Skip to content

Commit

Permalink
Merge pull request #3854 from dotpaul/datasetdatatable3
Browse files Browse the repository at this point in the history 
Initial rules for DataSet / DataTable deserializations
  • Loading branch information
@dotpaul
dotpaul committed Jul 14, 2020
2 parents bf6e76a + 7993ad1 commit d512b50
Show file tree
Hide file tree
Showing 60 changed files with 5,108 additions and 260 deletions.
143 changes: 75 additions & 68 deletions src/Microsoft.CodeAnalysis.FxCopAnalyzers/Microsoft.CodeAnalysis.FxCopAnalyzers.md
View file

Large diffs are not rendered by default.

169 changes: 151 additions & 18 deletions src/Microsoft.CodeAnalysis.FxCopAnalyzers/Microsoft.CodeAnalysis.FxCopAnalyzers.sarif
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
{
"tool": {
"name": "Microsoft.CodeAnalysis.VersionCheckAnalyzer",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand All @@ -29,7 +29,7 @@
{
"tool": {
"name": "Microsoft.CodeQuality.Analyzers",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down Expand Up @@ -76,8 +76,8 @@
},
"CA1010": {
"id": "CA1010",
"shortDescription": "Collections should implement generic interface",
"fullDescription": "To broaden the usability of a collection, implement one of the generic collection interfaces. Then the collection can be used to populate generic collection types.",
"shortDescription": "Generic interface should also be implemented",
"fullDescription": "To broaden the usability of a type, implement one of the generic interfaces. This is especially true for collections as they can then be used to populate generic collection types.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca1010",
"properties": {
Expand Down Expand Up @@ -1234,7 +1234,7 @@
"CA1822": {
"id": "CA1822",
"shortDescription": "Mark members as static",
"fullDescription": "Members that do not access instance data or call instance methods can be marked as static (Shared in Visual Basic). After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code.",
"fullDescription": "Members that do not access instance data or call instance methods can be marked as static. After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca1822",
"properties": {
Expand Down Expand Up @@ -1530,7 +1530,7 @@
{
"tool": {
"name": "Microsoft.CodeQuality.CSharp.Analyzers",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down Expand Up @@ -1727,7 +1727,7 @@
{
"tool": {
"name": "Microsoft.CodeQuality.VisualBasic.Analyzers",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down Expand Up @@ -1962,7 +1962,7 @@
{
"tool": {
"name": "Microsoft.NetCore.Analyzers",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down Expand Up @@ -2819,6 +2819,139 @@
]
}
},
"CA2350": {
"id": "CA2350",
"shortDescription": "Do not use insecure deserialization with DataTable.ReadXml()",
"fullDescription": "The method '{0}' is insecure when deserializing untrusted data. If deserializing untrusted data, replace with TBD.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2350",
"properties": {
"category": "Security",
"isEnabledByDefault": false,
"typeName": "DoNotUseDataTableReadXml",
"languages": [
"C#",
"Visual Basic"
],
"tags": [
"Telemetry"
]
}
},
"CA2351": {
"id": "CA2351",
"shortDescription": "Do not use insecure deserialization with DataSet.ReadXml()",
"fullDescription": "The method '{0}' is insecure when deserializing untrusted data. If deserializing untrusted data, replace with TBD.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2351",
"properties": {
"category": "Security",
"isEnabledByDefault": false,
"typeName": "DoNotUseDataSetReadXml",
"languages": [
"C#",
"Visual Basic"
],
"tags": [
"Telemetry"
]
}
},
"CA2352": {
"id": "CA2352",
"shortDescription": "Unsafe DataSet or DataTable in serializable type can be vulnerable to remote code execution attacks",
"fullDescription": "When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2352",
"properties": {
"category": "Security",
"isEnabledByDefault": false,
"typeName": "DataSetDataTableInSerializableTypeAnalyzer",
"languages": [
"C#",
"Visual Basic"
],
"tags": [
"Telemetry"
]
}
},
"CA2353": {
"id": "CA2353",
"shortDescription": "Unsafe DataSet or DataTable in serializable type",
"fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2353",
"properties": {
"category": "Security",
"isEnabledByDefault": false,
"typeName": "DataSetDataTableInSerializableTypeAnalyzer",
"languages": [
"C#",
"Visual Basic"
],
"tags": [
"Telemetry"
]
}
},
"CA2354": {
"id": "CA2354",
"shortDescription": "Unsafe DataSet or DataTable in deserialized object graph can be vulnerable to remote code execution attacks",
"fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2354",
"properties": {
"category": "Security",
"isEnabledByDefault": false,
"typeName": "DataSetDataTableInIFormatterSerializableObjectGraphAnalyzer",
"languages": [
"C#",
"Visual Basic"
],
"tags": [
"Telemetry"
]
}
},
"CA2355": {
"id": "CA2355",
"shortDescription": "Unsafe DataSet or DataTable type found in deserializable object graph",
"fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2355",
"properties": {
"category": "Security",
"isEnabledByDefault": false,
"typeName": "DataSetDataTableInSerializableObjectGraphAnalyzer",
"languages": [
"C#",
"Visual Basic"
],
"tags": [
"Telemetry"
]
}
},
"CA2356": {
"id": "CA2356",
"shortDescription": "Unsafe DataSet or DataTable type in web deserializable object graph",
"fullDescription": "When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca2356",
"properties": {
"category": "Security",
"isEnabledByDefault": false,
"typeName": "DataSetDataTableInWebSerializableObjectGraphAnalyzer",
"languages": [
"C#",
"Visual Basic"
],
"tags": [
"Telemetry"
]
}
},
"CA3001": {
"id": "CA3001",
"shortDescription": "Review code for SQL injection vulnerabilities",
Expand Down Expand Up @@ -3118,8 +3251,8 @@
},
"CA5358": {
"id": "CA5358",
"shortDescription": "Do Not Use Unsafe Cipher Modes",
"fullDescription": "These modes are vulnerable to attacks. Use only approved modes (CBC, CTS).",
"shortDescription": "Review cipher mode usage with cryptography experts",
"fullDescription": "These cipher modes might be vulnerable to attacks. Consider using recommended modes (CBC, CTS).",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca5358",
"properties": {
Expand Down Expand Up @@ -3195,14 +3328,14 @@
},
"CA5362": {
"id": "CA5362",
"shortDescription": "Do Not Refer Self In Serializable Class",
"fullDescription": "This can allow an attacker to DOS or exhaust the memory of the process.",
"shortDescription": "Potential reference cycle in deserialized object graph",
"fullDescription": "Review code that processes untrusted deserialized data for handling of unexpected reference cycles. An unexpected reference cycle should not cause the code to enter an infinite loop. Otherwise, an unexpected reference cycle can allow an attacker to DOS or exhaust the memory of the process when deserializing untrusted data.",
"defaultLevel": "warning",
"helpUri": "https://docs.microsoft.com/visualstudio/code-quality/ca5362",
"properties": {
"category": "Security",
"isEnabledByDefault": false,
"typeName": "DoNotReferSelfInSerializableClass",
"typeName": "PotentialReferenceCycleInDeserializedObjectGraph",
"languages": [
"C#",
"Visual Basic"
Expand Down Expand Up @@ -4013,7 +4146,7 @@
{
"tool": {
"name": "Microsoft.NetCore.CSharp.Analyzers",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down Expand Up @@ -4152,7 +4285,7 @@
{
"tool": {
"name": "Microsoft.NetCore.VisualBasic.Analyzers",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down Expand Up @@ -4291,7 +4424,7 @@
{
"tool": {
"name": "Microsoft.NetFramework.Analyzers",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down Expand Up @@ -4377,7 +4510,7 @@
{
"tool": {
"name": "Microsoft.NetFramework.CSharp.Analyzers",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down Expand Up @@ -4422,7 +4555,7 @@
{
"tool": {
"name": "Microsoft.NetFramework.VisualBasic.Analyzers",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down
2 changes: 1 addition & 1 deletion ...osoft.CodeAnalysis.VersionCheckAnalyzer/Microsoft.CodeAnalysis.VersionCheckAnalyzer.sarif
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
{
"tool": {
"name": "Microsoft.CodeAnalysis.VersionCheckAnalyzer",
"version": "2.9.9",
"version": "2.9.10",
"language": "en-US"
},
"rules": {
Expand Down
4 changes: 2 additions & 2 deletions src/Microsoft.CodeQuality.Analyzers/Microsoft.CodeQuality.Analyzers.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Sr. No. | Rule ID | Title | Category | Enabled | Severity | CodeFix | Descriptio
2 | [CA1001](https://docs.microsoft.com/visualstudio/code-quality/ca1001) | Types that own disposable fields should be disposable | Design | True | Warning | True | A class declares and implements an instance field that is a System.IDisposable type, and the class does not implement IDisposable. A class that declares an IDisposable field indirectly owns an unmanaged resource and should implement the IDisposable interface. |
3 | [CA1003](https://docs.microsoft.com/visualstudio/code-quality/ca1003) | Use generic event handler instances | Design | False | Warning | False | A type contains an event that declares an EventHandler delegate that returns void, whose signature contains two parameters (the first an object and the second a type that is assignable to EventArgs), and the containing assembly targets Microsoft .NET Framework?2.0. |
4 | [CA1008](https://docs.microsoft.com/visualstudio/code-quality/ca1008) | Enums should have zero value | Design | False | Warning | True | The default value of an uninitialized enumeration, just as other value types, is zero. A nonflags-attributed enumeration should define a member by using the value of zero so that the default value is a valid value of the enumeration. If an enumeration that has the FlagsAttribute attribute applied defines a zero-valued member, its name should be ""None"" to indicate that no values have been set in the enumeration. |
5 | [CA1010](https://docs.microsoft.com/visualstudio/code-quality/ca1010) | Collections should implement generic interface | Design | True | Warning | False | To broaden the usability of a collection, implement one of the generic collection interfaces. Then the collection can be used to populate generic collection types. |
5 | [CA1010](https://docs.microsoft.com/visualstudio/code-quality/ca1010) | Generic interface should also be implemented | Design | True | Warning | False | To broaden the usability of a type, implement one of the generic interfaces. This is especially true for collections as they can then be used to populate generic collection types. |
6 | [CA1012](https://docs.microsoft.com/visualstudio/code-quality/ca1012) | Abstract types should not have constructors | Design | False | Warning | True | Constructors on abstract types can be called only by derived types. Because public constructors create instances of a type, and you cannot create instances of an abstract type, an abstract type that has a public constructor is incorrectly designed. |
7 | [CA1014](https://docs.microsoft.com/visualstudio/code-quality/ca1014) | Mark assemblies with CLSCompliant | Design | False | Warning | False | The Common Language Specification (CLS) defines naming restrictions, data types, and rules to which assemblies must conform if they will be used across programming languages. Good design dictates that all assemblies explicitly indicate CLS compliance by using CLSCompliantAttribute . If this attribute is not present on an assembly, the assembly is not compliant. |
8 | [CA1016](https://docs.microsoft.com/visualstudio/code-quality/ca1016) | Mark assemblies with assembly version | Design | True | Warning | False | The .NET Framework uses the version number to uniquely identify an assembly, and to bind to types in strongly named assemblies. The version number is used together with version and publisher policy. By default, applications run only with the assembly version with which they were built. |
Expand Down Expand Up @@ -69,7 +69,7 @@ Sr. No. | Rule ID | Title | Category | Enabled | Severity | CodeFix | Descriptio
66 | [CA1815](https://docs.microsoft.com/visualstudio/code-quality/ca1815) | Override equals and operator equals on value types | Performance | True | Warning | True | For value types, the inherited implementation of Equals uses the Reflection library and compares the contents of all fields. Reflection is computationally expensive, and comparing every field for equality might be unnecessary. If you expect users to compare or sort instances, or to use instances as hash table keys, your value type should implement Equals. |
67 | [CA1819](https://docs.microsoft.com/visualstudio/code-quality/ca1819) | Properties should not return arrays | Performance | True | Warning | False | Arrays that are returned by properties are not write-protected, even when the property is read-only. To keep the array tamper-proof, the property must return a copy of the array. Typically, users will not understand the adverse performance implications of calling such a property. |
68 | [CA1821](https://docs.microsoft.com/visualstudio/code-quality/ca1821) | Remove empty Finalizers | Performance | True | Warning | True | Finalizers should be avoided where possible, to avoid the additional performance overhead involved in tracking object lifetime. |
69 | [CA1822](https://docs.microsoft.com/visualstudio/code-quality/ca1822) | Mark members as static | Performance | True | Warning | True | Members that do not access instance data or call instance methods can be marked as static (Shared in Visual Basic). After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code. |
69 | [CA1822](https://docs.microsoft.com/visualstudio/code-quality/ca1822) | Mark members as static | Performance | True | Warning | True | Members that do not access instance data or call instance methods can be marked as static. After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code. |
70 | [CA1823](https://docs.microsoft.com/visualstudio/code-quality/ca1823) | Avoid unused private fields | Performance | True | Warning | True | Private fields were detected that do not appear to be accessed in the assembly. |
71 | [CA2007](https://docs.microsoft.com/visualstudio/code-quality/ca2007) | Consider calling ConfigureAwait on the awaited task | Reliability | True | Warning | True | When an asynchronous method awaits a Task directly, continuation occurs in the same thread that created the task. Consider calling Task.ConfigureAwait(Boolean) to signal your intention for continuation. Call ConfigureAwait(false) on the task to schedule continuations to the thread pool, thereby avoiding a deadlock on the UI thread. Passing false is a good option for app-independent libraries. Calling ConfigureAwait(true) on the task has the same behavior as not explicitly calling ConfigureAwait. By explicitly calling this method, you're letting readers know you intentionally want to perform the continuation on the original synchronization context. |
72 | [CA2119](https://docs.microsoft.com/visualstudio/code-quality/ca2119) | Seal methods that satisfy private interfaces | Security | True | Warning | True | An inheritable public type provides an overridable method implementation of an internal (Friend in Visual Basic) interface. To fix a violation of this rule, prevent the method from being overridden outside the assembly. |
Expand Down
Loading

0 comments on commit d512b50

Please sign in to comment.