diff --git a/NuGet.exe b/NuGet.exe new file mode 100644 index 00000000..7d4cdaef Binary files /dev/null and b/NuGet.exe differ diff --git a/README.md b/README.md index 8e2a18f0..173c9483 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ [![Build status](https://ci.appveyor.com/api/projects/status/se4ok0surqu73ob7?svg=true)](https://ci.appveyor.com/project/JarLob/security-code-scan) ### Downloading -Official releases are available as nuget packages ([Master](https://www.nuget.org/packages/SecurityCodeScan/) and [VS2017](https://www.nuget.org/packages/SecurityCodeScan.VS2017/) branches) and as Visual Studio extensions ([Master](https://marketplace.visualstudio.com/items?itemName=JaroslavLobacevski.SecurityCodeScan) and [VS2017](https://marketplace.visualstudio.com/items?itemName=JaroslavLobacevski.SecurityCodeScanVS2017) branches). +Official releases are available as nuget packages ([VS2015](https://www.nuget.org/packages/SecurityCodeScan/) and [VS2017](https://www.nuget.org/packages/SecurityCodeScan.VS2017/) branches) and as Visual Studio extensions ([VS2015](https://marketplace.visualstudio.com/items?itemName=JaroslavLobacevski.SecurityCodeScan) and [VS2017](https://marketplace.visualstudio.com/items?itemName=JaroslavLobacevski.SecurityCodeScanVS2017) branches). Nightly builds are available from [appveyor](https://ci.appveyor.com/project/JarLob/security-code-scan) (go to `Configuration: Release` -> `Artifacts`). ### Building @@ -19,7 +19,7 @@ msbuild SecurityCodeScan.sln ``` ### Contributing -* All documentation from the [official site](https://security-code-scan.github.io) is open-source and located in the [website](https://github.com/security-code-scan/security-code-scan/tree/master/website) folder. Feel free to modify the markdown files and contribute to it. +* All documentation from the [official site](https://security-code-scan.github.io) is open-source and located in the [website](https://github.com/security-code-scan/security-code-scan/tree/vs2019/website) folder. Feel free to modify the markdown files and contribute to it. * You may customize the behavior of Security Code Scan by creating a local configuration file as described in [ExternalConfigurationFiles section](https://security-code-scan.github.io/#ExternalConfigurationFiles). It is easy to add new vulnerable functions (sinks) that should trigger a warning, define untrusted sources, etc. Once you think you have working configuration file you are welcome to contribute your changes to the main built-in configuration file. Ideally your Pull Request comes with tests that cover the changes. * Review the list of available [issues.](https://github.com/security-code-scan/security-code-scan/issues) The general understanding of Roslyn might be handy: - [Use Roslyn to Write a Live Code Analyzer for Your API](https://docs.microsoft.com/en-us/archive/msdn-magazine/2014/special-issue/csharp-and-visual-basic-use-roslyn-to-write-a-live-code-analyzer-for-your-api) diff --git a/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj b/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj index e9c7810a..db5792bf 100644 --- a/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj +++ b/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj @@ -1,8 +1,6 @@  - - - + Debug @@ -61,6 +59,9 @@ ..\packages\EntityFramework.6.2.0\lib\net45\EntityFramework.SqlServer.dll + + ..\packages\ManagedEsent.1.9.4\lib\net40\Esent.Interop.dll + ..\packages\fastJSON.2.1.21\lib\net40\fastjson.dll @@ -76,14 +77,15 @@ ..\packages\Microsoft.AspNet.Identity.Core.2.2.1\lib\net45\Microsoft.AspNet.Identity.Core.dll - - ..\packages\Microsoft.AspNetCore.Antiforgery.1.1.3\lib\net451\Microsoft.AspNetCore.Antiforgery.dll + + ..\packages\Microsoft.AspNetCore.Antiforgery.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Antiforgery.dll ..\packages\Microsoft.AspNetCore.Authentication.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Authentication.Abstractions.dll ..\packages\Microsoft.AspNetCore.Authentication.Core.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Authentication.Core.dll + True ..\packages\Microsoft.AspNetCore.Authorization.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Authorization.dll @@ -91,17 +93,17 @@ ..\packages\Microsoft.AspNetCore.Authorization.Policy.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Authorization.Policy.dll - - ..\packages\Microsoft.AspNetCore.Cryptography.Internal.1.1.3\lib\net451\Microsoft.AspNetCore.Cryptography.Internal.dll + + ..\packages\Microsoft.AspNetCore.Cryptography.Internal.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Cryptography.Internal.dll - - ..\packages\Microsoft.AspNetCore.DataProtection.1.1.3\lib\net451\Microsoft.AspNetCore.DataProtection.dll + + ..\packages\Microsoft.AspNetCore.DataProtection.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.DataProtection.dll - - ..\packages\Microsoft.AspNetCore.DataProtection.Abstractions.1.1.3\lib\net451\Microsoft.AspNetCore.DataProtection.Abstractions.dll + + ..\packages\Microsoft.AspNetCore.DataProtection.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.DataProtection.Abstractions.dll - - ..\packages\Microsoft.AspNetCore.Diagnostics.Abstractions.1.1.6\lib\netstandard1.0\Microsoft.AspNetCore.Diagnostics.Abstractions.dll + + ..\packages\Microsoft.AspNetCore.Diagnostics.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Diagnostics.Abstractions.dll ..\packages\Microsoft.AspNetCore.Hosting.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Hosting.Abstractions.dll @@ -109,11 +111,12 @@ ..\packages\Microsoft.AspNetCore.Hosting.Server.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Hosting.Server.Abstractions.dll - - ..\packages\Microsoft.AspNetCore.Html.Abstractions.1.1.2\lib\netstandard1.0\Microsoft.AspNetCore.Html.Abstractions.dll + + ..\packages\Microsoft.AspNetCore.Html.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Html.Abstractions.dll ..\packages\Microsoft.AspNetCore.Http.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Http.dll + True ..\packages\Microsoft.AspNetCore.Http.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Http.Abstractions.dll @@ -124,35 +127,40 @@ ..\packages\Microsoft.AspNetCore.Http.Features.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Http.Features.dll - - ..\packages\Microsoft.AspNetCore.JsonPatch.1.1.2\lib\net451\Microsoft.AspNetCore.JsonPatch.dll + + ..\packages\Microsoft.AspNetCore.JsonPatch.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.JsonPatch.dll ..\packages\Microsoft.AspNetCore.Mvc.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Mvc.Abstractions.dll + True ..\packages\Microsoft.AspNetCore.Mvc.Core.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Mvc.Core.dll + True - - ..\packages\Microsoft.AspNetCore.Mvc.DataAnnotations.1.1.8\lib\net451\Microsoft.AspNetCore.Mvc.DataAnnotations.dll + + ..\packages\Microsoft.AspNetCore.Mvc.DataAnnotations.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Mvc.DataAnnotations.dll - - ..\packages\Microsoft.AspNetCore.Mvc.Formatters.Json.1.1.8\lib\net451\Microsoft.AspNetCore.Mvc.Formatters.Json.dll + + ..\packages\Microsoft.AspNetCore.Mvc.Formatters.Json.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Mvc.Formatters.Json.dll - - ..\packages\Microsoft.AspNetCore.Mvc.ViewFeatures.1.1.8\lib\net451\Microsoft.AspNetCore.Mvc.ViewFeatures.dll + + ..\packages\Microsoft.AspNetCore.Mvc.ViewFeatures.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Mvc.ViewFeatures.dll ..\packages\Microsoft.AspNetCore.ResponseCaching.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.ResponseCaching.Abstractions.dll ..\packages\Microsoft.AspNetCore.Routing.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Routing.dll + True ..\packages\Microsoft.AspNetCore.Routing.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.Routing.Abstractions.dll + True ..\packages\Microsoft.AspNetCore.WebUtilities.2.1.0\lib\netstandard2.0\Microsoft.AspNetCore.WebUtilities.dll + True ..\packages\Microsoft.Bcl.AsyncInterfaces.1.1.1\lib\net461\Microsoft.Bcl.AsyncInterfaces.dll @@ -160,26 +168,26 @@ ..\packages\Microsoft.Bcl.HashCode.1.1.0\lib\net461\Microsoft.Bcl.HashCode.dll - - ..\packages\Microsoft.CodeAnalysis.Common.1.3.2\lib\net45\Microsoft.CodeAnalysis.dll + + ..\packages\Microsoft.CodeAnalysis.Common.2.10.0\lib\netstandard1.3\Microsoft.CodeAnalysis.dll - - ..\packages\Microsoft.CodeAnalysis.CSharp.1.3.2\lib\net45\Microsoft.CodeAnalysis.CSharp.dll + + ..\packages\Microsoft.CodeAnalysis.CSharp.2.10.0\lib\netstandard1.3\Microsoft.CodeAnalysis.CSharp.dll - - ..\packages\Microsoft.CodeAnalysis.CSharp.Workspaces.1.3.2\lib\net45\Microsoft.CodeAnalysis.CSharp.Workspaces.dll + + ..\packages\Microsoft.CodeAnalysis.CSharp.Workspaces.2.10.0\lib\netstandard1.3\Microsoft.CodeAnalysis.CSharp.Workspaces.dll - - ..\packages\Microsoft.CodeAnalysis.VisualBasic.1.3.2\lib\net45\Microsoft.CodeAnalysis.VisualBasic.dll + + ..\packages\Microsoft.CodeAnalysis.VisualBasic.2.10.0\lib\netstandard1.3\Microsoft.CodeAnalysis.VisualBasic.dll - - ..\packages\Microsoft.CodeAnalysis.VisualBasic.Workspaces.1.3.2\lib\net45\Microsoft.CodeAnalysis.VisualBasic.Workspaces.dll + + ..\packages\Microsoft.CodeAnalysis.VisualBasic.Workspaces.2.10.0\lib\netstandard1.3\Microsoft.CodeAnalysis.VisualBasic.Workspaces.dll - - ..\packages\Microsoft.CodeAnalysis.Workspaces.Common.1.3.2\lib\net45\Microsoft.CodeAnalysis.Workspaces.dll + + ..\packages\Microsoft.CodeAnalysis.Workspaces.Common.2.10.0\lib\net46\Microsoft.CodeAnalysis.Workspaces.dll - - ..\packages\Microsoft.CodeAnalysis.Workspaces.Common.1.3.2\lib\net45\Microsoft.CodeAnalysis.Workspaces.Desktop.dll + + ..\packages\Microsoft.CodeAnalysis.Workspaces.Common.2.10.0\lib\net46\Microsoft.CodeAnalysis.Workspaces.Desktop.dll ..\packages\Microsoft.Data.Sqlite.1.1.1\lib\net451\Microsoft.Data.Sqlite.dll @@ -226,11 +234,11 @@ ..\packages\Microsoft.Extensions.Hosting.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.Extensions.Hosting.Abstractions.dll - - ..\packages\Microsoft.Extensions.Localization.1.1.3\lib\net451\Microsoft.Extensions.Localization.dll + + ..\packages\Microsoft.Extensions.Localization.2.1.0\lib\netstandard2.0\Microsoft.Extensions.Localization.dll - - ..\packages\Microsoft.Extensions.Localization.Abstractions.1.1.3\lib\netstandard1.0\Microsoft.Extensions.Localization.Abstractions.dll + + ..\packages\Microsoft.Extensions.Localization.Abstractions.2.1.0\lib\netstandard2.0\Microsoft.Extensions.Localization.Abstractions.dll ..\packages\Microsoft.Extensions.Logging.3.1.4\lib\netstandard2.0\Microsoft.Extensions.Logging.dll @@ -250,8 +258,8 @@ ..\packages\Microsoft.Extensions.Primitives.3.1.4\lib\netstandard2.0\Microsoft.Extensions.Primitives.dll - - ..\packages\Microsoft.Extensions.WebEncoders.1.1.2\lib\netstandard1.0\Microsoft.Extensions.WebEncoders.dll + + ..\packages\Microsoft.Extensions.WebEncoders.2.1.0\lib\netstandard2.0\Microsoft.Extensions.WebEncoders.dll ..\packages\Microsoft.Net.Http.Headers.2.1.0\lib\netstandard2.0\Microsoft.Net.Http.Headers.dll @@ -262,14 +270,11 @@ ..\packages\EnterpriseLibrary.Data.6.0.1304.0\lib\NET45\Microsoft.Practices.EnterpriseLibrary.Data.dll - - ..\packages\Microsoft.CodeCoverage.16.6.1\lib\net45\Microsoft.VisualStudio.CodeCoverage.Shim.dll - - ..\packages\MSTest.TestFramework.2.1.1\lib\net45\Microsoft.VisualStudio.TestPlatform.TestFramework.dll + ..\packages\MSTest.TestFramework.2.1.0\lib\net45\Microsoft.VisualStudio.TestPlatform.TestFramework.dll - ..\packages\MSTest.TestFramework.2.1.1\lib\net45\Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll + ..\packages\MSTest.TestFramework.2.1.0\lib\net45\Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll ..\packages\Microsoft.Web.Infrastructure.1.0.0.0\lib\net40\Microsoft.Web.Infrastructure.dll @@ -278,12 +283,23 @@ ..\packages\Microsoft.Web.Xdt.2.1.2\lib\net40\Microsoft.Web.XmlTransform.dll + + ..\packages\Microsoft.Win32.Primitives.4.3.0\lib\net46\Microsoft.Win32.Primitives.dll + True + True + + + ..\packages\Microsoft.Win32.Registry.4.5.0\lib\net461\Microsoft.Win32.Registry.dll + ..\packages\Moq.4.5.16\lib\net45\Moq.dll True - - ..\packages\Newtonsoft.Json.9.0.1\lib\net45\Newtonsoft.Json.dll + + ..\packages\Newtonsoft.Json.11.0.2\lib\net45\Newtonsoft.Json.dll + + + ..\packages\Newtonsoft.Json.Bson.1.0.1\lib\net45\Newtonsoft.Json.Bson.dll ..\packages\NHibernate.4.1.2.4000\lib\net40\NHibernate.dll @@ -297,8 +313,23 @@ ..\packages\ServiceStack.Text.5.0.2\lib\net45\ServiceStack.Text.dll + + ..\packages\SQLitePCLRaw.bundle_green.1.1.2\lib\net45\SQLitePCLRaw.batteries_green.dll + + + ..\packages\SQLitePCLRaw.bundle_green.1.1.2\lib\net45\SQLitePCLRaw.batteries_v2.dll + + + ..\packages\SQLitePCLRaw.core.1.1.2\lib\net45\SQLitePCLRaw.core.dll + + + ..\packages\SQLitePCLRaw.provider.e_sqlite3.net45.1.1.2\lib\net45\SQLitePCLRaw.provider.e_sqlite3.dll + + + ..\packages\System.AppContext.4.3.0\lib\net46\System.AppContext.dll + ..\packages\System.Buffers.4.5.1\lib\net461\System.Buffers.dll @@ -310,40 +341,63 @@ - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.AttributedModel.dll - True + + ..\packages\System.Composition.AttributedModel.1.0.31\lib\portable-net45+win8+wp8+wpa81\System.Composition.AttributedModel.dll - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.Convention.dll - True + + ..\packages\System.Composition.Convention.1.0.31\lib\portable-net45+win8+wp8+wpa81\System.Composition.Convention.dll - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.Hosting.dll - True + + ..\packages\System.Composition.Hosting.1.0.31\lib\portable-net45+win8+wp8+wpa81\System.Composition.Hosting.dll - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.Runtime.dll - True + + ..\packages\System.Composition.Runtime.1.0.31\lib\portable-net45+win8+wp8+wpa81\System.Composition.Runtime.dll - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.TypedParts.dll - True + + ..\packages\System.Composition.TypedParts.1.0.31\lib\portable-net45+win8+wp8+wpa81\System.Composition.TypedParts.dll + + + ..\packages\System.Console.4.3.0\lib\net46\System.Console.dll - + - ..\packages\System.Data.SQLite.Core.1.0.109.2\lib\net451\System.Data.SQLite.dll + ..\packages\System.Data.SQLite.Core.1.0.109.2\lib\net46\System.Data.SQLite.dll ..\packages\System.Diagnostics.DiagnosticSource.4.7.1\lib\net46\System.Diagnostics.DiagnosticSource.dll + + ..\packages\System.Diagnostics.FileVersionInfo.4.3.0\lib\net46\System.Diagnostics.FileVersionInfo.dll + + + ..\packages\System.Diagnostics.StackTrace.4.3.0\lib\net46\System.Diagnostics.StackTrace.dll + + + + ..\packages\System.Globalization.Calendars.4.3.0\lib\net46\System.Globalization.Calendars.dll + True + True + ..\packages\System.Interactive.Async.3.0.0\lib\net45\System.Interactive.Async.dll + + + ..\packages\System.IO.Compression.ZipFile.4.3.0\lib\net46\System.IO.Compression.ZipFile.dll + True + True + + + ..\packages\System.IO.FileSystem.4.3.0\lib\net46\System.IO.FileSystem.dll + True + + + ..\packages\System.IO.FileSystem.Primitives.4.3.0\lib\net46\System.IO.FileSystem.Primitives.dll + ..\packages\System.Memory.4.5.4\lib\net461\System.Memory.dll @@ -351,37 +405,72 @@ + + ..\packages\System.Net.Sockets.4.3.0\lib\net46\System.Net.Sockets.dll + True + True + ..\packages\System.Numerics.Vectors.4.5.0\lib\net46\System.Numerics.Vectors.dll - - ..\packages\System.Reflection.Metadata.1.3.0\lib\portable-net45+win8\System.Reflection.Metadata.dll + + ..\packages\System.Reflection.Metadata.1.6.0\lib\netstandard2.0\System.Reflection.Metadata.dll ..\packages\System.Runtime.CompilerServices.Unsafe.4.7.1\lib\net461\System.Runtime.CompilerServices.Unsafe.dll - + ..\packages\System.Runtime.InteropServices.RuntimeInformation.4.3.0\lib\net45\System.Runtime.InteropServices.RuntimeInformation.dll + + ..\packages\System.Security.AccessControl.4.5.0\lib\net461\System.Security.AccessControl.dll + + + ..\packages\System.Security.Cryptography.Algorithms.4.3.0\lib\net46\System.Security.Cryptography.Algorithms.dll + + + ..\packages\System.Security.Cryptography.Encoding.4.3.0\lib\net46\System.Security.Cryptography.Encoding.dll + + + ..\packages\System.Security.Cryptography.Primitives.4.3.0\lib\net46\System.Security.Cryptography.Primitives.dll + + + ..\packages\System.Security.Cryptography.X509Certificates.4.3.0\lib\net46\System.Security.Cryptography.X509Certificates.dll + + + ..\packages\System.Security.Cryptography.Xml.4.5.0\lib\net461\System.Security.Cryptography.Xml.dll + + + ..\packages\System.Security.Permissions.4.5.0\lib\net461\System.Security.Permissions.dll + + + ..\packages\System.Security.Principal.Windows.4.5.0\lib\net461\System.Security.Principal.Windows.dll + + + + ..\packages\System.Text.Encoding.CodePages.4.3.0\lib\net46\System.Text.Encoding.CodePages.dll + - ..\packages\System.Text.Encodings.Web.4.5.0\lib\netstandard1.0\System.Text.Encodings.Web.dll + ..\packages\System.Text.Encodings.Web.4.5.0\lib\netstandard2.0\System.Text.Encodings.Web.dll ..\packages\System.Threading.Tasks.Extensions.4.5.4\lib\net461\System.Threading.Tasks.Extensions.dll + + ..\packages\System.Threading.Thread.4.3.0\lib\net46\System.Threading.Thread.dll + - + ..\packages\System.ValueTuple.4.3.0\lib\netstandard1.0\System.ValueTuple.dll ..\packages\Microsoft.AspNet.WebPages.3.2.3\lib\net45\System.Web.Helpers.dll - True ..\packages\Microsoft.AspNet.Mvc.5.2.3\lib\net45\System.Web.Mvc.dll @@ -389,19 +478,15 @@ ..\packages\Microsoft.AspNet.Razor.3.2.3\lib\net45\System.Web.Razor.dll - True ..\packages\Microsoft.AspNet.WebPages.3.2.3\lib\net45\System.Web.WebPages.dll - True ..\packages\Microsoft.AspNet.WebPages.3.2.3\lib\net45\System.Web.WebPages.Deployment.dll - True ..\packages\Microsoft.AspNet.WebPages.3.2.3\lib\net45\System.Web.WebPages.Razor.dll - True @@ -409,6 +494,15 @@ + + ..\packages\System.Xml.XmlDocument.4.3.0\lib\net46\System.Xml.XmlDocument.dll + + + ..\packages\System.Xml.XPath.4.3.0\lib\net46\System.Xml.XPath.dll + + + ..\packages\System.Xml.XPath.XDocument.4.3.0\lib\net46\System.Xml.XPath.XDocument.dll + @@ -432,7 +526,6 @@ - @@ -471,38 +564,41 @@ Designer + + PreserveNewest + - - {D7034F4A-4741-4493-8E1E-0A6D3BE9734E} - SecurityCodeScan - + - + + - - + + {d7034f4a-4741-4493-8e1e-0a6d3be9734e} + SecurityCodeScan + This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - + - - - - - - + + + + + - - - - + + + + + +
- + - - + + - - + + - - + - - + - - + - - + - - + - - + - - + - - + + + + + - - - + - - + - - + - - + - - + - - + + - - + - - + - - + + - - + + - + + + + + + + + + + - + - + + + + + + + + + + + + + + + + + @@ -118,16 +131,11 @@ - - - - - - - - + + + @@ -138,4 +146,4 @@ - + \ No newline at end of file diff --git a/SecurityCodeScan.Test/packages.config b/SecurityCodeScan.Test/packages.config index 96f5fe7a..3b8e1368 100644 --- a/SecurityCodeScan.Test/packages.config +++ b/SecurityCodeScan.Test/packages.config @@ -1,57 +1,57 @@  - - - - - - - - - - - - - - + + + + + + + + + + + + + + + - - - - + + + + - + - + - - - + + + - - - - - - - - - - - + + + + + + + + + + @@ -67,74 +67,113 @@ - - + + - + - + - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + - - + + - + - - - + + + + + + + + + + - - - - - - - - - + + + + + + + + + + + + + + + + - - + + + - - - - - - - + + + + + + + - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + - - - - + + + + + + + + + \ No newline at end of file diff --git a/SecurityCodeScan.Vsix/SecurityCodeScan.Vsix.csproj b/SecurityCodeScan.Vsix/SecurityCodeScan.Vsix.csproj index 392df315..b3bcdd85 100644 --- a/SecurityCodeScan.Vsix/SecurityCodeScan.Vsix.csproj +++ b/SecurityCodeScan.Vsix/SecurityCodeScan.Vsix.csproj @@ -8,6 +8,7 @@ 14.0 + @@ -19,8 +20,7 @@ Library Properties SecurityCodeScan.Vsix - SecurityCodeScan.Vsix - v4.5.2 + SecurityCodeScan.VS2017.Vsix false false false @@ -28,6 +28,7 @@ false false Roslyn + v4.6.1 true @@ -57,7 +58,6 @@ - Designer @@ -71,6 +71,10 @@ + + YamlDotNet.dll + true + Always true diff --git a/SecurityCodeScan.Vsix/marketplace.json b/SecurityCodeScan.Vsix/marketplace.json index 5b237ff7..fa2c7b50 100644 --- a/SecurityCodeScan.Vsix/marketplace.json +++ b/SecurityCodeScan.Vsix/marketplace.json @@ -2,7 +2,7 @@ "$schema": "http://json.schemastore.org/vsix-publish", "categories": [ "Security", "Coding" ], "identity": { - "internalName": "SecurityCodeScan", + "internalName": "SecurityCodeScanVS2017", "tags": [ ".NET", "Analysis", diff --git a/SecurityCodeScan.Vsix/marketplace.md b/SecurityCodeScan.Vsix/marketplace.md index 329198ec..ad161ea8 100644 --- a/SecurityCodeScan.Vsix/marketplace.md +++ b/SecurityCodeScan.Vsix/marketplace.md @@ -1,4 +1,6 @@ -# Security static code analyzer for .NET +**_This extension is legacy and is no longer maintained, please use [SecurityCodeScan VS2019](https://marketplace.visualstudio.com/items?itemName=JaroslavLobacevski.SecurityCodeScanVS2019) instead._** + +# Security static code analyzer for .NET [Website](https://security-code-scan.github.io) * Detects various [security vulnerability patterns](https://security-code-scan.github.io/#rules): SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), XML eXternal Entity Injection (XXE), etc. @@ -9,6 +11,6 @@ * Continuous Integration (CI) through [MSBuild](https://msdn.microsoft.com/en-us/library/dd393574.aspx). For Unix CI runners please use [VS2017 nuget package](https://www.nuget.org/packages/SecurityCodeScan.VS2017). -* Works with Visual Studio 2015 or higher. Visual Studio [Community](https://www.visualstudio.com/en-us/products/visual-studio-community-vs.aspx), Professional and Enterprise editions are supported. Other editors that support Roslyn based analyzers like Rider or OmniSharp should work too. +* Works with Visual Studio 2017 or higher. Visual Studio [Community](https://www.visualstudio.com/en-us/products/visual-studio-community-vs.aspx), Professional and Enterprise editions are supported. Other editors that support Roslyn based analyzers like Rider or OmniSharp should work too. -* [Open Source](https://github.com/security-code-scan/security-code-scan) \ No newline at end of file +* [Open Source](https://github.com/security-code-scan/security-code-scan) diff --git a/SecurityCodeScan.Vsix/packages.config b/SecurityCodeScan.Vsix/packages.config deleted file mode 100644 index cc862a6e..00000000 --- a/SecurityCodeScan.Vsix/packages.config +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/SecurityCodeScan.Vsix/source.extension.vsixmanifest b/SecurityCodeScan.Vsix/source.extension.vsixmanifest index 7b116f2b..a9f6a519 100644 --- a/SecurityCodeScan.Vsix/source.extension.vsixmanifest +++ b/SecurityCodeScan.Vsix/source.extension.vsixmanifest @@ -1,8 +1,8 @@  - - Security Code Scan + + Security Code Scan (for VS2017 and newer) Security static code analyzer for .NET https://security-code-scan.github.io LICENSE-LGPL.txt @@ -13,9 +13,9 @@ SecurityCodeScan;Security.Code.Scan;Security Code Scan;Static Code Analysis;Security;Vulnerability;Analyzer;Analyzers;.NET;Roslyn;OWASP;Injection;XSS;CSRF;XXE;SQLi - - - + + + @@ -25,6 +25,6 @@ - + diff --git a/SecurityCodeScan.sln b/SecurityCodeScan.sln index 079d4403..16ceda8d 100644 --- a/SecurityCodeScan.sln +++ b/SecurityCodeScan.sln @@ -31,4 +31,8 @@ Global GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + EnterpriseLibraryConfigurationToolBinariesPathV6 = packages\EnterpriseLibrary.Common.6.0.1304.0\lib\NET45;packages\EnterpriseLibrary.Data.6.0.1304.0\lib\NET45 + SolutionGuid = {4890F503-884C-48F5-982B-41C1DB7472F5} + EndGlobalSection EndGlobal diff --git a/SecurityCodeScan/Analyzers/Analyzers.cs b/SecurityCodeScan/Analyzers/Analyzers.cs index e9ac99e5..63f4d13c 100644 --- a/SecurityCodeScan/Analyzers/Analyzers.cs +++ b/SecurityCodeScan/Analyzers/Analyzers.cs @@ -3,6 +3,7 @@ using System.Collections.Immutable; using System.Diagnostics; using System.Linq; +using System.Reflection; using Microsoft.CodeAnalysis; using Microsoft.CodeAnalysis.Diagnostics; using SecurityCodeScan.Analyzers.Taint; @@ -52,7 +53,7 @@ internal Analyzers(IEnumerable analyzers) { foreach (var analyzer in analyzers) { - if (!analyzer.GetType().GetCustomAttributes(typeof(SecurityAnalyzerAttribute), false).Any()) + if (!analyzer.GetType().GetTypeInfo().GetCustomAttributes(typeof(SecurityAnalyzerAttribute), false).Any()) throw new Exception("Analyzer is derived from SecurityAnalyzer, but doesn't have 'SecurityAnalyzer' attribute."); } Workers = new Lazy>(() => new List(analyzers)); @@ -61,7 +62,7 @@ internal Analyzers(IEnumerable analyzers) internal Analyzers(SecurityAnalyzer analyzer) { - if (!analyzer.GetType().GetCustomAttributes(typeof(SecurityAnalyzerAttribute), false).Any()) + if (!analyzer.GetType().GetTypeInfo().GetCustomAttributes(typeof(SecurityAnalyzerAttribute), false).Any()) throw new Exception("Analyzer is derived from SecurityAnalyzer, but doesn't have 'SecurityAnalyzer' attribute."); Workers = new Lazy>(() => new List { analyzer }); @@ -72,12 +73,12 @@ internal List InitWorkers(string language) where T : TaintA { var workers = new List(); var taintExtensions = new List(); - var types = GetType().Assembly.DefinedTypes; + var types = GetType().GetTypeInfo().Assembly.DefinedTypes; foreach (var type in types) { - if (!type.IsAbstract && typeof(T).IsAssignableFrom(type)) + if (!type.IsAbstract && typeof(T).GetTypeInfo().IsAssignableFrom(type)) { - taintExtensions.Add((T)Activator.CreateInstance(type)); + taintExtensions.Add((T)Activator.CreateInstance(type.AsType())); } } @@ -92,13 +93,13 @@ internal List InitWorkers(string language) where T : TaintA { if (attribute.Languages.Contains(language)) { - if (typeof(TaintAnalyzer).IsAssignableFrom(type)) + if (typeof(TaintAnalyzer).GetTypeInfo().IsAssignableFrom(type)) { - workers.Add((SecurityAnalyzer)Activator.CreateInstance(type, taintExtensions.ToArray())); + workers.Add((SecurityAnalyzer)Activator.CreateInstance(type.AsType(), taintExtensions.ToArray())); } else { - workers.Add((SecurityAnalyzer)Activator.CreateInstance(type)); + workers.Add((SecurityAnalyzer)Activator.CreateInstance(type.AsType())); } break; } diff --git a/SecurityCodeScan/Analyzers/CompilationAnalyzer.cs b/SecurityCodeScan/Analyzers/CompilationAnalyzer.cs index e95b0346..57cc3002 100644 --- a/SecurityCodeScan/Analyzers/CompilationAnalyzer.cs +++ b/SecurityCodeScan/Analyzers/CompilationAnalyzer.cs @@ -15,4 +15,16 @@ public void OnCompilationAction(CompilationAnalysisContext ctx) ctx.ReportDiagnostic(Diagnostic.Create(Rule, Location.None)); } } + + internal class DeprecationAnalyzer + { + public const string DiagnosticId = "SCS9999"; + + public static readonly DiagnosticDescriptor Rule = LocaleUtil.GetDescriptor(DiagnosticId); + + public void OnCompilationAction(CompilationAnalysisContext ctx) + { + ctx.ReportDiagnostic(Diagnostic.Create(Rule, Location.None)); + } + } } diff --git a/SecurityCodeScan/Analyzers/SecurityAnalysisContext.cs b/SecurityCodeScan/Analyzers/SecurityAnalysisContext.cs index a72961e8..56dee35e 100644 --- a/SecurityCodeScan/Analyzers/SecurityAnalysisContext.cs +++ b/SecurityCodeScan/Analyzers/SecurityAnalysisContext.cs @@ -36,6 +36,7 @@ public void Initialize(AnalysisContext analysisContext, IEnumerable> OnCompilationStartActions = new List>(); @@ -65,6 +66,8 @@ private void OnCompilationAction(CompilationAnalysisContext context) action(context); } + DeprecationAnalyzer.OnCompilationAction(context); + if (ProjectConfiguration.ReportAnalysisCompletion) FinalAnalyzer.OnCompilationAction(context); } diff --git a/SecurityCodeScan/Analyzers/Taint/CodeEvaluation/CSharpCodeEvaluation.cs b/SecurityCodeScan/Analyzers/Taint/CodeEvaluation/CSharpCodeEvaluation.cs index 918bc35d..811b2b37 100644 --- a/SecurityCodeScan/Analyzers/Taint/CodeEvaluation/CSharpCodeEvaluation.cs +++ b/SecurityCodeScan/Analyzers/Taint/CodeEvaluation/CSharpCodeEvaluation.cs @@ -116,10 +116,21 @@ private VariableState VisitMethodDeclaration(BaseMethodDeclarationSyntax node, E } } - if (node.Body == null) - return new VariableState(node, VariableTaint.Unknown); + if(node.ExpressionBody != null) + { + var expressionState = VisitExpression(node.ExpressionBody.Expression, state); + foreach (var ext in Extensions) + { + ext.VisitArrowExpressionClause(node.ExpressionBody, state, expressionState, ProjectConfiguration); + } + + return expressionState; + } + + if (node.Body != null) + return VisitBlock(node.Body, state); - return VisitBlock(node.Body, state); + return new VariableState(node, VariableTaint.Unknown); } private VariableState VisitForEach(ForEachStatementSyntax node, ExecutionState state) @@ -137,6 +148,10 @@ private VariableState VisitNode(SyntaxNode node, ExecutionState state) { switch (node) { + case SingleVariableDesignationSyntax singleVariableDesignationSyntax: + var varState = new VariableState(singleVariableDesignationSyntax, VariableTaint.Unknown); + state.AddNewValue(ResolveIdentifier(singleVariableDesignationSyntax.Identifier), varState); + return varState; case PrefixUnaryExpressionSyntax prefixUnaryExpression: return VisitNode(prefixUnaryExpression.Operand, state); case LocalDeclarationStatementSyntax declarationStatementSyntax: @@ -361,6 +376,29 @@ private VariableState VisitFromClause(FromClauseSyntax fromClauseSyntax, Executi return fromClauseState; } + private VariableState VisitSwitchSection(SwitchSectionSyntax switchSectionSyntax, ExecutionState state, VariableState switchStatementVarState) + { + if (switchSectionSyntax.Labels.Any(x => x is CasePatternSwitchLabelSyntax)) + { + var caseState = new ExecutionState(state); + foreach (var switchLabelSyntax in switchSectionSyntax.Labels) + { + if (switchLabelSyntax is CasePatternSwitchLabelSyntax casePatternSwitchLabel && + casePatternSwitchLabel.Pattern is DeclarationPatternSyntax declarationPattern && + declarationPattern.Designation is SingleVariableDesignationSyntax singleVariableDesignation) + { + caseState.AddNewValue(ResolveIdentifier(singleVariableDesignation.Identifier), switchStatementVarState); + } + } + + var caseStateVariable = VisitStatements(switchSectionSyntax.Statements, caseState, new VariableState(switchSectionSyntax, VariableTaint.Unset)); + state.Replace(caseState); + return caseStateVariable; + } + + return VisitStatements(switchSectionSyntax.Statements, state, new VariableState(switchSectionSyntax, VariableTaint.Unset)); + } + private VariableState VisitSwitch(SwitchStatementSyntax switchStatementSyntax, ExecutionState state) { var exprVarState = VisitExpression(switchStatementSyntax.Expression, state); @@ -368,14 +406,14 @@ private VariableState VisitSwitch(SwitchStatementSyntax switchStatementSyntax, E return exprVarState; var firstCaseState = new ExecutionState(state); - var sectionVarState = VisitNode(switchStatementSyntax.Sections[0], firstCaseState); + var sectionVarState = VisitSwitchSection(switchStatementSyntax.Sections[0], firstCaseState, exprVarState); exprVarState.MergeTaint(sectionVarState.Taint); for (var i = 1; i < switchStatementSyntax.Sections.Count; i++) { var section = switchStatementSyntax.Sections[i]; var caseState = new ExecutionState(state); - sectionVarState = VisitNode(section, caseState); + sectionVarState = VisitSwitchSection(section, caseState, exprVarState); exprVarState.MergeTaint(sectionVarState.Taint); firstCaseState.Merge(caseState); } @@ -489,6 +527,8 @@ private VariableState VisitExpression(ExpressionSyntax expression, ExecutionStat { switch (expression) { + case DeclarationExpressionSyntax declarationExpressionSyntax: + return VisitNode(declarationExpressionSyntax.Designation, state); case ParenthesizedExpressionSyntax parenthesizedExpressionSyntax: return VisitExpression(parenthesizedExpressionSyntax.Expression, state); case InvocationExpressionSyntax invocationExpressionSyntax: @@ -1216,41 +1256,44 @@ private VariableState ResolveVariableState(ExpressionSyntax expression, if (prop.IsVirtual || prop.IsOverride || prop.IsAbstract) return new VariableState(expression, VariableTaint.Unknown); - var getMtd = prop.GetMethod; - if (getMtd == null) - { - return new VariableState(expression, VariableTaint.Unknown); - } + var getMtd = prop.GetMethod; + if(getMtd == null) + { + return new VariableState(expression, VariableTaint.Unknown); + } - var decls = getMtd.DeclaringSyntaxReferences; - if (decls.Length != 1) - { - // partial methods can't return anything, so something weird is going on - return new VariableState(expression, VariableTaint.Unknown); - } + var decls = getMtd.DeclaringSyntaxReferences; + if(decls.Length != 1) + { + // partial methods can't return anything, so something weird is going on + return new VariableState(expression, VariableTaint.Unknown); + } - var syntaxNode = (CSharpSyntaxNode)decls[0].GetSyntax(); - if (syntaxNode == null) - return new VariableState(expression, VariableTaint.Unknown); + var syntaxNode = (CSharpSyntaxNode)decls[0].GetSyntax(); + if (syntaxNode == null) + return new VariableState(expression, VariableTaint.Unknown); - if (!semanticModel.Compilation.ContainsSyntaxTree(syntaxNode.SyntaxTree)) - return new VariableState(expression, VariableTaint.Unknown); + if (!semanticModel.Compilation.ContainsSyntaxTree(syntaxNode.SyntaxTree)) + return new VariableState(expression, VariableTaint.Unknown); - var possiblyOtherSemanticModel = semanticModel.Compilation.GetSemanticModel(syntaxNode.SyntaxTree); - if (syntaxNode is ArrowExpressionClauseSyntax arrowExpressionClauseSyntax) - return ResolveVariableState(arrowExpressionClauseSyntax, expression, possiblyOtherSemanticModel, ref visited); + var possiblyOtherSemanticModel = semanticModel.Compilation.GetSemanticModel(syntaxNode.SyntaxTree); + if (syntaxNode is ArrowExpressionClauseSyntax arrowExpressionClauseSyntax) + return ResolveVariableState(arrowExpressionClauseSyntax, expression, possiblyOtherSemanticModel, ref visited); - if (syntaxNode is AccessorDeclarationSyntax accessorDecl) - { - if (accessorDecl.Body != null) + if(syntaxNode is AccessorDeclarationSyntax accessorDecl) { - var accessFlow = possiblyOtherSemanticModel.AnalyzeControlFlow(accessorDecl.Body); - if (accessFlow.Succeeded && AllReturnConstant(accessFlow.ExitPoints, possiblyOtherSemanticModel, visited)) - return new VariableState(expression, VariableTaint.Constant); - } + if (accessorDecl.ExpressionBody != null) + return ResolveVariableState(accessorDecl.ExpressionBody, expression, possiblyOtherSemanticModel, ref visited); - return new VariableState(expression, VariableTaint.Unknown); - } + if (accessorDecl.Body != null) + { + var accessFlow = possiblyOtherSemanticModel.AnalyzeControlFlow(accessorDecl.Body); + if (accessFlow.Succeeded && AllReturnConstant(accessFlow.ExitPoints, possiblyOtherSemanticModel, visited)) + return new VariableState(expression, VariableTaint.Constant); + } + + return new VariableState(expression, VariableTaint.Unknown); + } if (!(syntaxNode is StatementSyntax statementSyntax)) return new VariableState(expression, VariableTaint.Unknown); diff --git a/SecurityCodeScan/Analyzers/Taint/CodeEvaluation/VbCodeEvaluation.cs b/SecurityCodeScan/Analyzers/Taint/CodeEvaluation/VbCodeEvaluation.cs index 2f94fe6d..646b1605 100644 --- a/SecurityCodeScan/Analyzers/Taint/CodeEvaluation/VbCodeEvaluation.cs +++ b/SecurityCodeScan/Analyzers/Taint/CodeEvaluation/VbCodeEvaluation.cs @@ -1199,16 +1199,34 @@ private VariableState ResolveVariableState(ExpressionSyntax expression, if (prop.IsVirtual || prop.IsOverride || prop.IsAbstract) return new VariableState(expression, VariableTaint.Unknown); - // TODO: Use public API - var syntaxNodeProperty = prop.GetMethod.GetType().GetTypeInfo().BaseType.GetTypeInfo().GetDeclaredProperty("Syntax"); - var syntaxNode = (VisualBasicSyntaxNode)syntaxNodeProperty?.GetValue(prop.GetMethod); + var getMtd = prop.GetMethod; + if(getMtd == null) + { + return new VariableState(expression, VariableTaint.Unknown); + } + + var decls = getMtd.DeclaringSyntaxReferences; + if(decls.Length != 1) + { + // partial methods can't return anything, so something weird is going on + return new VariableState(expression, VariableTaint.Unknown); + } + + var syntaxNode = (VisualBasicSyntaxNode)decls[0].GetSyntax(); if (syntaxNode == null) return new VariableState(expression, VariableTaint.Unknown); + if (!semanticModel.Compilation.ContainsSyntaxTree(syntaxNode.SyntaxTree)) + return new VariableState(expression, VariableTaint.Unknown); + var possiblyOtherSemanticModel = semanticModel.Compilation.GetSemanticModel(syntaxNode.SyntaxTree); - if (!(syntaxNode is AccessorBlockSyntax accessorBlockSyntax) || accessorBlockSyntax.Statements.Count <= 0) + if (!(syntaxNode is AccessorStatementSyntax accessorStatementSyntax) || + !(accessorStatementSyntax.Parent is AccessorBlockSyntax accessorBlockSyntax) || + accessorBlockSyntax.Statements.Count <= 0) + { return new VariableState(expression, VariableTaint.Unknown); + } var flow = possiblyOtherSemanticModel.AnalyzeControlFlow(accessorBlockSyntax.Statements.First(), accessorBlockSyntax.Statements.Last()); diff --git a/SecurityCodeScan/Config/Configuration.cs b/SecurityCodeScan/Config/Configuration.cs index ddee3722..8dfdf966 100644 --- a/SecurityCodeScan/Config/Configuration.cs +++ b/SecurityCodeScan/Config/Configuration.cs @@ -159,7 +159,7 @@ public Configuration(ConfigData configData) : this() private readonly LinkedList _CsrfGroupsList; // ensure groups are exposed in the same order they were added private readonly Dictionary> _CsrfGroups; - public IReadOnlyCollection CsrfGoups => (IReadOnlyCollection)_CsrfGroupsList; + public IReadOnlyCollection CsrfGoups => _CsrfGroupsList; public void MergeWith(ConfigData config) { diff --git a/SecurityCodeScan/Config/ConfigurationManager.cs b/SecurityCodeScan/Config/ConfigurationManager.cs index 56fbaf47..bdf492c1 100644 --- a/SecurityCodeScan/Config/ConfigurationManager.cs +++ b/SecurityCodeScan/Config/ConfigurationManager.cs @@ -4,6 +4,7 @@ using System.IO; using System.Reflection; using System.Text; +using System.Runtime.InteropServices; using Microsoft.CodeAnalysis; using YamlDotNet.RepresentationModel; using YamlDotNet.Serialization; @@ -21,7 +22,29 @@ internal class ConfigurationReader private string UserConfigFile => UserConfigFileCached.Value; private static readonly Lazy UserConfigFileCached = - new Lazy(() => Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), UserConfigName)); + new Lazy(() => + { + // todo: use Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) once on netstandard 2.0 + string path; + if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) + { + path = Environment.GetEnvironmentVariable("LocalAppData"); + } + else + { + string home = Environment.GetEnvironmentVariable("HOME"); + // "$XDG_DATA_HOME defines the base directory relative to which user specific data files should be stored." + // "If $XDG_DATA_HOME is either not set or empty, a default equal to $HOME/.local/share should be used." + path = Environment.GetEnvironmentVariable("XDG_DATA_HOME"); + + if (string.IsNullOrEmpty(path) || path[0] != '/') + { + path = Path.Combine(home, ".local", "share"); + } + } + + return Path.Combine(path, UserConfigName); + }); private static readonly Version ConfigVersion = new Version(2,1); @@ -59,7 +82,7 @@ public virtual ConfigData GetUserConfiguration() if (!File.Exists(filePath)) return null; - using (var reader = new StreamReader(filePath)) + using (var reader = File.OpenText (filePath)) { return DeserializeAndValidate(reader); } diff --git a/SecurityCodeScan/Config/CsrfNamedGroup.cs b/SecurityCodeScan/Config/CsrfNamedGroup.cs index 8c8f7481..83334045 100644 --- a/SecurityCodeScan/Config/CsrfNamedGroup.cs +++ b/SecurityCodeScan/Config/CsrfNamedGroup.cs @@ -11,23 +11,11 @@ internal class CsrfAttributeCondition { public static readonly CsrfAttributeCondition TRUE = new CsrfAttributeCondition(); - public struct Pair - { - public Pair(object parameterIndexOrPropertyName, object expectedValue) - { - ParameterIndexOrPropertyName = parameterIndexOrPropertyName; - ExpectedValue = expectedValue; - } - - public readonly object ParameterIndexOrPropertyName; - public readonly object ExpectedValue; - } - - public readonly List MustMatch; + public readonly List<(object ParameterIndexOrPropertyName, object ExpectedValue)> MustMatch; public CsrfAttributeCondition() { - MustMatch = new List(); + MustMatch = new List<(object ParameterIndexOrPropertyName, object ExpectedValue)>(); } public static void AddCsrfAttributes(Dictionary> destination, IEnumerable source) @@ -92,11 +80,11 @@ private static CsrfAttributeCondition CreateCsrfAttributeCondition(Dictionary - SecurityCodeScan + SecurityCodeScan.VS2017 $version$ - Security Code Scan + Security Code Scan (for VS2017 and newer) Jaroslav Lobačevski, Philippe Arteau Jaroslav Lobačevski https://opensource.org/licenses/lgpl-3.0.html @@ -21,7 +21,7 @@ - + diff --git a/SecurityCodeScan/Properties/AssemblyInfo.cs b/SecurityCodeScan/Properties/AssemblyInfo.cs index 1c8cd384..1ab627b9 100644 --- a/SecurityCodeScan/Properties/AssemblyInfo.cs +++ b/SecurityCodeScan/Properties/AssemblyInfo.cs @@ -6,7 +6,7 @@ // General Information about an assembly is controlled through the following // set of attributes. Change these attribute values to modify the information // associated with an assembly. -[assembly: AssemblyTitle("Security Code Scan")] +[assembly: AssemblyTitle("Security Code Scan (VS2017 and newer)")] [assembly: AssemblyDescription("Security static code analyzer for .NET")] [assembly: AssemblyConfiguration("")] [assembly: AssemblyCompany("https://github.com/security-code-scan/security-code-scan")] diff --git a/SecurityCodeScan/SecurityCodeScan.csproj b/SecurityCodeScan/SecurityCodeScan.csproj index 68936159..5b03fc4b 100644 --- a/SecurityCodeScan/SecurityCodeScan.csproj +++ b/SecurityCodeScan/SecurityCodeScan.csproj @@ -1,193 +1,66 @@ - - - + + - 11.0 - Debug - AnyCPU - {D7034F4A-4741-4493-8E1E-0A6D3BE9734E} - Library - Properties - SecurityCodeScan - SecurityCodeScan - v4.5.2 - - - - - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - default - - - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - default + netstandard1.3 + false + false + true + - false + SecurityCodeScan.VS2017 + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - True - True - Empty.resx - - - + + + - - ResXFileCodeGenerator - Empty.Designer.cs - Designer - + + + - - - - PreserveNewest - - - Designer + + all + runtime; build; native; contentfiles; analyzers + + + + + + all + runtime; build; native; contentfiles; analyzers; buildtransitive + + + + + + + + + + + + PreserveNewest - - - Designer - - + PreserveNewest - + PreserveNewest - - - ..\packages\Microsoft.CodeAnalysis.Common.1.3.2\lib\net45\Microsoft.CodeAnalysis.dll - - - ..\packages\Microsoft.CodeAnalysis.CSharp.1.3.2\lib\net45\Microsoft.CodeAnalysis.CSharp.dll - - - ..\packages\Microsoft.CodeAnalysis.VisualBasic.1.3.2\lib\net45\Microsoft.CodeAnalysis.VisualBasic.dll - - - - ..\packages\System.Collections.Immutable.1.1.37\lib\dotnet\System.Collections.Immutable.dll - - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.AttributedModel.dll - False - - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.Convention.dll - False - - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.Hosting.dll - False - - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.Runtime.dll - False - - - ..\packages\Microsoft.Composition.1.0.27\lib\portable-net45+win8+wp8+wpa81\System.Composition.TypedParts.dll - False - - - ..\packages\System.Reflection.Metadata.1.2.0\lib\portable-net45+win8\System.Reflection.Metadata.dll - - - - - ..\packages\YamlDotNet.8.1.1\lib\net45\YamlDotNet.dll - - - - - - - - + + - + - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - \ No newline at end of file + + diff --git a/SecurityCodeScan/packages.config b/SecurityCodeScan/packages.config deleted file mode 100644 index 036a9d52..00000000 --- a/SecurityCodeScan/packages.config +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/SecurityCodeScan/tools/install.ps1 b/SecurityCodeScan/tools/install.ps1 index 8178834f..9e3fbbf4 100644 --- a/SecurityCodeScan/tools/install.ps1 +++ b/SecurityCodeScan/tools/install.ps1 @@ -1,13 +1,22 @@ param($installPath, $toolsPath, $package, $project) -$analyzersPaths = Join-Path (Join-Path (Split-Path -Path $toolsPath -Parent) "analyzers" ) * -Resolve +if($project.Object.SupportsPackageDependencyResolution) +{ + if($project.Object.SupportsPackageDependencyResolution()) + { + # Do not install analyzers via install.ps1, instead let the project system handle it. + return + } +} + +$analyzersPaths = Join-Path (Join-Path (Split-Path -Path $toolsPath -Parent) "analyzers") * -Resolve foreach($analyzersPath in $analyzersPaths) { - # Install the language agnostic analyzers. if (Test-Path $analyzersPath) { - foreach ($analyzerFilePath in Get-ChildItem $analyzersPath -Filter *.dll) + # Install the language agnostic analyzers. + foreach ($analyzerFilePath in Get-ChildItem -Path "$analyzersPath\*.dll" -Exclude *.resources.dll) { if($project.Object.AnalyzerReferences) { @@ -38,7 +47,7 @@ foreach($analyzersPath in $analyzersPaths) $languageAnalyzersPath = join-path $analyzersPath $languageFolder if (Test-Path $languageAnalyzersPath) { - foreach ($analyzerFilePath in Get-ChildItem $languageAnalyzersPath -Filter *.dll) + foreach ($analyzerFilePath in Get-ChildItem -Path "$languageAnalyzersPath\*.dll" -Exclude *.resources.dll) { if($project.Object.AnalyzerReferences) { diff --git a/SecurityCodeScan/tools/uninstall.ps1 b/SecurityCodeScan/tools/uninstall.ps1 index 9130bcb5..e9a81a0a 100644 --- a/SecurityCodeScan/tools/uninstall.ps1 +++ b/SecurityCodeScan/tools/uninstall.ps1 @@ -1,13 +1,22 @@ param($installPath, $toolsPath, $package, $project) -$analyzersPaths = Join-Path (Join-Path (Split-Path -Path $toolsPath -Parent) "analyzers" ) * -Resolve +if($project.Object.SupportsPackageDependencyResolution) +{ + if($project.Object.SupportsPackageDependencyResolution()) + { + # Do not uninstall analyzers via uninstall.ps1, instead let the project system handle it. + return + } +} + +$analyzersPaths = Join-Path (Join-Path (Split-Path -Path $toolsPath -Parent) "analyzers") * -Resolve foreach($analyzersPath in $analyzersPaths) { # Uninstall the language agnostic analyzers. if (Test-Path $analyzersPath) { - foreach ($analyzerFilePath in Get-ChildItem $analyzersPath -Filter *.dll) + foreach ($analyzerFilePath in Get-ChildItem -Path "$analyzersPath\*.dll" -Exclude *.resources.dll) { if($project.Object.AnalyzerReferences) { @@ -38,7 +47,7 @@ foreach($analyzersPath in $analyzersPaths) $languageAnalyzersPath = join-path $analyzersPath $languageFolder if (Test-Path $languageAnalyzersPath) { - foreach ($analyzerFilePath in Get-ChildItem $languageAnalyzersPath -Filter *.dll) + foreach ($analyzerFilePath in Get-ChildItem -Path "$languageAnalyzersPath\*.dll" -Exclude *.resources.dll) { if($project.Object.AnalyzerReferences) { @@ -53,4 +62,4 @@ foreach($analyzersPath in $analyzersPaths) } } } -} \ No newline at end of file +} \ No newline at end of file