Skip to content

Commit d512b50

Browse files
dotpauldotpaul
authored
Merge pull request #3854 from dotpaul/datasetdatatable3
Initial rules for DataSet / DataTable deserializations
2 parents bf6e76a + 7993ad1 commit d512b50

File tree

60 files changed

+5108
-260
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+5108
-260
lines changed

‎src/Microsoft.CodeAnalysis.FxCopAnalyzers/Microsoft.CodeAnalysis.FxCopAnalyzers.md

+75-68
Large diffs are not rendered by default.

‎src/Microsoft.CodeAnalysis.FxCopAnalyzers/Microsoft.CodeAnalysis.FxCopAnalyzers.sarif

+151-18
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
{
66
"tool": {
77
"name": "Microsoft.CodeAnalysis.VersionCheckAnalyzer",
8-
"version": "2.9.9",
8+
"version": "2.9.10",
99
"language": "en-US"
1010
},
1111
"rules": {
@@ -29,7 +29,7 @@
2929
{
3030
"tool": {
3131
"name": "Microsoft.CodeQuality.Analyzers",
32-
"version": "2.9.9",
32+
"version": "2.9.10",
3333
"language": "en-US"
3434
},
3535
"rules": {
@@ -76,8 +76,8 @@
7676
},
7777
"CA1010": {
7878
"id": "CA1010",
79-
"shortDescription": "Collections should implement generic interface",
80-
"fullDescription": "To broaden the usability of a collection, implement one of the generic collection interfaces. Then the collection can be used to populate generic collection types.",
79+
"shortDescription": "Generic interface should also be implemented",
80+
"fullDescription": "To broaden the usability of a type, implement one of the generic interfaces. This is especially true for collections as they can then be used to populate generic collection types.",
8181
"defaultLevel": "warning",
8282
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca1010",
8383
"properties": {
@@ -1234,7 +1234,7 @@
12341234
"CA1822": {
12351235
"id": "CA1822",
12361236
"shortDescription": "Mark members as static",
1237-
"fullDescription": "Members that do not access instance data or call instance methods can be marked as static (Shared in Visual Basic). After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code.",
1237+
"fullDescription": "Members that do not access instance data or call instance methods can be marked as static. After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code.",
12381238
"defaultLevel": "warning",
12391239
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca1822",
12401240
"properties": {
@@ -1530,7 +1530,7 @@
15301530
{
15311531
"tool": {
15321532
"name": "Microsoft.CodeQuality.CSharp.Analyzers",
1533-
"version": "2.9.9",
1533+
"version": "2.9.10",
15341534
"language": "en-US"
15351535
},
15361536
"rules": {
@@ -1727,7 +1727,7 @@
17271727
{
17281728
"tool": {
17291729
"name": "Microsoft.CodeQuality.VisualBasic.Analyzers",
1730-
"version": "2.9.9",
1730+
"version": "2.9.10",
17311731
"language": "en-US"
17321732
},
17331733
"rules": {
@@ -1962,7 +1962,7 @@
19621962
{
19631963
"tool": {
19641964
"name": "Microsoft.NetCore.Analyzers",
1965-
"version": "2.9.9",
1965+
"version": "2.9.10",
19661966
"language": "en-US"
19671967
},
19681968
"rules": {
@@ -2819,6 +2819,139 @@
28192819
]
28202820
}
28212821
},
2822+
"CA2350": {
2823+
"id": "CA2350",
2824+
"shortDescription": "Do not use insecure deserialization with DataTable.ReadXml()",
2825+
"fullDescription": "The method '{0}' is insecure when deserializing untrusted data. If deserializing untrusted data, replace with TBD.",
2826+
"defaultLevel": "warning",
2827+
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2350",
2828+
"properties": {
2829+
"category": "Security",
2830+
"isEnabledByDefault": false,
2831+
"typeName": "DoNotUseDataTableReadXml",
2832+
"languages": [
2833+
"C#",
2834+
"Visual Basic"
2835+
],
2836+
"tags": [
2837+
"Telemetry"
2838+
]
2839+
}
2840+
},
2841+
"CA2351": {
2842+
"id": "CA2351",
2843+
"shortDescription": "Do not use insecure deserialization with DataSet.ReadXml()",
2844+
"fullDescription": "The method '{0}' is insecure when deserializing untrusted data. If deserializing untrusted data, replace with TBD.",
2845+
"defaultLevel": "warning",
2846+
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2351",
2847+
"properties": {
2848+
"category": "Security",
2849+
"isEnabledByDefault": false,
2850+
"typeName": "DoNotUseDataSetReadXml",
2851+
"languages": [
2852+
"C#",
2853+
"Visual Basic"
2854+
],
2855+
"tags": [
2856+
"Telemetry"
2857+
]
2858+
}
2859+
},
2860+
"CA2352": {
2861+
"id": "CA2352",
2862+
"shortDescription": "Unsafe DataSet or DataTable in serializable type can be vulnerable to remote code execution attacks",
2863+
"fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
2864+
"defaultLevel": "warning",
2865+
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2352",
2866+
"properties": {
2867+
"category": "Security",
2868+
"isEnabledByDefault": false,
2869+
"typeName": "DataSetDataTableInSerializableTypeAnalyzer",
2870+
"languages": [
2871+
"C#",
2872+
"Visual Basic"
2873+
],
2874+
"tags": [
2875+
"Telemetry"
2876+
]
2877+
}
2878+
},
2879+
"CA2353": {
2880+
"id": "CA2353",
2881+
"shortDescription": "Unsafe DataSet or DataTable in serializable type",
2882+
"fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
2883+
"defaultLevel": "warning",
2884+
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2353",
2885+
"properties": {
2886+
"category": "Security",
2887+
"isEnabledByDefault": false,
2888+
"typeName": "DataSetDataTableInSerializableTypeAnalyzer",
2889+
"languages": [
2890+
"C#",
2891+
"Visual Basic"
2892+
],
2893+
"tags": [
2894+
"Telemetry"
2895+
]
2896+
}
2897+
},
2898+
"CA2354": {
2899+
"id": "CA2354",
2900+
"shortDescription": "Unsafe DataSet or DataTable in deserialized object graph can be vulnerable to remote code execution attacks",
2901+
"fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
2902+
"defaultLevel": "warning",
2903+
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2354",
2904+
"properties": {
2905+
"category": "Security",
2906+
"isEnabledByDefault": false,
2907+
"typeName": "DataSetDataTableInIFormatterSerializableObjectGraphAnalyzer",
2908+
"languages": [
2909+
"C#",
2910+
"Visual Basic"
2911+
],
2912+
"tags": [
2913+
"Telemetry"
2914+
]
2915+
}
2916+
},
2917+
"CA2355": {
2918+
"id": "CA2355",
2919+
"shortDescription": "Unsafe DataSet or DataTable type found in deserializable object graph",
2920+
"fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
2921+
"defaultLevel": "warning",
2922+
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2355",
2923+
"properties": {
2924+
"category": "Security",
2925+
"isEnabledByDefault": false,
2926+
"typeName": "DataSetDataTableInSerializableObjectGraphAnalyzer",
2927+
"languages": [
2928+
"C#",
2929+
"Visual Basic"
2930+
],
2931+
"tags": [
2932+
"Telemetry"
2933+
]
2934+
}
2935+
},
2936+
"CA2356": {
2937+
"id": "CA2356",
2938+
"shortDescription": "Unsafe DataSet or DataTable type in web deserializable object graph",
2939+
"fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
2940+
"defaultLevel": "warning",
2941+
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2356",
2942+
"properties": {
2943+
"category": "Security",
2944+
"isEnabledByDefault": false,
2945+
"typeName": "DataSetDataTableInWebSerializableObjectGraphAnalyzer",
2946+
"languages": [
2947+
"C#",
2948+
"Visual Basic"
2949+
],
2950+
"tags": [
2951+
"Telemetry"
2952+
]
2953+
}
2954+
},
28222955
"CA3001": {
28232956
"id": "CA3001",
28242957
"shortDescription": "Review code for SQL injection vulnerabilities",
@@ -3118,8 +3251,8 @@
31183251
},
31193252
"CA5358": {
31203253
"id": "CA5358",
3121-
"shortDescription": "Do Not Use Unsafe Cipher Modes",
3122-
"fullDescription": "These modes are vulnerable to attacks. Use only approved modes (CBC, CTS).",
3254+
"shortDescription": "Review cipher mode usage with cryptography experts",
3255+
"fullDescription": "These cipher modes might be vulnerable to attacks. Consider using recommended modes (CBC, CTS).",
31233256
"defaultLevel": "warning",
31243257
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca5358",
31253258
"properties": {
@@ -3195,14 +3328,14 @@
31953328
},
31963329
"CA5362": {
31973330
"id": "CA5362",
3198-
"shortDescription": "Do Not Refer Self In Serializable Class",
3199-
"fullDescription": "This can allow an attacker to DOS or exhaust the memory of the process.",
3331+
"shortDescription": "Potential reference cycle in deserialized object graph",
3332+
"fullDescription": "Review code that processes untrusted deserialized data for handling of unexpected reference cycles. An unexpected reference cycle should not cause the code to enter an infinite loop. Otherwise, an unexpected reference cycle can allow an attacker to DOS or exhaust the memory of the process when deserializing untrusted data.",
32003333
"defaultLevel": "warning",
32013334
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca5362",
32023335
"properties": {
32033336
"category": "Security",
32043337
"isEnabledByDefault": false,
3205-
"typeName": "DoNotReferSelfInSerializableClass",
3338+
"typeName": "PotentialReferenceCycleInDeserializedObjectGraph",
32063339
"languages": [
32073340
"C#",
32083341
"Visual Basic"
@@ -4013,7 +4146,7 @@
40134146
{
40144147
"tool": {
40154148
"name": "Microsoft.NetCore.CSharp.Analyzers",
4016-
"version": "2.9.9",
4149+
"version": "2.9.10",
40174150
"language": "en-US"
40184151
},
40194152
"rules": {
@@ -4152,7 +4285,7 @@
41524285
{
41534286
"tool": {
41544287
"name": "Microsoft.NetCore.VisualBasic.Analyzers",
4155-
"version": "2.9.9",
4288+
"version": "2.9.10",
41564289
"language": "en-US"
41574290
},
41584291
"rules": {
@@ -4291,7 +4424,7 @@
42914424
{
42924425
"tool": {
42934426
"name": "Microsoft.NetFramework.Analyzers",
4294-
"version": "2.9.9",
4427+
"version": "2.9.10",
42954428
"language": "en-US"
42964429
},
42974430
"rules": {
@@ -4377,7 +4510,7 @@
43774510
{
43784511
"tool": {
43794512
"name": "Microsoft.NetFramework.CSharp.Analyzers",
4380-
"version": "2.9.9",
4513+
"version": "2.9.10",
43814514
"language": "en-US"
43824515
},
43834516
"rules": {
@@ -4422,7 +4555,7 @@
44224555
{
44234556
"tool": {
44244557
"name": "Microsoft.NetFramework.VisualBasic.Analyzers",
4425-
"version": "2.9.9",
4558+
"version": "2.9.10",
44264559
"language": "en-US"
44274560
},
44284561
"rules": {

‎src/Microsoft.CodeAnalysis.VersionCheckAnalyzer/Microsoft.CodeAnalysis.VersionCheckAnalyzer.sarif

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
{
66
"tool": {
77
"name": "Microsoft.CodeAnalysis.VersionCheckAnalyzer",
8-
"version": "2.9.9",
8+
"version": "2.9.10",
99
"language": "en-US"
1010
},
1111
"rules": {

‎src/Microsoft.CodeQuality.Analyzers/Microsoft.CodeQuality.Analyzers.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Sr. No. | Rule ID | Title | Category | Enabled | Severity | CodeFix | Descriptio
55
2 | [CA1001](https://docs.microsoft.com/visualstudio/code-quality/ca1001) | Types that own disposable fields should be disposable | Design | True | Warning | True | A class declares and implements an instance field that is a System.IDisposable type, and the class does not implement IDisposable. A class that declares an IDisposable field indirectly owns an unmanaged resource and should implement the IDisposable interface. |
66
3 | [CA1003](https://docs.microsoft.com/visualstudio/code-quality/ca1003) | Use generic event handler instances | Design | False | Warning | False | A type contains an event that declares an EventHandler delegate that returns void, whose signature contains two parameters (the first an object and the second a type that is assignable to EventArgs), and the containing assembly targets Microsoft .NET Framework?2.0. |
77
4 | [CA1008](https://docs.microsoft.com/visualstudio/code-quality/ca1008) | Enums should have zero value | Design | False | Warning | True | The default value of an uninitialized enumeration, just as other value types, is zero. A nonflags-attributed enumeration should define a member by using the value of zero so that the default value is a valid value of the enumeration. If an enumeration that has the FlagsAttribute attribute applied defines a zero-valued member, its name should be ""None"" to indicate that no values have been set in the enumeration. |
8-
5 | [CA1010](https://docs.microsoft.com/visualstudio/code-quality/ca1010) | Collections should implement generic interface | Design | True | Warning | False | To broaden the usability of a collection, implement one of the generic collection interfaces. Then the collection can be used to populate generic collection types. |
8+
5 | [CA1010](https://docs.microsoft.com/visualstudio/code-quality/ca1010) | Generic interface should also be implemented | Design | True | Warning | False | To broaden the usability of a type, implement one of the generic interfaces. This is especially true for collections as they can then be used to populate generic collection types. |
99
6 | [CA1012](https://docs.microsoft.com/visualstudio/code-quality/ca1012) | Abstract types should not have constructors | Design | False | Warning | True | Constructors on abstract types can be called only by derived types. Because public constructors create instances of a type, and you cannot create instances of an abstract type, an abstract type that has a public constructor is incorrectly designed. |
1010
7 | [CA1014](https://docs.microsoft.com/visualstudio/code-quality/ca1014) | Mark assemblies with CLSCompliant | Design | False | Warning | False | The Common Language Specification (CLS) defines naming restrictions, data types, and rules to which assemblies must conform if they will be used across programming languages. Good design dictates that all assemblies explicitly indicate CLS compliance by using CLSCompliantAttribute . If this attribute is not present on an assembly, the assembly is not compliant. |
1111
8 | [CA1016](https://docs.microsoft.com/visualstudio/code-quality/ca1016) | Mark assemblies with assembly version | Design | True | Warning | False | The .NET Framework uses the version number to uniquely identify an assembly, and to bind to types in strongly named assemblies. The version number is used together with version and publisher policy. By default, applications run only with the assembly version with which they were built. |
@@ -69,7 +69,7 @@ Sr. No. | Rule ID | Title | Category | Enabled | Severity | CodeFix | Descriptio
6969
66 | [CA1815](https://docs.microsoft.com/visualstudio/code-quality/ca1815) | Override equals and operator equals on value types | Performance | True | Warning | True | For value types, the inherited implementation of Equals uses the Reflection library and compares the contents of all fields. Reflection is computationally expensive, and comparing every field for equality might be unnecessary. If you expect users to compare or sort instances, or to use instances as hash table keys, your value type should implement Equals. |
7070
67 | [CA1819](https://docs.microsoft.com/visualstudio/code-quality/ca1819) | Properties should not return arrays | Performance | True | Warning | False | Arrays that are returned by properties are not write-protected, even when the property is read-only. To keep the array tamper-proof, the property must return a copy of the array. Typically, users will not understand the adverse performance implications of calling such a property. |
7171
68 | [CA1821](https://docs.microsoft.com/visualstudio/code-quality/ca1821) | Remove empty Finalizers | Performance | True | Warning | True | Finalizers should be avoided where possible, to avoid the additional performance overhead involved in tracking object lifetime. |
72-
69 | [CA1822](https://docs.microsoft.com/visualstudio/code-quality/ca1822) | Mark members as static | Performance | True | Warning | True | Members that do not access instance data or call instance methods can be marked as static (Shared in Visual Basic). After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code. |
72+
69 | [CA1822](https://docs.microsoft.com/visualstudio/code-quality/ca1822) | Mark members as static | Performance | True | Warning | True | Members that do not access instance data or call instance methods can be marked as static. After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code. |
7373
70 | [CA1823](https://docs.microsoft.com/visualstudio/code-quality/ca1823) | Avoid unused private fields | Performance | True | Warning | True | Private fields were detected that do not appear to be accessed in the assembly. |
7474
71 | [CA2007](https://docs.microsoft.com/visualstudio/code-quality/ca2007) | Consider calling ConfigureAwait on the awaited task | Reliability | True | Warning | True | When an asynchronous method awaits a Task directly, continuation occurs in the same thread that created the task. Consider calling Task.ConfigureAwait(Boolean) to signal your intention for continuation. Call ConfigureAwait(false) on the task to schedule continuations to the thread pool, thereby avoiding a deadlock on the UI thread. Passing false is a good option for app-independent libraries. Calling ConfigureAwait(true) on the task has the same behavior as not explicitly calling ConfigureAwait. By explicitly calling this method, you're letting readers know you intentionally want to perform the continuation on the original synchronization context. |
7575
72 | [CA2119](https://docs.microsoft.com/visualstudio/code-quality/ca2119) | Seal methods that satisfy private interfaces | Security | True | Warning | True | An inheritable public type provides an overridable method implementation of an internal (Friend in Visual Basic) interface. To fix a violation of this rule, prevent the method from being overridden outside the assembly. |

0 commit comments

Comments
 (0)