Skip to content

Commit 3fb9630

Browse files
lyndaidaiilyndaidaii
authored
Add roslyn analyzer and fix security warning issue (#8214)
* Add roslyn analyzer and fix security warning issue
1 parent 7f6dffb commit 3fb9630

29 files changed

Lines changed: 122 additions & 34 deletions

File tree

‎.editorconfig‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
[*.cs]
2+
3+
# Suppress performance, usage, naming, maintainability, style diagnostics.
4+
dotnet_analyzer_diagnostic.category-design.severity = none
5+
dotnet_analyzer_diagnostic.category-globalization.severity = none
6+
dotnet_analyzer_diagnostic.category-naming.severity = none
7+
dotnet_analyzer_diagnostic.category-performance.severity = none
8+
dotnet_analyzer_diagnostic.category-reliability.severity = none
9+
dotnet_analyzer_diagnostic.category-security.severity = warning
10+
dotnet_analyzer_diagnostic.category-usage.severity = none
11+
dotnet_analyzer_diagnostic.category-Maintainability.severity = none
12+
dotnet_analyzer_diagnostic.category-Style.severity = none
13+
14+
# Addtional suppress to be compatible with different version among VS2019
15+
16+
# CA1001: Types that own disposable fields should be disposable
17+
dotnet_diagnostic.CA1001.severity = none
18+
19+
# CA1063: Implement IDisposable Correctly
20+
dotnet_diagnostic.CA1063.severity = none
21+
22+
# CA1033: Interface methods should be callable by child types
23+
dotnet_diagnostic.CA1033.severity = none
24+
25+
# CA2229: Implement serialization constructors
26+
dotnet_diagnostic.CA2229.severity = none
27+
28+
# CA2200: Rethrow to preserve stack details.
29+
dotnet_diagnostic.CA2200.severity = none
30+
31+
# CA1065: Do not raise exceptions in unexpected locations
32+
dotnet_diagnostic.CA1065.severity = none
33+
34+
# CA2214: Do not call overridable methods in constructors
35+
dotnet_diagnostic.CA2214.severity = none

‎Directory.Build.props‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<Project>
2+
<ItemGroup>
3+
<PackageReference Include="Microsoft.CodeAnalysis.FxCopAnalyzers">
4+
<Version>3.3.0</Version>
5+
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
6+
<PrivateAssets>all</PrivateAssets>
7+
</PackageReference>
8+
</ItemGroup>
9+
</Project>

‎NuGetGallery.sln‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GitHubVulnerabilities2Db.Fa
5252
EndProject
5353
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "VerifyGitHubVulnerabilities", "src\VerifyGitHubVulnerabilities\VerifyGitHubVulnerabilities.csproj", "{C0B764D2-D376-439E-A5C4-1AC41B11E9DE}"
5454
EndProject
55+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{C643C106-D245-4F00-A486-146357812D8D}"
56+
ProjectSection(SolutionItems) = preProject
57+
.editorconfig = .editorconfig
58+
EndProjectSection
59+
EndProject
5560
Global
5661
GlobalSection(SolutionConfigurationPlatforms) = preSolution
5762
Debug|Any CPU = Debug|Any CPU

‎src/AccountDeleter/AccountDeleter.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@
8282
<Compile Include="AccountDeleteUserService.cs" />
8383
<Compile Include="Program.cs" />
8484
<Compile Include="Properties\AssemblyInfo.cs" />
85+
<Compile Include="Properties\AssemblyInfo.*.cs" />
8586
<Compile Include="Telemetry\IAccountDeleteTelemetryService.cs" />
8687
<Compile Include="Telemetry\AccountDeleteTelemetryService.cs" />
8788
</ItemGroup>

‎src/AccountDeleter/Properties/AssemblyInfo.cs‎

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,7 @@
2121
// The following GUID is for the ID of the typelib if this project is exposed to COM
2222
[assembly: Guid("8ee102b9-da4e-4fdf-b6fd-fb12e6584dd7")]
2323

24-
// Version information for an assembly consists of the following four values:
25-
//
26-
// Major Version
27-
// Minor Version
28-
// Build Number
29-
// Revision
30-
//
31-
// You can specify all the values or you can default the Build and Revision Numbers
32-
// by using the '*' as shown below:
33-
// [assembly: AssemblyVersion("1.0.*")]
34-
[assembly: AssemblyVersion("1.0.0.0")]
35-
[assembly: AssemblyFileVersion("1.0.0.0")]
24+
// The build will automatically inject the following attributes:
25+
// AssemblyVersion, AssemblyFileVersion, AssemblyInformationalVersion, AssemblyMetadata (for Branch, CommitId, and BuildDateUtc)
26+
27+
[assembly: AssemblyMetadata("RepositoryUrl", "https://www.github.com/NuGet/NuGetGallery")]

‎src/DatabaseMigrationTools/DatabaseMigrationTools.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@
4949
<Compile Include="MigrationContextFactory.cs" />
5050
<Compile Include="Program.cs" />
5151
<Compile Include="Properties\AssemblyInfo.cs" />
52+
<Compile Include="Properties\AssemblyInfo.*.cs" />
5253
<Compile Include="ValidationDbMigrationContext.cs" />
5354
</ItemGroup>
5455
<ItemGroup>

‎src/GitHubVulnerabilities2Db/GitHubVulnerabilities2Db.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@
7070
<Compile Include="Job.cs" />
7171
<Compile Include="Program.cs" />
7272
<Compile Include="Properties\AssemblyInfo.cs" />
73+
<Compile Include="Properties\AssemblyInfo.*.cs" />
7374
</ItemGroup>
7475
<ItemGroup>
7576
<None Include="App.config" />

‎src/NuGet.Services.Entities/NuGet.Services.Entities.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@
8484
<Compile Include="PackageVulnerability.cs" />
8585
<Compile Include="PackageVulnerabilitySeverity.cs" />
8686
<Compile Include="Properties\AssemblyInfo.cs" />
87+
<Compile Include="Properties\AssemblyInfo.*.cs" />
8788
<Compile Include="ReservedNamespace.cs" />
8889
<Compile Include="Role.cs" />
8990
<Compile Include="Scope.cs" />

‎src/NuGet.Services.Entities/Properties/AssemblyInfo.cs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
33

44
using System.Reflection;
5+
using System.Resources;
56
using System.Runtime.InteropServices;
67

78
[assembly: AssemblyTitle("NuGet.Services.Entities")]
@@ -10,4 +11,5 @@
1011
[assembly: Guid("6262f4fc-29be-4226-b676-db391c89d396")]
1112
[assembly: AssemblyDescription("Entities used for NuGet services")]
1213
[assembly: AssemblyCopyright("Copyright © .NET Foundation 2018")]
13-
[assembly: AssemblyCompany(".NET Foundation")]
14+
[assembly: AssemblyCompany(".NET Foundation")]
15+
[assembly: NeutralResourcesLanguage("en-US")]

‎src/NuGetGallery.Core/Certificates/CertificateFile.cs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,10 +63,11 @@ private static MemoryStream CopyAsReadOnly(Stream source)
6363
}
6464
}
6565

66-
[SuppressMessage("Microsoft.Security.Cryptography", "CA5354:SHA1CannotBeUsed", Justification = @"SHA1 thumbprint is only used to distinguish certificates in the Gallery view.")]
6766
private static string GetSha1Thumbprint(MemoryStream stream)
6867
{
68+
#pragma warning disable CA5350 // Do Not Use Weak Cryptographic Algorithms
6969
using (var hashAlgorithm = SHA1.Create())
70+
#pragma warning restore CA5350 // Do Not Use Weak Cryptographic Algorithms
7071
{
7172
return GetThumbprint(stream, hashAlgorithm);
7273
}

0 commit comments

Comments
 (0)