ASP.NET and FxCop

FxCop was originally designed for reusable libraries and has tended to fire many, many false positives against ASP.NET binaries. We've enabled code analysis for web apps in VS2005 Developer, however, and as part of that work we've made a significant pass through the rule set in order to eliminate noise. We completed a few outstanding work items just yesterday. The result is that the next version of FxCop (1.34) will return a much more focused result set when targeting Web Apps. This noise reduction will occur only on v2.0 of the framework, btw, due to our dependency on a new CLR attribute (GeneratedCodeAttribute) that helps identify wizard or otherwise auto-generated code.

There is only one rule in FxCop, currently, that was written with web apps in mind and it is the security check 'Review Sql queries for security vulnerabilities'. We hope to greatly increase our web app analysis capabilities in the next version of VS.

Michael Fanning
MS Development: VSTS Code Analysis/FxCop

MichaelFanning-MS at 2007-9-9 >

public List<String> DoQuery(string query)

SqlConnection someConnection = new SqlConnection(@"Data Source=.\sqlexpress;Initial Catalog=Werp;Integrated Security=True;Pooling=False");

SqlCommand someCommand = new SqlCommand();

someCommand.CommandText = "SELECT LastName FROM Employees " +

"WHERE FirstName='" + query + "' OR LastName ='" + query + '"';

SqlDataReader reader = someCommand.ExecuteReader();

List<String> result = new List<string>();

while (reader.Read())

return result;

BeerBong at 2007-9-9 >

Actually, I have installed fxCop from Windows Vista SDK February CTP.

I reinstalled fxCop taken from gotdotnet (RC1) and no, it doesn't catch vulnerability with generics inside.

Here the sample. SQL Injection rule fires up only for DoQuery method

public static class MyService

private static string connection = @"Data Source=.\sqlexpress;Initial Catalog=Werp;Integrated Security=True;Pooling=False";

public static string[] DoQuery(string query)

SqlConnection someConnection = new SqlConnection(connection);

SqlCommand someCommand = new SqlCommand();

someCommand.CommandText = "SELECT LastName FROM Employees " +

"WHERE FirstName='" + query + "'";

SqlDataReader reader = someCommand.ExecuteReader();

ArrayList result = new ArrayList();

while (reader.Read())

return (string[])result.ToArray(typeof(String));

public static List<String> DoQuery1(string query)

SqlConnection someConnection = new SqlConnection(connection);

SqlCommand someCommand = new SqlCommand();

someCommand.CommandText = "SELECT LastName FROM Employees " +

"WHERE FirstName='" + query + "'";

SqlDataReader reader = someCommand.ExecuteReader();

List<String> result = new List<string>();

while (reader.Read())

return result;

BeerBong at 2007-9-9 >