defines a set of related named constants. By default, the System.Int32 data type is used to store the constant value. Although you can change this underlying type, it is not required or recommended for most scenarios.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1028", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "EnumStorageShouldBeInt32Analyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1030": { - "id": "CA1030", - "shortDescription": "Use events where appropriate", - "fullDescription": "This rule detects methods that have names that ordinarily would be used for events. If a method is called in response to a clearly defined state change, the method should be invoked by an event handler. Objects that call the method should raise events instead of calling the method directly.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1030", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "UseEventsWhereAppropriateAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1031": { - "id": "CA1031", - "shortDescription": "Do not catch general exception types", - "fullDescription": "A general exception such as System.Exception or System.SystemException or a disallowed exception type is caught in a catch statement, or a general catch clause is used. General and disallowed exceptions should not be caught.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1031", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "DoNotCatchGeneralExceptionTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1033": { - "id": "CA1033", - "shortDescription": "Interface methods should be callable by child types", - "fullDescription": "An unsealed externally visible type provides an explicit method implementation of a public interface and does not provide an alternative externally visible method that has the same name.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1033", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "InterfaceMethodsShouldBeCallableByChildTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1034": { - "id": "CA1034", - "shortDescription": "Nested types should not be visible", - "fullDescription": "A nested type is a type that is declared in the scope of another type. Nested types are useful to encapsulate private implementation details of the containing type. Used for this purpose, nested types should not be externally visible.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1034", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "NestedTypesShouldNotBeVisibleAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1036": { - "id": "CA1036", - "shortDescription": "Override methods on comparable types", - "fullDescription": "A public or protected type implements the System.IComparable interface. It does not override Object.Equals nor does it overload the language-specific operator for equality, inequality, less than, less than or equal, greater than or greater than or equal.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1036", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "OverrideMethodsOnComparableTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1040": { - "id": "CA1040", - "shortDescription": "Avoid empty interfaces", - "fullDescription": "Interfaces define members that provide a behavior or usage contract. The functionality that is described by the interface can be adopted by any type, regardless of where the type appears in the inheritance hierarchy. A type implements an interface by providing implementations for the members of the interface. An empty interface does not define any members; therefore, it does not define a contract that can be implemented.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1040", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "AvoidEmptyInterfacesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1041": { - "id": "CA1041", - "shortDescription": "Provide ObsoleteAttribute message", - "fullDescription": "A type or member is marked by using a System.ObsoleteAttribute attribute that does not have its ObsoleteAttribute.Message property specified. When a type or member that is marked by using ObsoleteAttribute is compiled, the Message property of the attribute is displayed. This gives the user information about the obsolete type or member.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1041", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "ProvideObsoleteAttributeMessageAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1043": { - "id": "CA1043", - "shortDescription": "Use Integral Or String Argument For Indexers", - "fullDescription": "Indexers, that is, indexed properties, should use integer or string types for the index. These types are typically used for indexing data structures and increase the usability of the library. Use of the Object type should be restricted to those cases where the specific integer or string type cannot be specified at design time. If the design requires other types for the index, reconsider whether the type represents a logical data store. If it does not represent a logical data store, use a method.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1043", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "UseIntegralOrStringArgumentForIndexersAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1044": { - "id": "CA1044", - "shortDescription": "Properties should not be write only", - "fullDescription": "Although it is acceptable and often necessary to have a read-only property, the design guidelines prohibit the use of write-only properties. This is because letting a user set a value, and then preventing the user from viewing that value, does not provide any security. Also, without read access, the state of shared objects cannot be viewed, which limits their usefulness.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1044", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "PropertiesShouldNotBeWriteOnlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1045": { - "id": "CA1045", - "shortDescription": "Do not pass types by reference", - "fullDescription": "Passing types by reference (using out or ref) requires experience with pointers, understanding how value types and reference types differ, and handling methods that have multiple return values. Also, the difference between out and ref parameters is not widely understood.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1045", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "DoNotPassTypesByReference", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry" - ] - } - }, - "CA1046": { - "id": "CA1046", - "shortDescription": "Do not overload equality operator on reference types", - "fullDescription": "For reference types, the default implementation of the equality operator is almost always correct. By default, two references are equal only if they point to the same object. If the operator is providing meaningful value equality, the type should implement the generic 'System.IEquatable' interface.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1046", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "DoNotOverloadOperatorEqualsOnReferenceTypes", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1047": { - "id": "CA1047", - "shortDescription": "Do not declare protected member in sealed type", - "fullDescription": "Types declare protected members so that inheriting types can access or override the member. By definition, you cannot inherit from a sealed type, which means that protected methods on sealed types cannot be called.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1047", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "DoNotDeclareProtectedMembersInSealedTypes", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1050": { - "id": "CA1050", - "shortDescription": "Declare types in namespaces", - "fullDescription": "Types are declared in namespaces to prevent name collisions and as a way to organize related types in an object hierarchy.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1050", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "DeclareTypesInNamespacesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1051": { - "id": "CA1051", - "shortDescription": "Do not declare visible instance fields", - "fullDescription": "The primary use of a field should be as an implementation detail. Fields should be private or internal and should be exposed by using properties.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1051", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "DoNotDeclareVisibleInstanceFieldsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1052": { - "id": "CA1052", - "shortDescription": "Static holder types should be Static or NotInheritable", - "fullDescription": "Type '{0}' is a static holder type but is neither static nor NotInheritable", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1052", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "StaticHolderTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1054": { - "id": "CA1054", - "shortDescription": "URI-like parameters should not be strings", - "fullDescription": "This rule assumes that the parameter represents a Uniform Resource Identifier (URI). A string representation or a URI is prone to parsing and encoding errors, and can lead to security vulnerabilities. 'System.Uri' class provides these services in a safe and secure manner.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1054", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "UriParametersShouldNotBeStringsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1055": { - "id": "CA1055", - "shortDescription": "URI-like return values should not be strings", - "fullDescription": "This rule assumes that the method returns a URI. A string representation of a URI is prone to parsing and encoding errors, and can lead to security vulnerabilities. The System.Uri class provides these services in a safe and secure manner.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1055", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "UriReturnValuesShouldNotBeStringsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1056": { - "id": "CA1056", - "shortDescription": "URI-like properties should not be strings", - "fullDescription": "This rule assumes that the property represents a Uniform Resource Identifier (URI). A string representation of a URI is prone to parsing and encoding errors, and can lead to security vulnerabilities. The System.Uri class provides these services in a safe and secure manner.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1056", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "UriPropertiesShouldNotBeStringsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1058": { - "id": "CA1058", - "shortDescription": "Types should not extend certain base types", - "fullDescription": "An externally visible type extends certain base types. Use one of the alternatives.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1058", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "TypesShouldNotExtendCertainBaseTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1060": { - "id": "CA1060", - "shortDescription": "Move pinvokes to native methods class", - "fullDescription": "Platform Invocation methods, such as those that are marked by using the System.Runtime.InteropServices.DllImportAttribute attribute, or methods that are defined by using the Declare keyword in Visual Basic, access unmanaged code. These methods should be of the NativeMethods, SafeNativeMethods, or UnsafeNativeMethods class.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1060", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "MovePInvokesToNativeMethodsClassAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry" - ] - } - }, - "CA1061": { - "id": "CA1061", - "shortDescription": "Do not hide base class methods", - "fullDescription": "A method in a base type is hidden by an identically named method in a derived type when the parameter signature of the derived method differs only by types that are more weakly derived than the corresponding types in the parameter signature of the base method.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1061", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "DoNotHideBaseClassMethodsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1062": { - "id": "CA1062", - "shortDescription": "Validate arguments of public methods", - "fullDescription": "An externally visible method dereferences one of its reference arguments without verifying whether that argument is 'null' ('Nothing' in Visual Basic). All reference arguments that are passed to externally visible methods should be checked against 'null'. If appropriate, throw an 'ArgumentNullException' when the argument is 'null'. If the method is designed to be called only by known assemblies, you should make the method internal.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1062", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "ValidateArgumentsOfPublicMethods", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1063": { - "id": "CA1063", - "shortDescription": "Implement IDisposable Correctly", - "fullDescription": "All IDisposable types should implement the Dispose pattern correctly.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1063", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "ImplementIDisposableCorrectlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1064": { - "id": "CA1064", - "shortDescription": "Exceptions should be public", - "fullDescription": "An internal exception is visible only inside its own internal scope. After the exception falls outside the internal scope, only the base exception can be used to catch the exception. If the internal exception is inherited from T:System.Exception, T:System.SystemException, or T:System.ApplicationException, the external code will not have sufficient information to know what to do with the exception.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1064", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "ExceptionsShouldBePublicAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1065": { - "id": "CA1065", - "shortDescription": "Do not raise exceptions in unexpected locations", - "fullDescription": "A method that is not expected to throw exceptions throws an exception.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1065", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "DoNotRaiseExceptionsInUnexpectedLocationsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1066": { - "id": "CA1066", - "shortDescription": "Implement IEquatable when overriding Object.Equals", - "fullDescription": "When a type T overrides Object.Equals(object), the implementation must cast the object argument to the correct type T before performing the comparison. If the type implements IEquatable, and therefore offers the method T.Equals(T), and if the argument is known at compile time to be of type T, then the compiler can call IEquatable.Equals(T) instead of Object.Equals(object), and no cast is necessary, improving performance.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1066", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "EquatableAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1067": { - "id": "CA1067", - "shortDescription": "Override Object.Equals(object) when implementing IEquatable", - "fullDescription": "When a type T implements the interface IEquatable, it suggests to a user who sees a call to the Equals method in source code that an instance of the type can be equated with an instance of any other type. The user might be confused if their attempt to equate the type with an instance of another type fails to compile. This violates the \"principle of least surprise\".", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1067", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "EquatableAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1068": { - "id": "CA1068", - "shortDescription": "CancellationToken parameters must come last", - "fullDescription": "Method '{0}' should take CancellationToken as the last parameter", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1068", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "CancellationTokenParametersMustComeLastAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1069": { - "id": "CA1069", - "shortDescription": "Enums values should not be duplicated", - "fullDescription": "The field reference '{0}' is duplicated in this bitwise initialization", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1069", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "EnumShouldNotHaveDuplicatedValues", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1070": { - "id": "CA1070", - "shortDescription": "Do not declare event fields as virtual", - "fullDescription": "Do not declare virtual events in a base class. Overridden events in a derived class have undefined behavior. The C# compiler does not handle this correctly and it is unpredictable whether a subscriber to the derived event will actually be subscribing to the base class event.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1070", - "properties": { - "category": "Design", - "isEnabledByDefault": true, - "typeName": "DoNotDeclareEventFieldsAsVirtual", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1303": { - "id": "CA1303", - "shortDescription": "Do not pass literals as localized parameters", - "fullDescription": "A method passes a string literal as a parameter to a constructor or method in the .NET Framework class library and that string should be localizable. To fix a violation of this rule, replace the string literal with a string retrieved through an instance of the ResourceManager class.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1303", - "properties": { - "category": "Globalization", - "isEnabledByDefault": false, - "typeName": "DoNotPassLiteralsAsLocalizedParameters", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1304": { - "id": "CA1304", - "shortDescription": "Specify CultureInfo", - "fullDescription": "A method or constructor calls a member that has an overload that accepts a System.Globalization.CultureInfo parameter, and the method or constructor does not call the overload that takes the CultureInfo parameter. When a CultureInfo or System.IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales. If the result will be displayed to the user, specify 'CultureInfo.CurrentCulture' as the 'CultureInfo' parameter. Otherwise, if the result will be stored and accessed by software, such as when it is persisted to disk or to a database, specify 'CultureInfo.InvariantCulture'.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1304", - "properties": { - "category": "Globalization", - "isEnabledByDefault": true, - "typeName": "SpecifyCultureInfoAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1305": { - "id": "CA1305", - "shortDescription": "Specify IFormatProvider", - "fullDescription": "A method or constructor calls one or more members that have overloads that accept a System.IFormatProvider parameter, and the method or constructor does not call the overload that takes the IFormatProvider parameter. When a System.Globalization.CultureInfo or IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales. If the result will be based on the input from/output displayed to the user, specify 'CultureInfo.CurrentCulture' as the 'IFormatProvider'. Otherwise, if the result will be stored and accessed by software, such as when it is loaded from disk/database and when it is persisted to disk/database, specify 'CultureInfo.InvariantCulture'.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1305", - "properties": { - "category": "Globalization", - "isEnabledByDefault": true, - "typeName": "SpecifyIFormatProviderAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1307": { - "id": "CA1307", - "shortDescription": "Specify StringComparison for clarity", - "fullDescription": "A string comparison operation uses a method overload that does not set a StringComparison parameter. It is recommended to use the overload with StringComparison parameter for clarity of intent. If the result will be displayed to the user, such as when sorting a list of items for display in a list box, specify 'StringComparison.CurrentCulture' or 'StringComparison.CurrentCultureIgnoreCase' as the 'StringComparison' parameter. If comparing case-insensitive identifiers, such as file paths, environment variables, or registry keys and values, specify 'StringComparison.OrdinalIgnoreCase'. Otherwise, if comparing case-sensitive identifiers, specify 'StringComparison.Ordinal'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1307", - "properties": { - "category": "Globalization", - "isEnabledByDefault": false, - "typeName": "SpecifyStringComparisonAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1308": { - "id": "CA1308", - "shortDescription": "Normalize strings to uppercase", - "fullDescription": "Strings should be normalized to uppercase. A small group of characters cannot make a round trip when they are converted to lowercase. To make a round trip means to convert the characters from one locale to another locale that represents character data differently, and then to accurately retrieve the original characters from the converted characters.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1308", - "properties": { - "category": "Globalization", - "isEnabledByDefault": false, - "typeName": "NormalizeStringsToUppercaseAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1310": { - "id": "CA1310", - "shortDescription": "Specify StringComparison for correctness", - "fullDescription": "A string comparison operation uses a method overload that does not set a StringComparison parameter, hence its behavior could vary based on the current user's locale settings. It is strongly recommended to use the overload with StringComparison parameter for correctness and clarity of intent. If the result will be displayed to the user, such as when sorting a list of items for display in a list box, specify 'StringComparison.CurrentCulture' or 'StringComparison.CurrentCultureIgnoreCase' as the 'StringComparison' parameter. If comparing case-insensitive identifiers, such as file paths, environment variables, or registry keys and values, specify 'StringComparison.OrdinalIgnoreCase'. Otherwise, if comparing case-sensitive identifiers, specify 'StringComparison.Ordinal'.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1310", - "properties": { - "category": "Globalization", - "isEnabledByDefault": true, - "typeName": "SpecifyStringComparisonAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1401": { - "id": "CA1401", - "shortDescription": "P/Invokes should not be visible", - "fullDescription": "A public or protected method in a public type has the System.Runtime.InteropServices.DllImportAttribute attribute (also implemented by the Declare keyword in Visual Basic). Such methods should not be exposed.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1401", - "properties": { - "category": "Interoperability", - "isEnabledByDefault": true, - "typeName": "PInvokeDiagnosticAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1416": { - "id": "CA1416", - "shortDescription": "Validate platform compatibility", - "fullDescription": "Using platform dependent API on a component makes the code no longer work across all platforms.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1416", - "properties": { - "category": "Interoperability", - "isEnabledByDefault": true, - "typeName": "PlatformCompatibilityAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1417": { - "id": "CA1417", - "shortDescription": "Do not use 'OutAttribute' on string parameters for P/Invokes", - "fullDescription": "String parameters passed by value with the 'OutAttribute' can destabilize the runtime if the string is an interned string.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1417", - "properties": { - "category": "Interoperability", - "isEnabledByDefault": true, - "typeName": "DoNotUseOutAttributeStringPInvokeParametersAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1418": { - "id": "CA1418", - "shortDescription": "Use valid platform string", - "fullDescription": "Platform compatibility analyzer requires a valid platform name and version.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1418", - "properties": { - "category": "Interoperability", - "isEnabledByDefault": true, - "typeName": "UseValidPlatformString", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1419": { - "id": "CA1419", - "shortDescription": "Provide a parameterless constructor that is as visible as the containing type for concrete types derived from 'System.Runtime.InteropServices.SafeHandle'", - "fullDescription": "Providing a parameterless constructor that is as visible as the containing type for a type derived from 'System.Runtime.InteropServices.SafeHandle' enables better performance and usage with source-generated interop solutions.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1419", - "properties": { - "category": "Interoperability", - "isEnabledByDefault": true, - "typeName": "ProvidePublicParameterlessSafeHandleConstructorAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1420": { - "id": "CA1420", - "shortDescription": "Property, type, or attribute requires runtime marshalling", - "fullDescription": "Using features that require runtime marshalling when runtime marshalling is disabled will result in runtime exceptions.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1420", - "properties": { - "category": "Interoperability", - "isEnabledByDefault": true, - "typeName": "DisableRuntimeMarshallingAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1421": { - "id": "CA1421", - "shortDescription": "This method uses runtime marshalling even when the 'DisableRuntimeMarshallingAttribute' is applied", - "fullDescription": "This method uses runtime marshalling even when runtime marshalling is disabled, which can cause unexpected behavior differences at runtime due to different expectations of a type's native layout.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1421", - "properties": { - "category": "Interoperability", - "isEnabledByDefault": true, - "typeName": "DisableRuntimeMarshallingAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1422": { - "id": "CA1422", - "shortDescription": "Validate platform compatibility", - "fullDescription": "Using platform dependent API on a component makes the code no longer work across all platforms.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1422", - "properties": { - "category": "Interoperability", - "isEnabledByDefault": true, - "typeName": "PlatformCompatibilityAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1501": { - "id": "CA1501", - "shortDescription": "Avoid excessive inheritance", - "fullDescription": "Deeply nested type hierarchies can be difficult to follow, understand, and maintain. This rule limits analysis to hierarchies in the same module. To fix a violation of this rule, derive the type from a base type that is less deep in the inheritance hierarchy or eliminate some of the intermediate base types.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1501", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": false, - "typeName": "CodeMetricsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "CompilationEnd" - ] - } - }, - "CA1502": { - "id": "CA1502", - "shortDescription": "Avoid excessive complexity", - "fullDescription": "Cyclomatic complexity measures the number of linearly independent paths through the method, which is determined by the number and complexity of conditional branches. A low cyclomatic complexity generally indicates a method that is easy to understand, test, and maintain. The cyclomatic complexity is calculated from a control flow graph of the method and is given as follows: `cyclomatic complexity = the number of edges - the number of nodes + 1`, where a node represents a logic branch point and an edge represents a line between nodes.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1502", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": false, - "typeName": "CodeMetricsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "CompilationEnd" - ] - } - }, - "CA1505": { - "id": "CA1505", - "shortDescription": "Avoid unmaintainable code", - "fullDescription": "The maintainability index is calculated by using the following metrics: lines of code, program volume, and cyclomatic complexity. Program volume is a measure of the difficulty of understanding of a symbol that is based on the number of operators and operands in the code. Cyclomatic complexity is a measure of the structural complexity of the type or method. A low maintainability index indicates that code is probably difficult to maintain and would be a good candidate to redesign.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1505", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": false, - "typeName": "CodeMetricsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "CompilationEnd" - ] - } - }, - "CA1506": { - "id": "CA1506", - "shortDescription": "Avoid excessive class coupling", - "fullDescription": "This rule measures class coupling by counting the number of unique type references that a symbol contains. Symbols that have a high degree of class coupling can be difficult to maintain. It is a good practice to have types and methods that exhibit low coupling and high cohesion. To fix this violation, try to redesign the code to reduce the number of types to which it is coupled.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1506", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": false, - "typeName": "CodeMetricsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "CompilationEnd" - ] - } - }, - "CA1509": { - "id": "CA1509", - "shortDescription": "Invalid entry in code metrics rule specification file", - "fullDescription": "Invalid entry in code metrics rule specification file.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1509", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": false, - "typeName": "CodeMetricsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "CompilationEnd" - ] - } - }, - "CA1510": { - "id": "CA1510", - "shortDescription": "Use ArgumentNullException throw helper", - "fullDescription": "Throw helpers are simpler and more efficient than an if block constructing a new exception instance.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1510", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": true, - "typeName": "UseExceptionThrowHelpers", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1511": { - "id": "CA1511", - "shortDescription": "Use ArgumentException throw helper", - "fullDescription": "Throw helpers are simpler and more efficient than an if block constructing a new exception instance.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1511", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": true, - "typeName": "UseExceptionThrowHelpers", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1512": { - "id": "CA1512", - "shortDescription": "Use ArgumentOutOfRangeException throw helper", - "fullDescription": "Throw helpers are simpler and more efficient than an if block constructing a new exception instance.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1512", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": true, - "typeName": "UseExceptionThrowHelpers", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1513": { - "id": "CA1513", - "shortDescription": "Use ObjectDisposedException throw helper", - "fullDescription": "Throw helpers are simpler and more efficient than an if block constructing a new exception instance.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1513", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": true, - "typeName": "UseExceptionThrowHelpers", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1514": { - "id": "CA1514", - "shortDescription": "Avoid redundant length argument", - "fullDescription": "An explicit length calculation can be error-prone and can be avoided when slicing to end of the buffer.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1514", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": true, - "typeName": "AvoidLengthCalculationWhenSlicingToEndAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1700": { - "id": "CA1700", - "shortDescription": "Do not name enum values 'Reserved'", - "fullDescription": "This rule assumes that an enumeration member that has a name that contains \"reserved\" is not currently used but is a placeholder to be renamed or removed in a future version. Renaming or removing a member is a breaking change.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1700", - "properties": { - "category": "Naming", - "isEnabledByDefault": false, - "typeName": "DoNotNameEnumValuesReserved", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1707": { - "id": "CA1707", - "shortDescription": "Identifiers should not contain underscores", - "fullDescription": "By convention, identifier names do not contain the underscore (_) character. This rule checks namespaces, types, members, and parameters.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1707", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "IdentifiersShouldNotContainUnderscoresAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1708": { - "id": "CA1708", - "shortDescription": "Identifiers should differ by more than case", - "fullDescription": "Identifiers for namespaces, types, members, and parameters cannot differ only by case because languages that target the common language runtime are not required to be case-sensitive.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1708", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "IdentifiersShouldDifferByMoreThanCaseAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1710": { - "id": "CA1710", - "shortDescription": "Identifiers should have correct suffix", - "fullDescription": "By convention, the names of types that extend certain base types or that implement certain interfaces, or types that are derived from these types, have a suffix that is associated with the base type or interface.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1710", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "IdentifiersShouldHaveCorrectSuffixAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1711": { - "id": "CA1711", - "shortDescription": "Identifiers should not have incorrect suffix", - "fullDescription": "By convention, only the names of types that extend certain base types or that implement certain interfaces, or types that are derived from these types, should end with specific reserved suffixes. Other type names should not use these reserved suffixes.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1711", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "IdentifiersShouldNotHaveIncorrectSuffixAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1712": { - "id": "CA1712", - "shortDescription": "Do not prefix enum values with type name", - "fullDescription": "An enumeration's values should not start with the type name of the enumeration.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1712", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "DoNotPrefixEnumValuesWithTypeNameAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1713": { - "id": "CA1713", - "shortDescription": "Events should not have 'Before' or 'After' prefix", - "fullDescription": "Event names should describe the action that raises the event. To name related events that are raised in a specific sequence, use the present or past tense to indicate the relative position in the sequence of actions. For example, when naming a pair of events that is raised when closing a resource, you might name it 'Closing' and 'Closed', instead of 'BeforeClose' and 'AfterClose'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1713", - "properties": { - "category": "Naming", - "isEnabledByDefault": false, - "typeName": "EventsShouldNotHaveBeforeOrAfterPrefix", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1715": { - "id": "CA1715", - "shortDescription": "Identifiers should have correct prefix", - "fullDescription": "The name of an externally visible interface does not start with an uppercase \"\"I\"\". The name of a generic type parameter on an externally visible type or method does not start with an uppercase \"\"T\"\".", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1715", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "IdentifiersShouldHaveCorrectPrefixAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1716": { - "id": "CA1716", - "shortDescription": "Identifiers should not match keywords", - "fullDescription": "A namespace name or a type name matches a reserved keyword in a programming language. Identifiers for namespaces and types should not match keywords that are defined by languages that target the common language runtime.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1716", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "IdentifiersShouldNotMatchKeywordsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1720": { - "id": "CA1720", - "shortDescription": "Identifier contains type name", - "fullDescription": "Names of parameters and members are better used to communicate their meaning than to describe their type, which is expected to be provided by development tools. For names of members, if a data type name must be used, use a language-independent name instead of a language-specific one.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1720", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "IdentifiersShouldNotContainTypeNames", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1721": { - "id": "CA1721", - "shortDescription": "Property names should not match get methods", - "fullDescription": "The name of a public or protected member starts with \"\"Get\"\" and otherwise matches the name of a public or protected property. \"\"Get\"\" methods and properties should have names that clearly distinguish their function.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1721", - "properties": { - "category": "Naming", - "isEnabledByDefault": false, - "typeName": "PropertyNamesShouldNotMatchGetMethodsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1724": { - "id": "CA1724", - "shortDescription": "Type names should not match namespaces", - "fullDescription": "Type names should not match the names of namespaces that are defined in the .NET Framework class library. Violating this rule can reduce the usability of the library.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1724", - "properties": { - "category": "Naming", - "isEnabledByDefault": false, - "typeName": "TypeNamesShouldNotMatchNamespacesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA1725": { - "id": "CA1725", - "shortDescription": "Parameter names should match base declaration", - "fullDescription": "Consistent naming of parameters in an override hierarchy increases the usability of the method overrides. A parameter name in a derived method that differs from the name in the base declaration can cause confusion about whether the method is an override of the base method or a new overload of the method.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1725", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "ParameterNamesShouldMatchBaseDeclarationAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1727": { - "id": "CA1727", - "shortDescription": "Use PascalCase for named placeholders", - "fullDescription": "Use PascalCase for named placeholders in the logging message template.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1727", - "properties": { - "category": "Naming", - "isEnabledByDefault": true, - "typeName": "LoggerMessageDefineAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1806": { - "id": "CA1806", - "shortDescription": "Do not ignore method results", - "fullDescription": "A new object is created but never used; or a method that creates and returns a new string is called and the new string is never used; or a COM or P/Invoke method returns an HRESULT or error code that is never used.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1806", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "DoNotIgnoreMethodResultsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1810": { - "id": "CA1810", - "shortDescription": "Initialize reference type static fields inline", - "fullDescription": "A reference type declares an explicit static constructor. To fix a violation of this rule, initialize all static data when it is declared and remove the static constructor.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1810", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "InitializeStaticFieldsInlineAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1813": { - "id": "CA1813", - "shortDescription": "Avoid unsealed attributes", - "fullDescription": "The .NET Framework class library provides methods for retrieving custom attributes. By default, these methods search the attribute inheritance hierarchy. Sealing the attribute eliminates the search through the inheritance hierarchy and can improve performance.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1813", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "AvoidUnsealedAttributesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1814": { - "id": "CA1814", - "shortDescription": "Prefer jagged arrays over multidimensional", - "fullDescription": "A jagged array is an array whose elements are arrays. The arrays that make up the elements can be of different sizes, leading to less wasted space for some sets of data.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1814", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "PreferJaggedArraysOverMultidimensionalAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1815": { - "id": "CA1815", - "shortDescription": "Override equals and operator equals on value types", - "fullDescription": "For value types, the inherited implementation of Equals uses the Reflection library and compares the contents of all fields. Reflection is computationally expensive, and comparing every field for equality might be unnecessary. If you expect users to compare or sort instances, or to use instances as hash table keys, your value type should implement Equals.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1815", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "OverrideEqualsAndOperatorEqualsOnValueTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1816": { - "id": "CA1816", - "shortDescription": "Dispose methods should call SuppressFinalize", - "fullDescription": "A method that is an implementation of Dispose does not call GC.SuppressFinalize; or a method that is not an implementation of Dispose calls GC.SuppressFinalize; or a method calls GC.SuppressFinalize and passes something other than this (Me in Visual Basic).", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1816", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "CallGCSuppressFinalizeCorrectlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1819": { - "id": "CA1819", - "shortDescription": "Properties should not return arrays", - "fullDescription": "Arrays that are returned by properties are not write-protected, even when the property is read-only. To keep the array tamper-proof, the property must return a copy of the array. Typically, users will not understand the adverse performance implications of calling such a property.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1819", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "PropertiesShouldNotReturnArraysAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1820": { - "id": "CA1820", - "shortDescription": "Test for empty strings using string length", - "fullDescription": "Comparing strings by using the String.Length property or the String.IsNullOrEmpty method is significantly faster than using Equals.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1820", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "TestForEmptyStringsUsingStringLengthAnalyzer", - "languages": [ - "C#" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1821": { - "id": "CA1821", - "shortDescription": "Remove empty Finalizers", - "fullDescription": "Finalizers should be avoided where possible, to avoid the additional performance overhead involved in tracking object lifetime.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1821", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "RemoveEmptyFinalizersAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1822": { - "id": "CA1822", - "shortDescription": "Mark members as static", - "fullDescription": "Members that do not access instance data or call instance methods can be marked as static. After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1822", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "MarkMembersAsStaticAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1823": { - "id": "CA1823", - "shortDescription": "Avoid unused private fields", - "fullDescription": "Private fields were detected that do not appear to be accessed in the assembly.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1823", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "AvoidUnusedPrivateFieldsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1826": { - "id": "CA1826", - "shortDescription": "Do not use Enumerable methods on indexable collections", - "fullDescription": "This collection is directly indexable. Going through LINQ here causes unnecessary allocations and CPU work.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1826", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "DoNotUseEnumerableMethodsOnIndexableCollectionsInsteadUseTheCollectionDirectlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1827": { - "id": "CA1827", - "shortDescription": "Do not use Count() or LongCount() when Any() can be used", - "fullDescription": "For non-empty collections, Count() and LongCount() enumerate the entire sequence, while Any() stops at the first item or the first item that satisfies a condition.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1827", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseCountProperlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1828": { - "id": "CA1828", - "shortDescription": "Do not use CountAsync() or LongCountAsync() when AnyAsync() can be used", - "fullDescription": "For non-empty collections, CountAsync() and LongCountAsync() enumerate the entire sequence, while AnyAsync() stops at the first item or the first item that satisfies a condition.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1828", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseCountProperlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1829": { - "id": "CA1829", - "shortDescription": "Use Length/Count property instead of Count() when available", - "fullDescription": "Enumerable.Count() potentially enumerates the sequence while a Length/Count property is a direct access.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1829", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseCountProperlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1830": { - "id": "CA1830", - "shortDescription": "Prefer strongly-typed Append and Insert method overloads on StringBuilder", - "fullDescription": "StringBuilder.Append and StringBuilder.Insert provide overloads for multiple types beyond System.String. When possible, prefer the strongly-typed overloads over using ToString() and the string-based overload.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1830", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "PreferTypedStringBuilderAppendOverloads", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1831": { - "id": "CA1831", - "shortDescription": "Use AsSpan or AsMemory instead of Range-based indexers when appropriate", - "fullDescription": "The Range-based indexer on string values produces a copy of requested portion of the string. This copy is usually unnecessary when it is implicitly used as a ReadOnlySpan or ReadOnlyMemory value. Use the AsSpan method to avoid the unnecessary copy.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1831", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseAsSpanInsteadOfRangeIndexerAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1832": { - "id": "CA1832", - "shortDescription": "Use AsSpan or AsMemory instead of Range-based indexers when appropriate", - "fullDescription": "The Range-based indexer on array values produces a copy of requested portion of the array. This copy is usually unnecessary when it is implicitly used as a ReadOnlySpan or ReadOnlyMemory value. Use the AsSpan method to avoid the unnecessary copy.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1832", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseAsSpanInsteadOfRangeIndexerAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1833": { - "id": "CA1833", - "shortDescription": "Use AsSpan or AsMemory instead of Range-based indexers when appropriate", - "fullDescription": "The Range-based indexer on array values produces a copy of requested portion of the array. This copy is often unwanted when it is implicitly used as a Span or Memory value. Use the AsSpan method to avoid the copy.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1833", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseAsSpanInsteadOfRangeIndexerAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1834": { - "id": "CA1834", - "shortDescription": "Consider using 'StringBuilder.Append(char)' when applicable", - "fullDescription": "'StringBuilder.Append(char)' is more efficient than 'StringBuilder.Append(string)' when the string is a single character. When calling 'Append' with a constant, prefer using a constant char rather than a constant string containing one character.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1834", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "PreferConstCharOverConstUnitStringAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1835": { - "id": "CA1835", - "shortDescription": "Prefer the 'Memory'-based overloads for 'ReadAsync' and 'WriteAsync'", - "fullDescription": "'Stream' has a 'ReadAsync' overload that takes a 'Memory' as the first argument, and a 'WriteAsync' overload that takes a 'ReadOnlyMemory' as the first argument. Prefer calling the memory based overloads, which are more efficient.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1835", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "PreferStreamAsyncMemoryOverloads", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1836": { - "id": "CA1836", - "shortDescription": "Prefer IsEmpty over Count", - "fullDescription": "For determining whether the object contains or not any items, prefer using 'IsEmpty' property rather than retrieving the number of items from the 'Count' property and comparing it to 0 or 1.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1836", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseCountProperlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1837": { - "id": "CA1837", - "shortDescription": "Use 'Environment.ProcessId'", - "fullDescription": "'Environment.ProcessId' is simpler and faster than 'Process.GetCurrentProcess().Id'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1837", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseEnvironmentMembers", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1838": { - "id": "CA1838", - "shortDescription": "Avoid 'StringBuilder' parameters for P/Invokes", - "fullDescription": "Marshalling of 'StringBuilder' always creates a native buffer copy, resulting in multiple allocations for one marshalling operation.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1838", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "AvoidStringBuilderPInvokeParametersAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1839": { - "id": "CA1839", - "shortDescription": "Use 'Environment.ProcessPath'", - "fullDescription": "'Environment.ProcessPath' is simpler and faster than 'Process.GetCurrentProcess().MainModule.FileName'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1839", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseEnvironmentMembers", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1840": { - "id": "CA1840", - "shortDescription": "Use 'Environment.CurrentManagedThreadId'", - "fullDescription": "'Environment.CurrentManagedThreadId' is simpler and faster than 'Thread.CurrentThread.ManagedThreadId'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1840", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseEnvironmentMembers", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1842": { - "id": "CA1842", - "shortDescription": "Do not use 'WhenAll' with a single task", - "fullDescription": "Using 'WhenAll' with a single task may result in performance loss, await or return the task instead.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1842", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "DoNotUseWhenAllOrWaitAllWithSingleArgument", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1843": { - "id": "CA1843", - "shortDescription": "Do not use 'WaitAll' with a single task", - "fullDescription": "Using 'WaitAll' with a single task may result in performance loss, await or return the task instead.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1843", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "DoNotUseWhenAllOrWaitAllWithSingleArgument", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1844": { - "id": "CA1844", - "shortDescription": "Provide memory-based overrides of async methods when subclassing 'Stream'", - "fullDescription": "To improve performance, override the memory-based async methods when subclassing 'Stream'. Then implement the array-based methods in terms of the memory-based methods.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1844", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "ProvideStreamMemoryBasedAsyncOverrides", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1846": { - "id": "CA1846", - "shortDescription": "Prefer 'AsSpan' over 'Substring'", - "fullDescription": "'AsSpan' is more efficient than 'Substring'. 'Substring' performs an O(n) string copy, while 'AsSpan' does not and has a constant cost.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1846", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "PreferAsSpanOverSubstring", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1847": { - "id": "CA1847", - "shortDescription": "Use char literal for a single character lookup", - "fullDescription": "'string.Contains(char)' is available as a better performing overload for single char lookup.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1847", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseStringContainsCharOverloadWithSingleCharactersAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1848": { - "id": "CA1848", - "shortDescription": "Use the LoggerMessage delegates", - "fullDescription": "For improved performance, use the LoggerMessage delegates.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1848", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "LoggerMessageDefineAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1849": { - "id": "CA1849", - "shortDescription": "Call async methods when in an async method", - "fullDescription": "When inside a Task-returning method, use the async version of methods, if they exist.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1849", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "UseAsyncMethodInAsyncContext", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1850": { - "id": "CA1850", - "shortDescription": "Prefer static 'HashData' method over 'ComputeHash'", - "fullDescription": "It is more efficient to use the static 'HashData' method over creating and managing a HashAlgorithm instance to call 'ComputeHash'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1850", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "PreferHashDataOverComputeHashAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1852": { - "id": "CA1852", - "shortDescription": "Seal internal types", - "fullDescription": "When a type is not accessible outside its assembly and has no subtypes within its containing assembly, it can be safely sealed. Sealing types can improve performance.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1852", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "SealInternalTypes", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA1853": { - "id": "CA1853", - "shortDescription": "Unnecessary call to 'Dictionary.ContainsKey(key)'", - "fullDescription": "Do not guard 'Dictionary.Remove(key)' with 'Dictionary.ContainsKey(key)'. The former already checks whether the key exists, and will not throw if it does not.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1853", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "DoNotGuardCallAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1854": { - "id": "CA1854", - "shortDescription": "Prefer the 'IDictionary.TryGetValue(TKey, out TValue)' method", - "fullDescription": "Prefer a 'TryGetValue' call over a Dictionary indexer access guarded by a 'ContainsKey' check. 'ContainsKey' and the indexer both would lookup the key under the hood, so using 'TryGetValue' removes the extra lookup.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1854", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "PreferDictionaryTryMethodsOverContainsKeyGuardAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1858": { - "id": "CA1858", - "shortDescription": "Use 'StartsWith' instead of 'IndexOf'", - "fullDescription": "It is both clearer and faster to use 'StartsWith' instead of comparing the result of 'IndexOf' to zero.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1858", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseStartsWithInsteadOfIndexOfComparisonWithZero", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1859": { - "id": "CA1859", - "shortDescription": "Use concrete types when possible for improved performance", - "fullDescription": "Using concrete types avoids virtual or interface call overhead and enables inlining.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1859", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseConcreteTypeAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1860": { - "id": "CA1860", - "shortDescription": "Avoid using 'Enumerable.Any()' extension method", - "fullDescription": "Prefer using 'IsEmpty', 'Count' or 'Length' properties whichever available, rather than calling 'Enumerable.Any()'. The intent is clearer and it is more performant than using 'Enumerable.Any()' extension method.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1860", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "PreferLengthCountIsEmptyOverAnyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1861": { - "id": "CA1861", - "shortDescription": "Avoid constant arrays as arguments", - "fullDescription": "Constant arrays passed as arguments are not reused when called repeatedly, which implies a new array is created each time. Consider extracting them to 'static readonly' fields to improve performance if the passed array is not mutated within the called method.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1861", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "AvoidConstArraysAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1862": { - "id": "CA1862", - "shortDescription": "Use the 'StringComparison' method overloads to perform case-insensitive string comparisons", - "fullDescription": "Avoid calling 'ToLower', 'ToUpper', 'ToLowerInvariant' and 'ToUpperInvariant' to perform case-insensitive string comparisons, as in 'string.ToLower() == string.ToLower()', because they lead to an allocation. Instead, use 'string.Equals(string, StringComparison)' to perform case-insensitive comparisons. Switching to using an overload that takes a 'StringComparison' might cause subtle changes in behavior, so it's important to conduct thorough testing after applying the suggestion. Additionally, if a culturally sensitive comparison is not required, consider using 'StringComparison.OrdinalIgnoreCase'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1862", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "RecommendCaseInsensitiveStringComparisonAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1863": { - "id": "CA1863", - "shortDescription": "Use 'CompositeFormat'", - "fullDescription": "Cache and use a 'CompositeFormat' instance as the argument to this formatting operation, rather than passing in the original format string. This reduces the cost of the formatting operation.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1863", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseCompositeFormatAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1864": { - "id": "CA1864", - "shortDescription": "Prefer the 'IDictionary.TryAdd(TKey, TValue)' method", - "fullDescription": "Prefer a 'TryAdd' call over an 'Add' call guarded by a 'ContainsKey' check. 'TryAdd' behaves the same as 'Add', except that when the specified key already exists, it returns 'false' instead of throwing an exception.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1864", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "PreferDictionaryTryMethodsOverContainsKeyGuardAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1868": { - "id": "CA1868", - "shortDescription": "Unnecessary call to 'Contains(item)'", - "fullDescription": "Do not guard 'Add(item)' or 'Remove(item)' with 'Contains(item)' for the set. The former two already check whether the item exists and will return if it was added or removed.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1868", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "DoNotGuardCallAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1869": { - "id": "CA1869", - "shortDescription": "Cache and reuse 'JsonSerializerOptions' instances", - "fullDescription": "Avoid creating a new 'JsonSerializerOptions' instance for every serialization operation. Cache and reuse instances instead. Single use 'JsonSerializerOptions' instances can substantially degrade the performance of your application.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1869", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "AvoidSingleUseOfLocalJsonSerializerOptions", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1871": { - "id": "CA1871", - "shortDescription": "Do not pass a nullable struct to 'ArgumentNullException.ThrowIfNull'", - "fullDescription": "'ArgumentNullException.ThrowIfNull' accepts an 'object', so passing a nullable struct may cause the value to be boxed.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1871", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "DoNotPassNonNullableValueToArgumentNullExceptionThrowIfNull", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1872": { - "id": "CA1872", - "shortDescription": "Prefer 'Convert.ToHexString' and 'Convert.ToHexStringLower' over call chains based on 'BitConverter.ToString'", - "fullDescription": "Use 'Convert.ToHexString' or 'Convert.ToHexStringLower' when encoding bytes to a hexadecimal string representation. These methods are more efficient and allocation-friendly than using 'BitConverter.ToString' in combination with 'String.Replace' to replace dashes and 'String.ToLower'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1872", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "PreferConvertToHexStringOverBitConverterAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1873": { - "id": "CA1873", - "shortDescription": "Avoid potentially expensive logging", - "fullDescription": "In many situations, logging is disabled or set to a log level that results in an unnecessary evaluation for this argument.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1873", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "AvoidPotentiallyExpensiveCallWhenLoggingAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1874": { - "id": "CA1874", - "shortDescription": "Use 'Regex.IsMatch'", - "fullDescription": "'Regex.IsMatch' is simpler and faster than 'Regex.Match(...).Success'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1874", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseRegexMembers", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1875": { - "id": "CA1875", - "shortDescription": "Use 'Regex.Count'", - "fullDescription": "'Regex.Count' is simpler and faster than 'Regex.Matches(...).Count'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1875", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "UseRegexMembers", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2000": { - "id": "CA2000", - "shortDescription": "Dispose objects before losing scope", - "fullDescription": "If a disposable object is not explicitly disposed before all references to it are out of scope, the object will be disposed at some indeterminate time when the garbage collector runs the finalizer of the object. Because an exceptional event might occur that will prevent the finalizer of the object from running, the object should be explicitly disposed instead.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2000", - "properties": { - "category": "Reliability", - "isEnabledByDefault": false, - "typeName": "DisposeObjectsBeforeLosingScope", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2002": { - "id": "CA2002", - "shortDescription": "Do not lock on objects with weak identity", - "fullDescription": "An object is said to have a weak identity when it can be directly accessed across application domain boundaries. A thread that tries to acquire a lock on an object that has a weak identity can be blocked by a second thread in a different application domain that has a lock on the same object.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2002", - "properties": { - "category": "Reliability", - "isEnabledByDefault": false, - "typeName": "DoNotLockOnObjectsWithWeakIdentityAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2007": { - "id": "CA2007", - "shortDescription": "Consider calling ConfigureAwait on the awaited task", - "fullDescription": "When an asynchronous method awaits a Task directly, continuation occurs in the same thread that created the task. Consider calling Task.ConfigureAwait(Boolean) to signal your intention for continuation. Call ConfigureAwait(false) on the task to schedule continuations to the thread pool, thereby avoiding a deadlock on the UI thread. Passing false is a good option for app-independent libraries. Calling ConfigureAwait(true) on the task has the same behavior as not explicitly calling ConfigureAwait. By explicitly calling this method, you're letting readers know you intentionally want to perform the continuation on the original synchronization context.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2007", - "properties": { - "category": "Reliability", - "isEnabledByDefault": false, - "typeName": "DoNotDirectlyAwaitATaskAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2008": { - "id": "CA2008", - "shortDescription": "Do not create tasks without passing a TaskScheduler", - "fullDescription": "Do not create tasks unless you are using one of the overloads that takes a TaskScheduler. The default is to schedule on TaskScheduler.Current, which would lead to deadlocks. Either use TaskScheduler.Default to schedule on the thread pool, or explicitly pass TaskScheduler.Current to make your intentions clear.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2008", - "properties": { - "category": "Reliability", - "isEnabledByDefault": false, - "typeName": "DoNotCreateTasksWithoutPassingATaskSchedulerAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2009": { - "id": "CA2009", - "shortDescription": "Do not call ToImmutableCollection on an ImmutableCollection value", - "fullDescription": "Do not call {0} on an {1} value", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2009", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "DoNotCallToImmutableCollectionOnAnImmutableCollectionValueAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2011": { - "id": "CA2011", - "shortDescription": "Avoid infinite recursion", - "fullDescription": "Do not assign the property within its setter. This call might result in an infinite recursion.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2011", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "AvoidInfiniteRecursion", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2012": { - "id": "CA2012", - "shortDescription": "Use ValueTasks correctly", - "fullDescription": "ValueTasks returned from member invocations are intended to be directly awaited. Attempts to consume a ValueTask multiple times or to directly access one's result before it's known to be completed may result in an exception or corruption. Ignoring such a ValueTask is likely an indication of a functional bug and may degrade performance.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2012", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "UseValueTasksCorrectlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2013": { - "id": "CA2013", - "shortDescription": "Do not use ReferenceEquals with value types", - "fullDescription": "Value type typed arguments are uniquely boxed for each call to this method, therefore the result can be unexpected.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2013", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "DoNotUseReferenceEqualsWithValueTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2015": { - "id": "CA2015", - "shortDescription": "Do not define finalizers for types derived from MemoryManager", - "fullDescription": "Adding a finalizer to a type derived from MemoryManager may permit memory to be freed while it is still in use by a Span.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2015", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "DoNotDefineFinalizersForTypesDerivedFromMemoryManager", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2017": { - "id": "CA2017", - "shortDescription": "Parameter count mismatch", - "fullDescription": "Number of parameters supplied in the logging message template do not match the number of named placeholders.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2017", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "LoggerMessageDefineAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2018": { - "id": "CA2018", - "shortDescription": "'Buffer.BlockCopy' expects the number of bytes to be copied for the 'count' argument", - "fullDescription": "'Buffer.BlockCopy' expects the number of bytes to be copied for the 'count' argument. Using 'Array.Length' may not match the number of bytes that needs to be copied.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2018", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "BufferBlockCopyLengthAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2019": { - "id": "CA2019", - "shortDescription": "Improper 'ThreadStatic' field initialization", - "fullDescription": "'ThreadStatic' fields should be initialized lazily on use, not with inline initialization nor explicitly in a static constructor, which would only initialize the field on the thread that runs the type's static constructor.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2019", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "UseThreadStaticCorrectly", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2021": { - "id": "CA2021", - "shortDescription": "Do not call Enumerable.Cast or Enumerable.OfType with incompatible types", - "fullDescription": "Enumerable.Cast and Enumerable.OfType require compatible types to function expectedly. \u000aThe generic cast (IL 'unbox.any') used by the sequence returned by Enumerable.Cast will throw InvalidCastException at runtime on elements of the types specified. \u000aThe generic type check (C# 'is' operator/IL 'isinst') used by Enumerable.OfType will never succeed with elements of types specified, resulting in an empty sequence. \u000aWidening and user defined conversions are not supported with generic types.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2021", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "DoNotCallEnumerableCastOrOfTypeWithIncompatibleTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2022": { - "id": "CA2022", - "shortDescription": "Avoid inexact read with 'Stream.Read'", - "fullDescription": "A call to 'Stream.Read' may return fewer bytes than requested, resulting in unreliable code if the return value is not checked.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2022", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "AvoidUnreliableStreamReadAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2023": { - "id": "CA2023", - "shortDescription": "Invalid braces in message template", - "fullDescription": "The braces present in the message template are invalid. Ensure any braces in the message template are valid opening/closing braces, or are escaped.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2023", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "LoggerMessageDefineAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2024": { - "id": "CA2024", - "shortDescription": "Do not use 'StreamReader.EndOfStream' in async methods", - "fullDescription": "The property 'StreamReader.EndOfStream' can cause unintended synchronous blocking when no data is buffered. Instead, use 'StreamReader.ReadLineAsync' directly, which returns 'null' when reaching the end of the stream.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2024", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "DoNotUseEndOfStreamInAsyncMethodsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2025": { - "id": "CA2025", - "shortDescription": "Do not pass 'IDisposable' instances into unawaited tasks", - "fullDescription": "Unawaited tasks that use 'IDisposable' instances may use those instances long after they have been disposed. Ensure tasks using those instances are completed before the instances are disposed.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2025", - "properties": { - "category": "Reliability", - "isEnabledByDefault": false, - "typeName": "DoNotPassDisposablesIntoUnawaitedTasksAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2100": { - "id": "CA2100", - "shortDescription": "Review SQL queries for security vulnerabilities", - "fullDescription": "SQL queries that directly use user input can be vulnerable to SQL injection attacks. Review this SQL query for potential vulnerabilities, and consider using a parameterized SQL query.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2100", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewSqlQueriesForSecurityVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2101": { - "id": "CA2101", - "shortDescription": "Specify marshaling for P/Invoke string arguments", - "fullDescription": "A platform invoke member allows partially trusted callers, has a string parameter, and does not explicitly marshal the string. This can cause a potential security vulnerability.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2101", - "properties": { - "category": "Globalization", - "isEnabledByDefault": true, - "typeName": "PInvokeDiagnosticAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2119": { - "id": "CA2119", - "shortDescription": "Seal methods that satisfy private interfaces", - "fullDescription": "An inheritable public type provides an overridable method implementation of an internal (Friend in Visual Basic) interface. To fix a violation of this rule, prevent the method from being overridden outside the assembly.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2119", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "SealMethodsThatSatisfyPrivateInterfacesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2153": { - "id": "CA2153", - "shortDescription": "Do Not Catch Corrupted State Exceptions", - "fullDescription": "Catching corrupted state exceptions could mask errors (such as access violations), resulting in inconsistent state of execution or making it easier for attackers to compromise system. Instead, catch and handle a more specific set of exception type(s) or re-throw the exception.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2153", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotCatchCorruptedStateExceptionsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2200": { - "id": "CA2200", - "shortDescription": "Rethrow to preserve stack details", - "fullDescription": "Re-throwing caught exception changes stack information", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2200", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "RethrowToPreserveStackDetailsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2201": { - "id": "CA2201", - "shortDescription": "Do not raise reserved exception types", - "fullDescription": "An exception of type that is not sufficiently specific or reserved by the runtime should never be raised by user code. This makes the original error difficult to detect and debug. If this exception instance might be thrown, use a different exception type.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2201", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DoNotRaiseReservedExceptionTypesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2207": { - "id": "CA2207", - "shortDescription": "Initialize value type static fields inline", - "fullDescription": "A value type declares an explicit static constructor. To fix a violation of this rule, initialize all static data when it is declared and remove the static constructor.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2207", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "InitializeStaticFieldsInlineAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2208": { - "id": "CA2208", - "shortDescription": "Instantiate argument exceptions correctly", - "fullDescription": "A call is made to the default (parameterless) constructor of an exception type that is or derives from ArgumentException, or an incorrect string argument is passed to a parameterized constructor of an exception type that is or derives from ArgumentException.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2208", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "InstantiateArgumentExceptionsCorrectlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2211": { - "id": "CA2211", - "shortDescription": "Non-constant fields should not be visible", - "fullDescription": "Static fields that are neither constants nor read-only are not thread-safe. Access to such a field must be carefully controlled and requires advanced programming techniques to synchronize access to the class object.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2211", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "NonConstantFieldsShouldNotBeVisibleAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2213": { - "id": "CA2213", - "shortDescription": "Disposable fields should be disposed", - "fullDescription": "A type that implements System.IDisposable declares fields that are of types that also implement IDisposable. The Dispose method of the field is not called by the Dispose method of the declaring type. To fix a violation of this rule, call Dispose on fields that are of types that implement IDisposable if you are responsible for allocating and releasing the unmanaged resources held by the field.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2213", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "DisposableFieldsShouldBeDisposed", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2214": { - "id": "CA2214", - "shortDescription": "Do not call overridable methods in constructors", - "fullDescription": "Virtual methods defined on the class should not be called from constructors. If a derived class has overridden the method, the derived class version will be called (before the derived class constructor is called).", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2214", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "DoNotCallOverridableMethodsInConstructorsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2215": { - "id": "CA2215", - "shortDescription": "Dispose methods should call base class dispose", - "fullDescription": "A type that implements System.IDisposable inherits from a type that also implements IDisposable. The Dispose method of the inheriting type does not call the Dispose method of the parent type. To fix a violation of this rule, call base.Dispose in your Dispose method.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2215", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DisposeMethodsShouldCallBaseClassDispose", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2216": { - "id": "CA2216", - "shortDescription": "Disposable types should declare finalizer", - "fullDescription": "A type that implements System.IDisposable and has fields that suggest the use of unmanaged resources does not implement a finalizer, as described by Object.Finalize.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2216", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "DisposableTypesShouldDeclareFinalizerAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2217": { - "id": "CA2217", - "shortDescription": "Do not mark enums with FlagsAttribute", - "fullDescription": "An externally visible enumeration is marked by using FlagsAttribute, and it has one or more values that are not powers of two or a combination of the other defined values on the enumeration.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2217", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "EnumWithFlagsAttributeAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2219": { - "id": "CA2219", - "shortDescription": "Do not raise exceptions in finally clauses", - "fullDescription": "When an exception is raised in a finally clause, the new exception hides the active exception. This makes the original error difficult to detect and debug.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2219", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DoNotRaiseExceptionsInExceptionClausesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2225": { - "id": "CA2225", - "shortDescription": "Operator overloads have named alternates", - "fullDescription": "An operator overload was detected, and the expected named alternative method was not found. The named alternative member provides access to the same functionality as the operator and is provided for developers who program in languages that do not support overloaded operators.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2225", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "OperatorOverloadsHaveNamedAlternatesAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2226": { - "id": "CA2226", - "shortDescription": "Operators should have symmetrical overloads", - "fullDescription": "A type implements the equality or inequality operator and does not implement the opposite operator.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2226", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "OperatorsShouldHaveSymmetricalOverloadsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2227": { - "id": "CA2227", - "shortDescription": "Collection properties should be read only", - "fullDescription": "A writable collection property allows a user to replace the collection with a different collection. A read-only property stops the collection from being replaced but still allows the individual members to be set.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2227", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "CollectionPropertiesShouldBeReadOnlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2231": { - "id": "CA2231", - "shortDescription": "Overload operator equals on overriding value type Equals", - "fullDescription": "In most programming languages there is no default implementation of the equality operator (==) for value types. If your programming language supports operator overloads, you should consider implementing the equality operator. Its behavior should be identical to that of Equals.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2231", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "OverloadOperatorEqualsOnOverridingValueTypeEqualsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2235": { - "id": "CA2235", - "shortDescription": "Mark all non-serializable fields", - "fullDescription": "An instance field of a type that is not serializable is declared in a type that is serializable.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2235", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "SerializationRulesDiagnosticAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2237": { - "id": "CA2237", - "shortDescription": "Mark ISerializable types with serializable", - "fullDescription": "To be recognized by the common language runtime as serializable, types must be marked by using the SerializableAttribute attribute even when the type uses a custom serialization routine through implementation of the ISerializable interface.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2237", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "SerializationRulesDiagnosticAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2241": { - "id": "CA2241", - "shortDescription": "Provide correct arguments to formatting methods", - "fullDescription": "The format argument that is passed to System.String.Format does not contain a format item that corresponds to each object argument, or vice versa.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2241", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "ProvideCorrectArgumentsToFormattingMethodsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2242": { - "id": "CA2242", - "shortDescription": "Test for NaN correctly", - "fullDescription": "This expression tests a value against Single.Nan or Double.Nan. Use Single.IsNan(Single) or Double.IsNan(Double) to test the value.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2242", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "TestForNaNCorrectlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2243": { - "id": "CA2243", - "shortDescription": "Attribute string literals should parse correctly", - "fullDescription": "The string literal parameter of an attribute does not parse correctly for a URL, a GUID, or a version.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2243", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "AttributeStringLiteralsShouldParseCorrectlyAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2244": { - "id": "CA2244", - "shortDescription": "Do not duplicate indexed element initializations", - "fullDescription": "Indexed elements in objects initializers must initialize unique elements. A duplicate index might overwrite a previous element initialization.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2244", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "AvoidDuplicateElementInitialization", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2245": { - "id": "CA2245", - "shortDescription": "Do not assign a property to itself", - "fullDescription": "The property {0} should not be assigned to itself", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2245", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "AvoidPropertySelfAssignment", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2246": { - "id": "CA2246", - "shortDescription": "Assigning symbol and its member in the same statement", - "fullDescription": "Assigning to a symbol and its member (field/property) in the same statement is not recommended. It is not clear if the member access was intended to use symbol's old value prior to the assignment or new value from the assignment in this statement. For clarity, consider splitting the assignments into separate statements.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2246", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "AssigningSymbolAndItsMemberInSameStatement", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2247": { - "id": "CA2247", - "shortDescription": "Argument passed to TaskCompletionSource constructor should be TaskCreationOptions enum instead of TaskContinuationOptions enum", - "fullDescription": "TaskCompletionSource has constructors that take TaskCreationOptions that control the underlying Task, and constructors that take object state that's stored in the task. Accidentally passing a TaskContinuationOptions instead of a TaskCreationOptions will result in the call treating the options as state.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2247", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DoNotCreateTaskCompletionSourceWithWrongArguments", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2248": { - "id": "CA2248", - "shortDescription": "Provide correct 'enum' argument to 'Enum.HasFlag'", - "fullDescription": "'Enum.HasFlag' method expects the 'enum' argument to be of the same 'enum' type as the instance on which the method is invoked and that this 'enum' is marked with 'System.FlagsAttribute'. If these are different 'enum' types, an unhandled exception will be thrown at runtime. If the 'enum' type is not marked with 'System.FlagsAttribute' the call will always return 'false' at runtime.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2248", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "ProvideCorrectArgumentToEnumHasFlag", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2249": { - "id": "CA2249", - "shortDescription": "Consider using 'string.Contains' instead of 'string.IndexOf'", - "fullDescription": "Calls to 'string.IndexOf' where the result is used to check for the presence/absence of a substring can be replaced by 'string.Contains'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2249", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "PreferStringContainsOverIndexOfAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2250": { - "id": "CA2250", - "shortDescription": "Use 'ThrowIfCancellationRequested'", - "fullDescription": "'ThrowIfCancellationRequested' automatically checks whether the token has been canceled, and throws an 'OperationCanceledException' if it has.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2250", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "UseCancellationTokenThrowIfCancellationRequested", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2251": { - "id": "CA2251", - "shortDescription": "Use 'string.Equals'", - "fullDescription": "It is both clearer and likely faster to use 'string.Equals' instead of comparing the result of 'string.Compare' to zero.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2251", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "UseStringEqualsOverStringCompare", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2253": { - "id": "CA2253", - "shortDescription": "Named placeholders should not be numeric values", - "fullDescription": "Named placeholders in the logging message template should not be comprised of only numeric characters.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2253", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "LoggerMessageDefineAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2254": { - "id": "CA2254", - "shortDescription": "Template should be a static expression", - "fullDescription": "The logging message template should not vary between calls.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2254", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "LoggerMessageDefineAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2255": { - "id": "CA2255", - "shortDescription": "The 'ModuleInitializer' attribute should not be used in libraries", - "fullDescription": "Module initializers are intended to be used by application code to ensure an application's components are initialized before the application code begins executing. If library code declares a method with the 'ModuleInitializerAttribute', it can interfere with application initialization and also lead to limitations in that application's trimming abilities. Instead of using methods marked with 'ModuleInitializerAttribute', the library should expose methods that can be used to initialize any components within the library and allow the application to invoke the method during application initialization.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2255", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "ModuleInitializerAttributeShouldNotBeUsedInLibraries", - "languages": [ - "C#" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2256": { - "id": "CA2256", - "shortDescription": "All members declared in parent interfaces must have an implementation in a DynamicInterfaceCastableImplementation-attributed interface", - "fullDescription": "Types attributed with 'DynamicInterfaceCastableImplementationAttribute' act as an interface implementation for a type that implements the 'IDynamicInterfaceCastable' type. As a result, it must provide an implementation of all of the members defined in the inherited interfaces, because the type that implements 'IDynamicInterfaceCastable' will not provide them otherwise.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2256", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DynamicInterfaceCastableImplementationAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2257": { - "id": "CA2257", - "shortDescription": "Members defined on an interface with the 'DynamicInterfaceCastableImplementationAttribute' should be 'static'", - "fullDescription": "Since a type that implements 'IDynamicInterfaceCastable' may not implement a dynamic interface in metadata, calls to an instance interface member that is not an explicit implementation defined on this type are likely to fail at runtime. Mark new interface members 'static' to avoid runtime errors.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2257", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DynamicInterfaceCastableImplementationAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2258": { - "id": "CA2258", - "shortDescription": "Providing a 'DynamicInterfaceCastableImplementation' interface in Visual Basic is unsupported", - "fullDescription": "Providing a functional 'DynamicInterfaceCastableImplementationAttribute'-attributed interface requires the Default Interface Members feature, which is unsupported in Visual Basic.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2258", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DynamicInterfaceCastableImplementationAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2259": { - "id": "CA2259", - "shortDescription": "'ThreadStatic' only affects static fields", - "fullDescription": "'ThreadStatic' only affects static fields. When applied to instance fields, it has no impact on behavior.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2259", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "UseThreadStaticCorrectly", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2261": { - "id": "CA2261", - "shortDescription": "Do not use ConfigureAwaitOptions.SuppressThrowing with Task", - "fullDescription": "The ConfigureAwaitOptions.SuppressThrowing option is only supported with the non-generic Task, not a Task. To use it with a Task, first cast to the base Task.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2261", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DoNotUseConfigureAwaitWithSuppressThrowing", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2262": { - "id": "CA2262", - "shortDescription": "Set 'MaxResponseHeadersLength' properly", - "fullDescription": "The property 'MaxResponseHeadersLength' is measured in kilobytes, not in bytes. The provided value is multiplied by 1024, which might be greater than your intended maximum length.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2262", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "ProvideHttpClientHandlerMaxResponseHeaderLengthValueCorrectly", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2264": { - "id": "CA2264", - "shortDescription": "Do not pass a non-nullable value to 'ArgumentNullException.ThrowIfNull'", - "fullDescription": "'ArgumentNullException.ThrowIfNull' throws when the passed argument is 'null'. Certain constructs like non-nullable structs, 'nameof()' and 'new' expressions are known to never be null, so 'ArgumentNullException.ThrowIfNull' will never throw.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2264", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DoNotPassNonNullableValueToArgumentNullExceptionThrowIfNull", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2265": { - "id": "CA2265", - "shortDescription": "Do not compare Span to 'null' or 'default'", - "fullDescription": "Comparing a span to 'null' or 'default' might not do what you intended. 'default' and the 'null' literal are implicitly converted to 'Span.Empty'. Remove the redundant comparison or make the code more explicit by using 'IsEmpty'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2265", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "DoNotCompareSpanToNullAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2300": { - "id": "CA2300", - "shortDescription": "Do not use insecure deserializer BinaryFormatter", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data. If you need to instead detect BinaryFormatter deserialization without a SerializationBinder set, then disable rule CA2300, and enable rules CA2301 and CA2302.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2300", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerBinaryFormatterMethods", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2301": { - "id": "CA2301", - "shortDescription": "Do not call BinaryFormatter.Deserialize without first setting BinaryFormatter.Binder", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2301", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerBinaryFormatterWithoutBinder", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2302": { - "id": "CA2302", - "shortDescription": "Ensure BinaryFormatter.Binder is set before calling BinaryFormatter.Deserialize", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2302", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerBinaryFormatterWithoutBinder", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2305": { - "id": "CA2305", - "shortDescription": "Do not use insecure deserializer LosFormatter", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2305", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerLosFormatter", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2310": { - "id": "CA2310", - "shortDescription": "Do not use insecure deserializer NetDataContractSerializer", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data. If you need to instead detect NetDataContractSerializer deserialization without a SerializationBinder set, then disable rule CA2310, and enable rules CA2311 and CA2312.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2310", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerNetDataContractSerializerMethods", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2311": { - "id": "CA2311", - "shortDescription": "Do not deserialize without first setting NetDataContractSerializer.Binder", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2311", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerNetDataContractSerializerWithoutBinder", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2312": { - "id": "CA2312", - "shortDescription": "Ensure NetDataContractSerializer.Binder is set before deserializing", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2312", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerNetDataContractSerializerWithoutBinder", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2315": { - "id": "CA2315", - "shortDescription": "Do not use insecure deserializer ObjectStateFormatter", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2315", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerObjectStateFormatter", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2321": { - "id": "CA2321", - "shortDescription": "Do not deserialize with JavaScriptSerializer using a SimpleTypeResolver", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data with a JavaScriptSerializer initialized with a SimpleTypeResolver. Initialize JavaScriptSerializer without a JavaScriptTypeResolver specified, or initialize with a JavaScriptTypeResolver that limits the types of objects in the deserialized object graph.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2321", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerJavaScriptSerializerWithSimpleTypeResolver", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2322": { - "id": "CA2322", - "shortDescription": "Ensure JavaScriptSerializer is not initialized with SimpleTypeResolver before deserializing", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data with a JavaScriptSerializer initialized with a SimpleTypeResolver. Ensure that the JavaScriptSerializer is initialized without a JavaScriptTypeResolver specified, or initialized with a JavaScriptTypeResolver that limits the types of objects in the deserialized object graph.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2322", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerJavaScriptSerializerWithSimpleTypeResolver", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2326": { - "id": "CA2326", - "shortDescription": "Do not use TypeNameHandling values other than None", - "fullDescription": "Deserializing JSON when using a TypeNameHandling value other than None can be insecure. If you need to instead detect Json.NET deserialization when a SerializationBinder isn't specified, then disable rule CA2326, and enable rules CA2327, CA2328, CA2329, and CA2330.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2326", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "JsonNetTypeNameHandling", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2327": { - "id": "CA2327", - "shortDescription": "Do not use insecure JsonSerializerSettings", - "fullDescription": "When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using JsonSerializerSettings, use TypeNameHandling.None, or for values other than None, restrict deserialized types with a SerializationBinder.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2327", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureSettingsForJsonNet", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2328": { - "id": "CA2328", - "shortDescription": "Ensure that JsonSerializerSettings are secure", - "fullDescription": "When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using JsonSerializerSettings, ensure TypeNameHandling.None is specified, or for values other than None, ensure a SerializationBinder is specified to restrict deserialized types.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2328", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureSettingsForJsonNet", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2329": { - "id": "CA2329", - "shortDescription": "Do not deserialize with JsonSerializer using an insecure configuration", - "fullDescription": "When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using deserializing JsonSerializer, use TypeNameHandling.None, or for values other than None, restrict deserialized types with a SerializationBinder.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2329", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerJsonNetWithoutBinder", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2330": { - "id": "CA2330", - "shortDescription": "Ensure that JsonSerializer has a secure configuration when deserializing", - "fullDescription": "When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using deserializing JsonSerializer, use TypeNameHandling.None, or for values other than None, restrict deserialized types with a SerializationBinder.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2330", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureDeserializerJsonNetWithoutBinder", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA2350": { - "id": "CA2350", - "shortDescription": "Do not use DataTable.ReadXml() with untrusted data", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2350", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseDataTableReadXml", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2351": { - "id": "CA2351", - "shortDescription": "Do not use DataSet.ReadXml() with untrusted data", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2351", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseDataSetReadXml", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2361": { - "id": "CA2361", - "shortDescription": "Ensure auto-generated class containing DataSet.ReadXml() is not used with untrusted data", - "fullDescription": "The method '{0}' is insecure when deserializing untrusted data. Make sure that auto-generated class containing the '{0}' call is not deserialized with untrusted data.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2361", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseDataSetReadXml", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3001": { - "id": "CA3001", - "shortDescription": "Review code for SQL injection vulnerabilities", - "fullDescription": "Potential SQL injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3001", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForSqlInjectionVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3002": { - "id": "CA3002", - "shortDescription": "Review code for XSS vulnerabilities", - "fullDescription": "Potential cross-site scripting (XSS) vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3002", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForXssVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3003": { - "id": "CA3003", - "shortDescription": "Review code for file path injection vulnerabilities", - "fullDescription": "Potential file path injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3003", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForFilePathInjectionVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3004": { - "id": "CA3004", - "shortDescription": "Review code for information disclosure vulnerabilities", - "fullDescription": "Potential information disclosure vulnerability was found where '{0}' in method '{1}' may contain unintended information from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3004", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForInformationDisclosureVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3005": { - "id": "CA3005", - "shortDescription": "Review code for LDAP injection vulnerabilities", - "fullDescription": "Potential LDAP injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3005", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForLdapInjectionVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3006": { - "id": "CA3006", - "shortDescription": "Review code for process command injection vulnerabilities", - "fullDescription": "Potential process command injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3006", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForCommandExecutionVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3007": { - "id": "CA3007", - "shortDescription": "Review code for open redirect vulnerabilities", - "fullDescription": "Potential open redirect vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3007", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForOpenRedirectVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3008": { - "id": "CA3008", - "shortDescription": "Review code for XPath injection vulnerabilities", - "fullDescription": "Potential XPath injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3008", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForXPathInjectionVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3009": { - "id": "CA3009", - "shortDescription": "Review code for XML injection vulnerabilities", - "fullDescription": "Potential XML injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3009", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForXmlInjectionVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3010": { - "id": "CA3010", - "shortDescription": "Review code for XAML injection vulnerabilities", - "fullDescription": "Potential XAML injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3010", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForXamlInjectionVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3011": { - "id": "CA3011", - "shortDescription": "Review code for DLL injection vulnerabilities", - "fullDescription": "Potential DLL injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3011", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForDllInjectionVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3012": { - "id": "CA3012", - "shortDescription": "Review code for regex injection vulnerabilities", - "fullDescription": "Potential regex injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3012", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ReviewCodeForRegexInjectionVulnerabilities", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3061": { - "id": "CA3061", - "shortDescription": "Do Not Add Schema By URL", - "fullDescription": "This overload of XmlSchemaCollection.Add method internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3061", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotAddSchemaByURL", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3075": { - "id": "CA3075", - "shortDescription": "Insecure DTD processing in XML", - "fullDescription": "Using XmlTextReader.Load(), creating an insecure XmlReaderSettings instance when invoking XmlReader.Create(), setting the InnerXml property of the XmlDocument and enabling DTD processing using XmlUrlResolver insecurely can lead to information disclosure. Replace it with a call to the Load() method overload that takes an XmlReader instance, use XmlReader.Create() to accept XmlReaderSettings arguments or consider explicitly setting secure values. The DataViewSettingCollectionString property of DataViewManager should always be assigned from a trusted source, the DtdProcessing property should be set to false, and the XmlResolver property should be changed to XmlSecureResolver or null.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3075", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseInsecureDtdProcessingAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3076": { - "id": "CA3076", - "shortDescription": "Insecure XSLT script processing", - "fullDescription": "Providing an insecure XsltSettings instance and an insecure XmlResolver instance to XslCompiledTransform.Load method is potentially unsafe as it allows processing script within XSL, which on an untrusted XSL input may lead to malicious code execution. Either replace the insecure XsltSettings argument with XsltSettings.Default or an instance that has disabled document function and script execution, or replace the XmlResolver argument with null or an XmlSecureResolver instance. This message may be suppressed if the input is known to be from a trusted source and external resource resolution from locations that are not known in advance must be supported.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3076", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseInsecureXSLTScriptExecutionAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3077": { - "id": "CA3077", - "shortDescription": "Insecure Processing in API Design, XmlDocument and XmlTextReader", - "fullDescription": "Enabling DTD processing on all instances derived from XmlTextReader or  XmlDocument and using XmlUrlResolver for resolving external XML entities may lead to information disclosure. Ensure to set the XmlResolver property to null, create an instance of XmlSecureResolver when processing untrusted input, or use XmlReader.Create method with a secure XmlReaderSettings argument. Unless you need to enable it, ensure the DtdProcessing property is set to false.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3077", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseInsecureDtdProcessingInApiDesignAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA3147": { - "id": "CA3147", - "shortDescription": "Mark Verb Handlers With Validate Antiforgery Token", - "fullDescription": "Missing ValidateAntiForgeryTokenAttribute on controller action {0}", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca3147", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "MarkVerbHandlersWithValidateAntiforgeryTokenAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5350": { - "id": "CA5350", - "shortDescription": "Do Not Use Weak Cryptographic Algorithms", - "fullDescription": "Cryptographic algorithms degrade over time as attacks become for advances to attacker get access to more computation. Depending on the type and application of this cryptographic algorithm, further degradation of the cryptographic strength of it may allow attackers to read enciphered messages, tamper with enciphered  messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA-2 512, SHA-2 384, or SHA-2 256.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5350", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseInsecureCryptographicAlgorithmsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5351": { - "id": "CA5351", - "shortDescription": "Do Not Use Broken Cryptographic Algorithms", - "fullDescription": "An attack making it computationally feasible to break this algorithm exists. This allows attackers to break the cryptographic guarantees it is designed to provide. Depending on the type and application of this cryptographic algorithm, this may allow attackers to read enciphered messages, tamper with enciphered  messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA512, SHA384, or SHA256. Replace digital signature uses with RSA with a key length greater than or equal to 2048-bits, or ECDSA with a key length greater than or equal to 256 bits.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5351", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseInsecureCryptographicAlgorithmsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5358": { - "id": "CA5358", - "shortDescription": "Review cipher mode usage with cryptography experts", - "fullDescription": "These cipher modes might be vulnerable to attacks. Consider using recommended modes (CBC, CTS).", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5358", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "ApprovedCipherModeAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5359": { - "id": "CA5359", - "shortDescription": "Do Not Disable Certificate Validation", - "fullDescription": "A certificate can help authenticate the identity of the server. Clients should validate the server certificate to ensure requests are sent to the intended server. If the ServerCertificateValidationCallback always returns 'true', any certificate will pass validation.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5359", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotDisableCertificateValidation", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5360": { - "id": "CA5360", - "shortDescription": "Do Not Call Dangerous Methods In Deserialization", - "fullDescription": "Insecure Deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application, inflict a Denial-of-Service (DoS) attack, or even execute arbitrary code upon it being deserialized. It’s frequently possible for malicious users to abuse these deserialization features when the application is deserializing untrusted data which is under their control. Specifically, invoke dangerous methods in the process of deserialization. Successful insecure deserialization attacks could allow an attacker to carry out attacks such as DoS attacks, authentication bypasses, and remote code execution.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5360", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotCallDangerousMethodsInDeserialization", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5361": { - "id": "CA5361", - "shortDescription": "Do Not Disable SChannel Use of Strong Crypto", - "fullDescription": "Starting with the .NET Framework 4.6, the System.Net.ServicePointManager and System.Net.Security.SslStream classes are recommended to use new protocols. The old ones have protocol weaknesses and are not supported. Setting Switch.System.Net.DontEnableSchUseStrongCrypto with true will use the old weak crypto check and opt out of the protocol migration.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5361", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotSetSwitch", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5362": { - "id": "CA5362", - "shortDescription": "Potential reference cycle in deserialized object graph", - "fullDescription": "Review code that processes untrusted deserialized data for handling of unexpected reference cycles. An unexpected reference cycle should not cause the code to enter an infinite loop. Otherwise, an unexpected reference cycle can allow an attacker to DOS or exhaust the memory of the process when deserializing untrusted data.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5362", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "PotentialReferenceCycleInDeserializedObjectGraph", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5363": { - "id": "CA5363", - "shortDescription": "Do Not Disable Request Validation", - "fullDescription": "Request validation is a feature in ASP.NET that examines HTTP requests and determines whether they contain potentially dangerous content. This check adds protection from markup or code in the URL query string, cookies, or posted form values that might have been added for malicious purposes. So, it is generally desirable and should be left enabled for defense in depth.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5363", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotDisableRequestValidation", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5364": { - "id": "CA5364", - "shortDescription": "Do Not Use Deprecated Security Protocols", - "fullDescription": "Using a deprecated security protocol rather than the system default is risky.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5364", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseDeprecatedSecurityProtocols", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5365": { - "id": "CA5365", - "shortDescription": "Do Not Disable HTTP Header Checking", - "fullDescription": "HTTP header checking enables encoding of the carriage return and newline characters, \\r and \\n, that are found in response headers. This encoding can help to avoid injection attacks that exploit an application that echoes untrusted data contained by the header.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5365", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotDisableHTTPHeaderChecking", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5366": { - "id": "CA5366", - "shortDescription": "Use XmlReader for 'DataSet.ReadXml()'", - "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5366", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "UseXmlReaderForDataSetReadXml", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5367": { - "id": "CA5367", - "shortDescription": "Do Not Serialize Types With Pointer Fields", - "fullDescription": "Pointers are not \"type safe\" in the sense that you cannot guarantee the correctness of the memory they point at. So, serializing types with pointer fields is dangerous, as it may allow an attacker to control the pointer.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5367", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotSerializeTypeWithPointerFields", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5368": { - "id": "CA5368", - "shortDescription": "Set ViewStateUserKey For Classes Derived From Page", - "fullDescription": "Setting the ViewStateUserKey property can help you prevent attacks on your application by allowing you to assign an identifier to the view-state variable for individual users so that they cannot use the variable to generate an attack. Otherwise, there will be cross-site request forgery vulnerabilities.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5368", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "SetViewStateUserKey", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5369": { - "id": "CA5369", - "shortDescription": "Use XmlReader for 'XmlSerializer.Deserialize()'", - "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5369", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "UseXmlReaderForDeserialize", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5370": { - "id": "CA5370", - "shortDescription": "Use XmlReader for XmlValidatingReader constructor", - "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5370", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "UseXmlReaderForValidatingReader", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5371": { - "id": "CA5371", - "shortDescription": "Use XmlReader for 'XmlSchema.Read()'", - "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5371", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "UseXmlReaderForSchemaRead", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5372": { - "id": "CA5372", - "shortDescription": "Use XmlReader for XPathDocument constructor", - "fullDescription": "Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5372", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "UseXmlReaderForXPathDocument", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5373": { - "id": "CA5373", - "shortDescription": "Do not use obsolete key derivation function", - "fullDescription": "Password-based key derivation should use PBKDF2 with SHA-2. Avoid using PasswordDeriveBytes since it generates a PBKDF1 key. Avoid using Rfc2898DeriveBytes.CryptDeriveKey since it doesn't use the iteration count or salt.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5373", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseObsoleteKDFAlgorithm", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5374": { - "id": "CA5374", - "shortDescription": "Do Not Use XslTransform", - "fullDescription": "Do not use XslTransform. It does not restrict potentially dangerous external references.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5374", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseXslTransform", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5375": { - "id": "CA5375", - "shortDescription": "Do Not Use Account Shared Access Signature", - "fullDescription": "Shared Access Signatures(SAS) are a vital part of the security model for any application using Azure Storage, they should provide limited and safe permissions to your storage account to clients that don't have the account key. All of the operations available via a service SAS are also available via an account SAS, that is, account SAS is too powerful. So it is recommended to use Service SAS to delegate access more carefully.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5375", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseAccountSAS", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5376": { - "id": "CA5376", - "shortDescription": "Use SharedAccessProtocol HttpsOnly", - "fullDescription": "HTTPS encrypts network traffic. Use HttpsOnly, rather than HttpOrHttps, to ensure network traffic is always encrypted to help prevent disclosure of sensitive data.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5376", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "UseSharedAccessProtocolHttpsOnly", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5377": { - "id": "CA5377", - "shortDescription": "Use Container Level Access Policy", - "fullDescription": "No access policy identifier is specified, making tokens non-revocable.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5377", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "UseContainerLevelAccessPolicy", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5378": { - "id": "CA5378", - "shortDescription": "Do not disable ServicePointManagerSecurityProtocols", - "fullDescription": "Do not set Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols to true. Setting this switch limits Windows Communication Framework (WCF) to using Transport Layer Security (TLS) 1.0, which is insecure and obsolete.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5378", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotSetSwitch", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5379": { - "id": "CA5379", - "shortDescription": "Ensure Key Derivation Function algorithm is sufficiently strong", - "fullDescription": "Some implementations of the Rfc2898DeriveBytes class allow for a hash algorithm to be specified in a constructor parameter or overwritten in the HashAlgorithm property. If a hash algorithm is specified, then it should be SHA-256 or higher.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5379", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseWeakKDFAlgorithm", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5380": { - "id": "CA5380", - "shortDescription": "Do Not Add Certificates To Root Store", - "fullDescription": "By default, the Trusted Root Certification Authorities certificate store is configured with a set of public CAs that has met the requirements of the Microsoft Root Certificate Program. Since all trusted root CAs can issue certificates for any domain, an attacker can pick a weak or coercible CA that you install by yourself to target for an attack - and a single vulnerable, malicious or coercible CA undermines the security of the entire system. To make matters worse, these attacks can go unnoticed quite easily.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5380", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotInstallRootCert", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5381": { - "id": "CA5381", - "shortDescription": "Ensure Certificates Are Not Added To Root Store", - "fullDescription": "By default, the Trusted Root Certification Authorities certificate store is configured with a set of public CAs that has met the requirements of the Microsoft Root Certificate Program. Since all trusted root CAs can issue certificates for any domain, an attacker can pick a weak or coercible CA that you install by yourself to target for an attack - and a single vulnerable, malicious or coercible CA undermines the security of the entire system. To make matters worse, these attacks can go unnoticed quite easily.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5381", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotInstallRootCert", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5382": { - "id": "CA5382", - "shortDescription": "Use Secure Cookies In ASP.NET Core", - "fullDescription": "Applications available over HTTPS must use secure cookies.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5382", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "UseSecureCookiesASPNetCore", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5383": { - "id": "CA5383", - "shortDescription": "Ensure Use Secure Cookies In ASP.NET Core", - "fullDescription": "Applications available over HTTPS must use secure cookies.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5383", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "UseSecureCookiesASPNetCore", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5384": { - "id": "CA5384", - "shortDescription": "Do Not Use Digital Signature Algorithm (DSA)", - "fullDescription": "DSA is too weak to use.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5384", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "DoNotUseDSA", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5385": { - "id": "CA5385", - "shortDescription": "Use Rivest-Shamir-Adleman (RSA) Algorithm With Sufficient Key Size", - "fullDescription": "Encryption algorithms are vulnerable to brute force attacks when too small a key size is used.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5385", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "UseRSAWithSufficientKeySize", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5386": { - "id": "CA5386", - "shortDescription": "Avoid hardcoding SecurityProtocolType value", - "fullDescription": "Avoid hardcoding SecurityProtocolType {0}, and instead use SecurityProtocolType.SystemDefault to allow the operating system to choose the best Transport Layer Security protocol to use.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5386", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseDeprecatedSecurityProtocols", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5387": { - "id": "CA5387", - "shortDescription": "Do Not Use Weak Key Derivation Function With Insufficient Iteration Count", - "fullDescription": "When deriving cryptographic keys from user-provided inputs such as password, use sufficient iteration count (at least 100k).", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5387", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseWeakKDFInsufficientIterationCount", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5388": { - "id": "CA5388", - "shortDescription": "Ensure Sufficient Iteration Count When Using Weak Key Derivation Function", - "fullDescription": "When deriving cryptographic keys from user-provided inputs such as password, use sufficient iteration count (at least 100k).", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5388", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseWeakKDFInsufficientIterationCount", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5389": { - "id": "CA5389", - "shortDescription": "Do Not Add Archive Item's Path To The Target File System Path", - "fullDescription": "When extracting files from an archive and using the archive item's path, check if the path is safe. Archive path can be relative and can lead to file system access outside of the expected file system target path, leading to malicious config changes and remote code execution via lay-and-wait technique.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5389", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotAddArchiveItemPathToTheTargetFileSystemPath", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5390": { - "id": "CA5390", - "shortDescription": "Do not hard-code encryption key", - "fullDescription": "SymmetricAlgorithm's .Key property, or a method's rgbKey parameter, should never be a hard-coded value.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5390", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotHardCodeEncryptionKey", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5391": { - "id": "CA5391", - "shortDescription": "Use antiforgery tokens in ASP.NET Core MVC controllers", - "fullDescription": "Handling a POST, PUT, PATCH, or DELETE request without validating an antiforgery token may be vulnerable to cross-site request forgery attacks. A cross-site request forgery attack can send malicious requests from an authenticated user to your ASP.NET Core MVC controller.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5391", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "UseAutoValidateAntiforgeryToken", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5392": { - "id": "CA5392", - "shortDescription": "Use DefaultDllImportSearchPaths attribute for P/Invokes", - "fullDescription": "By default, P/Invokes using DllImportAttribute probe a number of directories, including the current working directory for the library to load. This can be a security issue for certain applications, leading to DLL hijacking.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5392", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "UseDefaultDllImportSearchPathsAttribute", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5393": { - "id": "CA5393", - "shortDescription": "Do not use unsafe DllImportSearchPath value", - "fullDescription": "There could be a malicious DLL in the default DLL search directories. Or, depending on where your application is run from, there could be a malicious DLL in the application's directory. Use a DllImportSearchPath value that specifies an explicit search path instead. The DllImportSearchPath flags that this rule looks for can be configured in .editorconfig.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5393", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "UseDefaultDllImportSearchPathsAttribute", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5394": { - "id": "CA5394", - "shortDescription": "Do not use insecure randomness", - "fullDescription": "Using a cryptographically weak pseudo-random number generator may allow an attacker to predict what security-sensitive value will be generated. Use a cryptographically strong random number generator if an unpredictable value is required, or ensure that weak pseudo-random numbers aren't used in a security-sensitive manner.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5394", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseInsecureRandomness", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5395": { - "id": "CA5395", - "shortDescription": "Miss HttpVerb attribute for action methods", - "fullDescription": "All the methods that create, edit, delete, or otherwise modify data do so in the [HttpPost] overload of the method, which needs to be protected with the anti forgery attribute from request forgery. Performing a GET operation should be a safe operation that has no side effects and doesn't modify your persisted data.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5395", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "UseAutoValidateAntiforgeryToken", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5396": { - "id": "CA5396", - "shortDescription": "Set HttpOnly to true for HttpCookie", - "fullDescription": "As a defense in depth measure, ensure security sensitive HTTP cookies are marked as HttpOnly. This indicates web browsers should disallow scripts from accessing the cookies. Injected malicious scripts are a common way of stealing cookies.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5396", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "SetHttpOnlyForHttpCookie", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5397": { - "id": "CA5397", - "shortDescription": "Do not use deprecated SslProtocols values", - "fullDescription": "Older protocol versions of Transport Layer Security (TLS) are less secure than TLS 1.2 and TLS 1.3, and are more likely to have new vulnerabilities. Avoid older protocol versions to minimize risk.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5397", - "properties": { - "category": "Security", - "isEnabledByDefault": true, - "typeName": "SslProtocolsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5398": { - "id": "CA5398", - "shortDescription": "Avoid hardcoded SslProtocols values", - "fullDescription": "Current Transport Layer Security protocol versions may become deprecated if vulnerabilities are found. Avoid hardcoding SslProtocols values to keep your application secure. Use 'None' to let the Operating System choose a version.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5398", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "SslProtocolsAnalyzer", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5399": { - "id": "CA5399", - "shortDescription": "HttpClients should enable certificate revocation list checks", - "fullDescription": "Using HttpClient without providing a platform specific handler (WinHttpHandler or CurlHandler or HttpClientHandler) where the CheckCertificateRevocationList property is set to true, will allow revoked certificates to be accepted by the HttpClient as valid.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5399", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotDisableHttpClientCRLCheck", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5400": { - "id": "CA5400", - "shortDescription": "Ensure HttpClient certificate revocation list check is not disabled", - "fullDescription": "Using HttpClient without providing a platform specific handler (WinHttpHandler or CurlHandler or HttpClientHandler) where the CheckCertificateRevocationList property is set to true, will allow revoked certificates to be accepted by the HttpClient as valid.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5400", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotDisableHttpClientCRLCheck", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5401": { - "id": "CA5401", - "shortDescription": "Do not use CreateEncryptor with non-default IV", - "fullDescription": "Symmetric encryption should always use a non-repeatable initialization vector to prevent dictionary attacks.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5401", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseCreateEncryptorWithNonDefaultIV", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5402": { - "id": "CA5402", - "shortDescription": "Use CreateEncryptor with the default IV", - "fullDescription": "Symmetric encryption should always use a non-repeatable initialization vector to prevent dictionary attacks.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5402", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotUseCreateEncryptorWithNonDefaultIV", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA5403": { - "id": "CA5403", - "shortDescription": "Do not hard-code certificate", - "fullDescription": "Hard-coded certificates in source code are vulnerable to being exploited.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5403", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotHardCodeCertificate", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5404": { - "id": "CA5404", - "shortDescription": "Do not disable token validation checks", - "fullDescription": "Token validation checks ensure that while validating tokens, all aspects are analyzed and verified. Turning off validation can lead to security holes by allowing untrusted tokens to make it through validation.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5404", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotDisableTokenValidationChecks", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA5405": { - "id": "CA5405", - "shortDescription": "Do not always skip token validation in delegates", - "fullDescription": "By setting critical TokenValidationParameter validation delegates to true, important authentication safeguards are disabled which can lead to tokens from any issuer or expired tokens being wrongly validated.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5405", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "DoNotAlwaysSkipTokenValidationInDelegates", - "languages": [ - "C#", - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - } - } - }, - { - "tool": { - "name": "Microsoft.CodeAnalysis.VisualBasic.NetAnalyzers", - "version": "10.0.300", - "language": "en-US" - }, - "rules": { - "CA1032": { - "id": "CA1032", - "shortDescription": "Implement standard exception constructors", - "fullDescription": "Failure to provide the full set of constructors can make it difficult to correctly handle exceptions.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1032", - "properties": { - "category": "Design", - "isEnabledByDefault": false, - "typeName": "BasicImplementStandardExceptionConstructorsAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1200": { - "id": "CA1200", - "shortDescription": "Avoid using cref tags with a prefix", - "fullDescription": "Use of cref tags with prefixes should be avoided, since it prevents the compiler from verifying references and the IDE from updating references during refactorings. It is permissible to suppress this error at a single documentation site if the cref must use a prefix because the type being mentioned is not findable by the compiler. For example, if a cref is mentioning a special attribute in the full framework but you're in a file that compiles against the portable framework, or if you want to reference a type at higher layer of Roslyn, you should suppress the error. You should not suppress the error just because you want to take a shortcut and avoid using the full syntax.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1200", - "properties": { - "category": "Documentation", - "isEnabledByDefault": true, - "typeName": "BasicAvoidUsingCrefTagsWithAPrefixAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1309": { - "id": "CA1309", - "shortDescription": "Use ordinal string comparison", - "fullDescription": "A string comparison operation that is nonlinguistic does not set the StringComparison parameter to either Ordinal or OrdinalIgnoreCase. By explicitly setting the parameter to either StringComparison.Ordinal or StringComparison.OrdinalIgnoreCase, your code often gains speed, becomes more correct, and becomes more reliable.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1309", - "properties": { - "category": "Globalization", - "isEnabledByDefault": true, - "typeName": "BasicUseOrdinalStringComparisonAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1311": { - "id": "CA1311", - "shortDescription": "Specify a culture or use an invariant version", - "fullDescription": "Specify culture to help avoid accidental implicit dependency on current culture. Using an invariant version yields consistent results regardless of the culture of an application.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1311", - "properties": { - "category": "Globalization", - "isEnabledByDefault": true, - "typeName": "BasicSpecifyCultureForToLowerAndToUpperAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1507": { - "id": "CA1507", - "shortDescription": "Use nameof to express symbol names", - "fullDescription": "Using nameof helps keep your code valid when refactoring.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1507", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": true, - "typeName": "BasicUseNameofInPlaceOfStringAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1508": { - "id": "CA1508", - "shortDescription": "Avoid dead conditional code", - "fullDescription": "'{0}' is never '{1}'. Remove or refactor the condition(s) to avoid dead code.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1508", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": false, - "typeName": "BasicAvoidDeadConditionalCode", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1515": { - "id": "CA1515", - "shortDescription": "Consider making public types internal", - "fullDescription": "Unlike a class library, an application's API isn't typically referenced publicly, so types can be marked internal.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1515", - "properties": { - "category": "Maintainability", - "isEnabledByDefault": false, - "typeName": "BasicMakeTypesInternal", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1802": { - "id": "CA1802", - "shortDescription": "Use literals where appropriate", - "fullDescription": "A field is declared static and read-only (Shared and ReadOnly in Visual Basic), and is initialized by using a value that is computable at compile time. Because the value that is assigned to the targeted field is computable at compile time, change the declaration to a const (Const in Visual Basic) field so that the value is computed at compile time instead of at runtime.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1802", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "BasicUseLiteralsWhereAppropriate", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1805": { - "id": "CA1805", - "shortDescription": "Do not initialize unnecessarily", - "fullDescription": "The .NET runtime initializes all fields of reference types to their default values before running the constructor. In most cases, explicitly initializing a field to its default value in a constructor is redundant, adding maintenance costs and potentially degrading performance (such as with increased assembly size), and the explicit initialization can be removed. In some cases, such as with static readonly fields that permanently retain their default value, consider instead changing them to be constants or properties.", - "defaultLevel": "hidden", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1805", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "BasicDoNotInitializeUnnecessarilyAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1812": { - "id": "CA1812", - "shortDescription": "Avoid uninstantiated internal classes", - "fullDescription": "An instance of an assembly-level type is not created by code in the assembly.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1812", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "BasicAvoidUninstantiatedInternalClasses", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" - ] - } - }, - "CA1824": { - "id": "CA1824", - "shortDescription": "Mark assemblies with NeutralResourcesLanguageAttribute", - "fullDescription": "The NeutralResourcesLanguage attribute informs the ResourceManager of the language that was used to display the resources of a neutral culture for an assembly. This improves lookup performance for the first resource that you load and can reduce your working set.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1824", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "BasicMarkAssembliesWithNeutralResourcesLanguageAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1825": { - "id": "CA1825", - "shortDescription": "Avoid zero-length array allocations", - "fullDescription": "Avoid unnecessary zero-length array allocations. Use {0} instead.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1825", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "BasicAvoidZeroLengthArrayAllocationsAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1841": { - "id": "CA1841", - "shortDescription": "Prefer Dictionary.Contains methods", - "fullDescription": "Many dictionary implementations lazily initialize the Values collection. To avoid unnecessary allocations, prefer 'ContainsValue' over 'Values.Contains'.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1841", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "BasicPreferDictionaryContainsMethods", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1845": { - "id": "CA1845", - "shortDescription": "Use span-based 'string.Concat'", - "fullDescription": "It is more efficient to use 'AsSpan' and 'string.Concat', instead of 'Substring' and a concatenation operator.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1845", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "BasicUseSpanBasedStringConcat", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1851": { - "id": "CA1851", - "shortDescription": "Possible multiple enumerations of 'IEnumerable' collection", - "fullDescription": "Possible multiple enumerations of 'IEnumerable' collection. Consider using an implementation that avoids multiple enumerations.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1851", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "BasicAvoidMultipleEnumerationsAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Dataflow", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1865": { - "id": "CA1865", - "shortDescription": "Use char overload", - "fullDescription": "The char overload is a better performing overload than a string with a single char.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1865", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "BasicUseStringMethodCharOverloadWithSingleCharacters", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1866": { - "id": "CA1866", - "shortDescription": "Use char overload", - "fullDescription": "The char overload is a better performing overload than a string with a single char.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1866", - "properties": { - "category": "Performance", - "isEnabledByDefault": true, - "typeName": "BasicUseStringMethodCharOverloadWithSingleCharacters", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA1867": { - "id": "CA1867", - "shortDescription": "Use char overload", - "fullDescription": "The char overload is a better performing overload than a string with a single char.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca1867", - "properties": { - "category": "Performance", - "isEnabledByDefault": false, - "typeName": "BasicUseStringMethodCharOverloadWithSingleCharacters", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2016": { - "id": "CA2016", - "shortDescription": "Forward the 'CancellationToken' parameter to methods", - "fullDescription": "Forward the 'CancellationToken' parameter to methods to ensure the operation cancellation notifications gets properly propagated, or pass in 'CancellationToken.None' explicitly to indicate intentionally not propagating the token.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2016", - "properties": { - "category": "Reliability", - "isEnabledByDefault": true, - "typeName": "BasicForwardCancellationTokenToInvocationsAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2218": { - "id": "CA2218", - "shortDescription": "Override GetHashCode on overriding Equals", - "fullDescription": "GetHashCode returns a value, based on the current instance, that is suited for hashing algorithms and data structures such as a hash table. Two objects that are the same type and are equal must return the same hash code.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2218", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "BasicOverrideGetHashCodeOnOverridingEqualsAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2224": { - "id": "CA2224", - "shortDescription": "Override Equals on overloading operator equals", - "fullDescription": "A public type implements the equality operator but does not override Object.Equals.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2224", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "BasicOverrideEqualsOnOverloadingOperatorEqualsAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2234": { - "id": "CA2234", - "shortDescription": "Pass system uri objects instead of strings", - "fullDescription": "A call is made to a method that has a string parameter whose name contains \"uri\", \"URI\", \"urn\", \"URN\", \"url\", or \"URL\". The declaring type of the method contains a corresponding method overload that has a System.Uri parameter.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2234", - "properties": { - "category": "Usage", - "isEnabledByDefault": false, - "typeName": "BasicPassSystemUriObjectsInsteadOfStringsAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "PortedFromFxCop", - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2252": { - "id": "CA2252", - "shortDescription": "This API requires opting into preview features", - "fullDescription": "An assembly has to opt into preview features before using them.", - "defaultLevel": "error", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2252", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "BasicDetectPreviewFeatureAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2263": { - "id": "CA2263", - "shortDescription": "Prefer generic overload when type is known", - "fullDescription": "Using a generic overload is preferable to the 'System.Type' overload when the type is known, promoting cleaner and more type-safe code with improved compile-time checks.", - "defaultLevel": "note", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2263", - "properties": { - "category": "Usage", - "isEnabledByDefault": true, - "typeName": "BasicPreferGenericOverloadsAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2352": { - "id": "CA2352", - "shortDescription": "Unsafe DataSet or DataTable in serializable type can be vulnerable to remote code execution attacks", - "fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2352", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "BasicDataSetDataTableInSerializableTypeAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2353": { - "id": "CA2353", - "shortDescription": "Unsafe DataSet or DataTable in serializable type", - "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2353", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "BasicDataSetDataTableInSerializableTypeAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2354": { - "id": "CA2354", - "shortDescription": "Unsafe DataSet or DataTable in deserialized object graph can be vulnerable to remote code execution attacks", - "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2354", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "BasicDataSetDataTableInIFormatterSerializableObjectGraphAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2355": { - "id": "CA2355", - "shortDescription": "Unsafe DataSet or DataTable type found in deserializable object graph", - "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2355", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "BasicDataSetDataTableInSerializableObjectGraphAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2356": { - "id": "CA2356", - "shortDescription": "Unsafe DataSet or DataTable type in web deserializable object graph", - "fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2356", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "BasicDataSetDataTableInWebSerializableObjectGraphAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - }, - "CA2362": { - "id": "CA2362", - "shortDescription": "Unsafe DataSet or DataTable in auto-generated serializable type can be vulnerable to remote code execution attacks", - "fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the auto-generated type is never deserialized with untrusted data.", - "defaultLevel": "warning", - "helpUri": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca2362", - "properties": { - "category": "Security", - "isEnabledByDefault": false, - "typeName": "BasicDataSetDataTableInSerializableTypeAnalyzer", - "languages": [ - "Visual Basic" - ], - "tags": [ - "Telemetry", - "EnabledRuleInAggressiveMode" - ] - } - } - } - } - ] -} \ No newline at end of file From 162a08af84227af981405b3dadfa724eee1d28e2 Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Sat, 28 Mar 2026 13:21:12 +0100 Subject: [PATCH 09/11] Improve tests --- .../MissingShebangInFileBasedProgramTests.cs | 49 +++++++++++-------- 1 file changed, 29 insertions(+), 20 deletions(-) diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs index cf46b2cfad44..120290e0f55a 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgramTests.cs @@ -64,16 +64,16 @@ public async Task SingleFile_NoDiagnosticAsync() } [Fact] - public async Task NonEntryPointFile_MultipleFiles_NoDiagnosticAsync() + public async Task EntryPointWithoutShebang_CodeFixAddsShebangAsync() { - // Only the entry point gets the diagnostic, not other files. + // Verify that the code fix prepends a shebang line. await new VerifyCS.Test { TestState = { Sources = { - ("Test0.cs", """class Program { static void Main() { Util.Greet(); } }"""), + ("Test0.cs", """class Program { static void Main() { } }"""), ("Util.cs", """class Util { public static string Greet() => "hello"; }"""), }, AnalyzerConfigFiles = { ("/.globalconfig", GlobalConfig) }, @@ -82,29 +82,39 @@ public async Task NonEntryPointFile_MultipleFiles_NoDiagnosticAsync() new DiagnosticResult(MissingShebangInFileBasedProgram.Rule).WithLocation("Test0.cs", 1, 1), }, }, - }.RunAsync(); - } - - [Fact] - public async Task EntryPointWithoutShebang_CodeFixAddsShebangAsync() - { - // Verify that the code fix prepends a shebang line. - await new VerifyCS.Test - { - TestState = + FixedState = { Sources = { - ("Test0.cs", """class Program { static void Main() { } }"""), + ("Test0.cs", """ + #!/usr/bin/env dotnet + class Program { static void Main() { } } + """), ("Util.cs", """class Util { public static string Greet() => "hello"; }"""), }, - AnalyzerConfigFiles = { ("/.globalconfig", GlobalConfig) }, - ExpectedDiagnostics = + }, + CodeFixTestBehaviors = CodeFixTestBehaviors.SkipLocalDiagnosticCheck, + SolutionTransforms = + { + (solution, projectId) => { - new DiagnosticResult(MissingShebangInFileBasedProgram.Rule).WithLocation("Test0.cs", 1, 1), + // Enable #! shebang support in the parser. + var parseOptions = (CSharpParseOptions)solution.GetProject(projectId)!.ParseOptions!; + return solution.WithProjectParseOptions(projectId, + parseOptions.WithFeatures(parseOptions.Features.Concat( + [new KeyValuePair("FileBasedProgram", "true")]))); }, }, - FixedState = + }.RunAsync(); + } + + [Fact] + public async Task EntryPointWithShebang_MultipleFiles_NoDiagnosticAsync() + { + // Entry point already has shebang, multiple files - no diagnostic. + await new VerifyCS.Test + { + TestState = { Sources = { @@ -114,13 +124,12 @@ class Program { static void Main() { } } """), ("Util.cs", """class Util { public static string Greet() => "hello"; }"""), }, + AnalyzerConfigFiles = { ("/.globalconfig", GlobalConfig) }, }, - CodeFixTestBehaviors = CodeFixTestBehaviors.SkipLocalDiagnosticCheck, SolutionTransforms = { (solution, projectId) => { - // Enable #! shebang support in the parser. var parseOptions = (CSharpParseOptions)solution.GetProject(projectId)!.ParseOptions!; return solution.WithProjectParseOptions(projectId, parseOptions.WithFeatures(parseOptions.Features.Concat( From e5e3765d3cb91e500f2ec1234e4734e153556604 Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Tue, 31 Mar 2026 15:36:34 +0200 Subject: [PATCH 10/11] Improve code --- ...pMissingShebangInFileBasedProgram.Fixer.cs | 25 ++++------- .../CSharpMissingShebangInFileBasedProgram.cs | 42 ++++++++++--------- .../Microsoft.CodeAnalysis.NetAnalyzers.sarif | 3 +- .../Usage/MissingShebangInFileBasedProgram.cs | 2 +- 4 files changed, 32 insertions(+), 40 deletions(-) diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.Fixer.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.Fixer.cs index e1191de30e7c..7894c0ab6c33 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.Fixer.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.Fixer.cs @@ -5,7 +5,7 @@ using Microsoft.CodeAnalysis.CodeActions; using Microsoft.CodeAnalysis.CodeFixes; using Microsoft.CodeAnalysis.CSharp; -using Microsoft.CodeAnalysis.Text; +using Microsoft.CodeAnalysis.Formatting; using Microsoft.NetCore.Analyzers; using Microsoft.NetCore.Analyzers.Usage; @@ -24,30 +24,19 @@ public override async Task RegisterCodeFixesAsync(CodeFixContext context) var codeAction = CodeAction.Create( MicrosoftNetCoreAnalyzersResources.MissingShebangInFileBasedProgramCodeFixTitle, - _ => + async ct => { - var eol = GetEndOfLine(root.SyntaxTree.GetText()); + var options = await context.Document.GetOptionsAsync(ct).ConfigureAwait(false); + var eol = options.GetOption(FormattingOptions.NewLine, LanguageNames.CSharp); var shebangTrivia = SyntaxFactory.ParseLeadingTrivia("#!/usr/bin/env dotnet" + eol); var firstToken = root.GetFirstToken(includeZeroWidth: true); var newFirstToken = firstToken.WithLeadingTrivia(shebangTrivia.AddRange(firstToken.LeadingTrivia)); - var newRoot = root.ReplaceToken(firstToken, newFirstToken); - return Task.FromResult(context.Document.WithSyntaxRoot(newRoot)); + var newRoot = root.ReplaceToken(firstToken, newFirstToken) + .WithAdditionalAnnotations(Formatter.Annotation); + return context.Document.WithSyntaxRoot(newRoot); }, MicrosoftNetCoreAnalyzersResources.MissingShebangInFileBasedProgramCodeFixTitle); context.RegisterCodeFix(codeAction, context.Diagnostics); } - - private static string GetEndOfLine(SourceText sourceText) - { - foreach (var line in sourceText.Lines) - { - if (line.End < line.EndIncludingLineBreak) - { - return sourceText.ToString(TextSpan.FromBounds(line.End, line.EndIncludingLineBreak)); - } - } - - return Environment.NewLine; - } } } diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs index d8dcadea3a3d..03eeeeb2e4d4 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs @@ -26,17 +26,32 @@ public override void Initialize(AnalysisContext context) return; } - // Track whether there are multiple non-generated source files. - // ConfigureGeneratedCodeAnalysis(None) ensures that the SyntaxTreeAction - // is only called for non-generated trees, so we count those. + // Count non-generated trees in the compilation upfront. + // We avoid CompilationEnd so diagnostics appear as live IDE diagnostics. int nonGeneratedTreeCount = 0; - Diagnostic? pendingDiagnostic = null; + foreach (var tree in context.Compilation.SyntaxTrees) + { + if (context.Options.AnalyzerConfigOptionsProvider.GetOptions(tree) + .TryGetValue("generated_code", out var generatedValue) && + generatedValue.Equals("true", StringComparison.OrdinalIgnoreCase)) + { + continue; + } - context.RegisterSyntaxTreeAction(context => + nonGeneratedTreeCount++; + } + + // Only report when there are multiple non-generated files + // (i.e., #:include directives are used). + // Single-file programs don't need a shebang to distinguish the entry point. + if (nonGeneratedTreeCount <= 1) { - Interlocked.Increment(ref nonGeneratedTreeCount); + return; + } - if (!context.Tree.FilePath.Equals(entryPointFilePath, StringComparison.OrdinalIgnoreCase)) + context.RegisterSyntaxTreeAction(context => + { + if (!context.Tree.FilePath.Equals(entryPointFilePath, StringComparison.Ordinal)) { return; } @@ -48,18 +63,7 @@ public override void Initialize(AnalysisContext context) } var location = root.GetFirstToken(includeZeroWidth: true).GetLocation(); - Interlocked.CompareExchange(ref pendingDiagnostic, location.CreateDiagnostic(Rule), null); - }); - - context.RegisterCompilationEndAction(context => - { - // Only report when there are multiple non-generated files - // (i.e., #:include directives are used). - // Single-file programs don't need a shebang to distinguish the entry point. - if (Volatile.Read(ref nonGeneratedTreeCount) > 1 && pendingDiagnostic is { } diagnostic) - { - context.ReportDiagnostic(diagnostic); - } + context.ReportDiagnostic(location.CreateDiagnostic(Rule)); }); }); } diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif index 1d2bb3538904..b2710e8f8fbd 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers.sarif @@ -604,8 +604,7 @@ ], "tags": [ "Telemetry", - "EnabledRuleInAggressiveMode", - "CompilationEnd" + "EnabledRuleInAggressiveMode" ] } }, diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.cs index 58cb16d57002..938e7ce7c00f 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/MissingShebangInFileBasedProgram.cs @@ -22,7 +22,7 @@ public abstract class MissingShebangInFileBasedProgram : DiagnosticAnalyzer CreateLocalizableResourceString(nameof(MissingShebangInFileBasedProgramDescription)), isPortedFxCopRule: false, isDataflowRule: false, - isReportedAtCompilationEnd: true); + isReportedAtCompilationEnd: false); public sealed override ImmutableArray SupportedDiagnostics { get; } = ImmutableArray.Create(Rule); } From df349de1121766b464ec24608700ca401eeb4bb8 Mon Sep 17 00:00:00 2001 From: Jan Jones Date: Tue, 31 Mar 2026 18:21:46 +0200 Subject: [PATCH 11/11] Fix checking generated code --- .../CSharpMissingShebangInFileBasedProgram.cs | 67 +++++++++++++++++-- 1 file changed, 63 insertions(+), 4 deletions(-) diff --git a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs index 03eeeeb2e4d4..72966e162403 100644 --- a/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs +++ b/src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.CSharp.NetAnalyzers/Microsoft.NetCore.Analyzers/Usage/CSharpMissingShebangInFileBasedProgram.cs @@ -26,14 +26,16 @@ public override void Initialize(AnalysisContext context) return; } - // Count non-generated trees in the compilation upfront. + // Count non-generated trees upfront so we can report directly + // from a SyntaxTreeAction without needing CompilationEnd. // We avoid CompilationEnd so diagnostics appear as live IDE diagnostics. + // We replicate Roslyn's generated code detection here because + // Compilation.SyntaxTrees is the raw set (unlike RegisterSyntaxTreeAction + // which gets automatic filtering via ConfigureGeneratedCodeAnalysis). int nonGeneratedTreeCount = 0; foreach (var tree in context.Compilation.SyntaxTrees) { - if (context.Options.AnalyzerConfigOptionsProvider.GetOptions(tree) - .TryGetValue("generated_code", out var generatedValue) && - generatedValue.Equals("true", StringComparison.OrdinalIgnoreCase)) + if (IsGeneratedCode(tree, context.Options.AnalyzerConfigOptionsProvider)) { continue; } @@ -67,5 +69,62 @@ public override void Initialize(AnalysisContext context) }); }); } + + /// + /// Replicates Roslyn's generated code detection which checks: + /// the generated_code analyzer config option, + /// common file name patterns, and <auto-generated> comment headers. + /// + private static bool IsGeneratedCode(SyntaxTree tree, AnalyzerConfigOptionsProvider optionsProvider) + { + if (optionsProvider.GetOptions(tree) + .TryGetValue("generated_code", out var generatedValue) && + generatedValue.Equals("true", StringComparison.OrdinalIgnoreCase)) + { + return true; + } + + var filePath = tree.FilePath; + if (!string.IsNullOrEmpty(filePath)) + { + var fileName = Path.GetFileName(filePath); + if (fileName.StartsWith("TemporaryGeneratedFile_", StringComparison.OrdinalIgnoreCase)) + { + return true; + } + + var nameWithoutExtension = Path.GetFileNameWithoutExtension(fileName); + if (nameWithoutExtension.EndsWith(".designer", StringComparison.OrdinalIgnoreCase) || + nameWithoutExtension.EndsWith(".generated", StringComparison.OrdinalIgnoreCase) || + nameWithoutExtension.EndsWith(".g", StringComparison.OrdinalIgnoreCase) || + nameWithoutExtension.EndsWith(".g.i", StringComparison.OrdinalIgnoreCase)) + { + return true; + } + } + + // Check for or comment at the top of the file. + foreach (var trivia in tree.GetRoot().GetLeadingTrivia()) + { + switch (trivia.Kind()) + { + case SyntaxKind.SingleLineCommentTrivia: + case SyntaxKind.MultiLineCommentTrivia: + var text = trivia.ToString(); + if (text.Contains("