Questions tagged [fxcop]
Microsoft's free static analysis tool for analyzing .NET managed code assemblies.
748
questions
0
votes
0
answers
40
views
How to convert FxCopReport format in sarif format?
Running microsoft code analysis using MSBUILD creates xml file which is in FxCopReport format. How canit be converted in sarif format ?
0
votes
0
answers
13
views
Visual Studio 2019 during publish getting fxcop is hung or deadlock error
I am trying to publish my web application in visual studio 2019 and during the publish getting the below fxcop error.
"MSbuild error CA 0001 - Fxcop is hung or deadlocked".
How to fix this ...
1
vote
1
answer
125
views
Creating Custom Rules for .Net Analyzers
We are switching to .Net Analyzers on our .Net 5 and 6 projects. On previous projects we had dlls we wrote for some custom rules that we use. I've looked around and can't find any information on how ...
0
votes
1
answer
26
views
File names and line numbers missing from FXCOP output in SDK-style project targeting .NET Framework
We used FXCOP code analysis ("legacy") a lot in our solution. We are turning on many Microsoft rules, and also have written a large set of our own FXCOP-style analyzers for aspects of code ...
1
vote
1
answer
210
views
How to get CA2100 SQL injection warning in calling methods
I have a helper method to prevent a lot of copy and paste. I want to make sure calling methods of my helper method "MyExecuteSQLQuery" will be checked against rule "CA2100: Review SQL ...
1
vote
0
answers
115
views
CA1063 Remove finalizer from class and add it in the code where disposing is false
I have been trying to avoid this warning, what I have tried and understand according to CA1063: Implement IDisposable correctly is that the finalizer should just include the Dispose method in false. ...
0
votes
1
answer
2k
views
CA1707 warning on constants names
why microsoft keeps documenting code with constant like WM_SOMECONSTANT but the code analysis in Visual Studio reports the CA1707 warning?
Should we suppress all these warning for the solution?
should ...
0
votes
2
answers
141
views
Remove all, except the first two parameters from the EventHandler
I am having trouble with the warning CA1009 from FxCop to remove all the poarameters except the first two from the event (object and EventArgs). I have not found the way to solve this issue, bécause ...
0
votes
1
answer
349
views
Warning: SQL injection attacks
I have been trying to adapt my code to FxCop rules and I found this warning: CA2100 Review the query string passed to 'OleDbDataAdapter.OleDbDataAdapter(string, OleDbConnection)' in 'WavesShaperNew....
1
vote
1
answer
239
views
Are FxCopAnalyzers and the .editorconfig file supposed to sync?
When I add an .editorconfig file to my project, it doesn't match the rules shown in the project's Dependencies > Analyzers.
For example, my .editorconfig file has this:
dotnet_diagnostic.CA2200....
2
votes
2
answers
290
views
Opening the Code Analysis Ruleset editor crashes Visual Studio
Every time I try to do anything with Code Analysis, Visual Studio crashes. The event viewer shows the crash is caused by an invalid window-splitter size.
Stacktrace:
Application: devenv.exe
Framework ...
1
vote
0
answers
169
views
How should you type an enumerable property in .NET Core configuration when using options?
I'm trying to work out the best way of using enumerable properties in an options object that's populated through appsettings.json configuration.
I have an example object below that I'll be configuring ...
0
votes
1
answer
509
views
Running FxCop analyzers from command line
I'm trying to use the new FxCop analyzers, but they're only available as NuGet packages or as VSIX extensions. I'd like to be able to run them directly, either from inside a C# program or from the ...
2
votes
0
answers
71
views
Does FxCop Analyzers works with blazor project?
I know the FxCop analyzers work well in CSharp files. Does it work with .razor files as well for a Blazor project?
2
votes
1
answer
249
views
Disable / Turn off FxCop CA1303 when calling LoggerExtensions methods in ASP .NET Core 3.1
I want my logs to be in English and therefore do not want to localize them.
I have a project in ASP .NET Core 3.1 where I added the nuget package Microsoft.CodeAnalysis.FxCopAnalyzers version 3.0.0 ...
2
votes
2
answers
455
views
Suppress CA1303 fxcop warning when constructing a new Exception
When I throw an exception in my ASP.NET Core 3.1 code, fxcop warns me when it sees a string literal as an argument to a new Exception(). For example:
throw new InvalidOperationException("Ouch");
...
1
vote
1
answer
653
views
Suppress CA1707 on constants
I'm new to FxCop. I have some constants that have underscores in the name. The name of these constants are somewhat long and can't be shortened. We don't use Pascal Case for constants - they are all ...
1
vote
1
answer
1k
views
How to make .editorconfig naming violations visible to dotnet build? (IDE1006 warnings)
I have recently implemented custom FxCopAnalyzers policies via .editorconfig for a netcoreapp3.1 c# project. I now have lots more warnings and hints in Visual Studio for code style and naming policies ...
0
votes
2
answers
2k
views
Visual Studio SonarLint extension connected to SonarQube is generating warnings CA0507 and CA0064 and no sonar Sxxx warnings
I installed the SonarLint extension for Visual Studio and connected successfully to our SonarQube server and successfully ran Code Analysis to display sonar issues in VS. So it was working OK but for ...
1
vote
1
answer
875
views
How to call/run fxcop analyzer from pre-commit git hook? C#
I'm Fxcop Analyzer style checker.
I want to run/call Fxcop from pre-commit, so if Fxcop finds any error or fields so Git Hook pre-commit should stop commit process.
I had never programmer in Bash and ...
0
votes
0
answers
42
views
Why is there a difference in analysis results in Microsoft.NetCore.Analyzers CA2000
My previous question was too abstract and downvoted. You can find it at Factory method to create disposable containers
I'd like to return two objects from a DAC factory. Namely the dataset loaded and ...
0
votes
1
answer
93
views
Using NCrunch, FxCop Analyzers and "warnings as errors": How to configure warning severity in NCrunch?
I am coding C#. I use NCrunch to run my unit tests in the background. I have set in my CSPROJ files (new CSPROJ format).
I want to use FxCop Analyzers as NuGet packages: https://learn.microsoft.com/...
0
votes
0
answers
196
views
How to stop the publishing of FxCop libraries in .NET Core
A .NET Standard 2.1 library has a package reference to FxCop like so:
<PackageReference Include="Microsoft.CodeAnalysis.FxCopAnalyzers" Version="2.9.5">
<PrivateAssets>all</...
24
votes
5
answers
10k
views
Why is Microsoft.CodeAnalysis published with ASP.NET Core website?
I'm publishing an ASP.NET Core MVC 3.0 website and the output folder contains lots of reference in many language to Microsoft.CodeAnalysis librairies, someone knows why?
Of course the FxCopAnalyzers ...
4
votes
1
answer
182
views
CA2202 Warning for ForEach loop
The fxcop analysis gives the CA2202 warning for the following method body over the foreach line:
public void LogAnalysis(IEnumerable<string> steps, bool append = false)
{
if (steps != null)
...
2
votes
1
answer
600
views
How to find unused code over a group of projects?
In my solution, I would like to detect unused code in an automated way as part of the CI. More specifically, I want to analyze a group of projects (e.g. those under /src but not /test) and then decide ...
0
votes
2
answers
183
views
Query regarding Microsoft Security Code analysis extension and Fxcop Analyzer
I want to use Roslyn analyser in our Azure pipelines. And got to know from below link that roslyn analyzer comes along with a plugin called Microsoft Security Code analysis extension.
https://learn....
0
votes
1
answer
97
views
Review that the XML parsed here is from a trusted source, otherwise set settings.DtdProcessing to System.Xml.DtdProcessing.Prohibit or .Ignore
Rule:
Do not allow Dtd on XmlTextReader
Category:
Microsoft.Security.Xml
Check Id:
CA3054
Rule Description:
Prohibit DTD processing when using XmlTextReader on untrusted sources. Enabling DTD ...
3
votes
1
answer
783
views
What do I missed to apply for sonarqube custom rules using fxcop?
I want to apply for my own sonarqube custom rule using fxcop.
SonarScan succeeded with MSBuild, but sonarqube did not reflect the rule!
I referenced this url - https://github.com/DanielHWe/sonar-...
7
votes
3
answers
5k
views
FxCopAnalyzers: An instance of analyzer cannot be created
I'm trying to install fxcop analyzers in my project. However, having added and restored the nuget package, building the project results in hundreds of warnings of the form
1>CSC : warning CS8032: ...
9
votes
3
answers
8k
views
How do you disable Roslyn Analyzers when using msbuild through the command line?
The Roslyn Analyzers are installed as nuget packages, which are dependencies of the FxCop Analyzers (also installed as nuget packages).
I have enabled full solution analysis as instructed here: How ...
0
votes
1
answer
52
views
Jenkins FxCop errors should fail the build
I have a FxCop.project file which i call using a Jenkins job
"C:\Program Files (x86)\Microsoft Fxcop 10.0\FxCopCmd.exe" /project:"D:\Testing\Source\FxCop\BrokerApplication.FxCop" /out:"D:\Testing\...
1
vote
0
answers
34
views
Do I need Code Analysis in Visual Studios if I'm using FxCop?
I was going over the settings in my Visual Studio 2017 solution and I'm looking at the Code Analysis tab on my UWP projects. I'm already importing the Microsoft.CodeAnalysis.FxCopAnalyzers. Is the ...
14
votes
2
answers
14k
views
What Replaces Code Analysis in Visual Studio 2019?
I'm toying with getting our team and projects ready for VS 2019. Right away, trying to set up Code Analysis for a new project, I find this:
So, if this is deprecated (and apparently can't even be ...
17
votes
3
answers
23k
views
Why can't Microsoft analyzers find Microsoft.CodeAnalysis?
I'm trying to add Microsoft.CodeAnalysis.FXCopAnalyzers (latest stable version) to my ASP.NET project. When I install it via NuGet, I get a ton of errors like:
An instance of analyzer Microsoft....
3
votes
0
answers
450
views
How do I add a SuppressMessage for type GlobalSuppression?
In my GlobalSuppression.cs I often end up with long justifications. I want those to span multiple lines, but don't want to gloabally suppress SA1118. Ideally it would be something like this:
[...
0
votes
1
answer
136
views
Any idea why MSBuild would suddenly start performing code analysis on other projects in my solution?
I've been busy turning on code analysis for one of our solutions. On Friday everything was going well.
I had added the following to one of our csproj files:
<PropertyGroup Condition="'$(...
20
votes
1
answer
3k
views
Is CA2007 relevant to a .NET Core application?
When I run FxCop on my project, I get a large number of warnings with the ID of CA2007. This ID is missing from the docs (it just skips from CA2006 to CA2100), but the message I get is:
Do not ...
5
votes
0
answers
168
views
Is there a nice way to edit code analysis rulesets outside of Visual Studio
As a former Visual Studio user, I'm used to being able to edit my code analysis (e.g. for FxCop and StyleCop) in the IDE. The built in editor makes it really easy.
I'm now using VS Code and trying to ...
1
vote
0
answers
381
views
How to exclude auto generated files from getting analyzed from your custom code analysis rule?
I have written a custom code analysis rule using FxCop sdk api and integrated it into my test project. It is correctly analyzing the project code, however it also analyses auto generated files. i.e in ...
6
votes
1
answer
959
views
Compile-time only Nuget dependency (FxCop)
I am creating a .Net Standard 2.0 Nuget package and I want to perform static code analysis for the build. However, when I add the Microsoft.CodeAnalysis.FxCopAnalyzers package it becomes a runtime ...
0
votes
1
answer
498
views
Documentation for FxCop analysis in VSTS?
I have a VSTS build of a simple .net application and I am looking to incorporate some static code analysis in the pipeline.
Is there any documentation for using FxCop? I can see plenty of mentions of ...
0
votes
1
answer
74
views
Jenkins - How do I send an email on the FxCop reports with warnings and issues
I am investigating on a way to send an email with graphical representation of FxCop warnings/Issues right after a build is performed on any end states. Is there any plugin or way that I can achieve ...
1
vote
1
answer
181
views
sonar msbuild run from Jenkins: sonar.cs.fxcop.assembly must be set
I have gone through the previous questions on the subject but whatever answer was given does not seem to work for me
My setup is
- Microsoft Visual Studio Community 2017 installed
- SonarQube ...
0
votes
1
answer
110
views
TFS Build 2013 avoid code analysis
How can I avoid code analysis running on TFS Builds at a solution level?
I understand I can do this at a project level, but there are over 200 projects in my C# solution and I'd like to switch off ...
1
vote
1
answer
45
views
Correct usage of Using for disposable types
I have this code
using(MyStopWatch st= new MyStopWatch())
{
St.start();
St.stop();
}
Which gives me CA1001 error when I run fxcop
And
MyStopWatch st= null;
using( st= new MyStopWatch())
{
St....
2
votes
1
answer
584
views
Add custom rule to code analyser for core 2.0
I am new to code analyser using nuget package.
I have installed Microsoft.CodeAnalysis.FxCopAnalyzers in my code and now i want to add some custom rules.
Please share some example
Thanks,
Shraddha ...
4
votes
0
answers
489
views
How to write output from Roslyn FxCopAnalyzers to disk using MSBuild?
I have a .NET Core 2.0 project for which I would like to perform code analysis from the command line and write the output to disk. Per the discussion here, I have referenced the Microsoft....
0
votes
2
answers
2k
views
CA2000: Dispose object warning
I have the following method:
public byte[] HtmlToDoc(string hmtl, string userId)
{
byte[] data;
var auditor = new ServiceAuditor
{
User = userId
};
...
1
vote
0
answers
16
views
Fxcop referrer existing rule in a custom rule project
I'm writing a custom fxcop rule to exclude some words from "Identifiers Should Be Cased Correctly" rule. What I want to do is, there are some words that I used in my project which are some notations I ...