Skip to content

Commit 476279a

Browse files
ghogenghogen
committed
Merge branch 'master' of github.com:MicrosoftDocs/visualstudio-docs-pr into target-platforms
2 parents 28b084a + 9242546 commit 476279a

35 files changed

+588
-132
lines changed

‎.openpublishing.redirection.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2745,6 +2745,11 @@
27452745
"redirect_url": "/visualstudio/debugger/graphics/getting-started-with-visual-studio-graphics-diagnostics",
27462746
"redirect_document_id": false
27472747
},
2748+
{
2749+
"source_path": "docs/profiling/profiling-overview.md",
2750+
"redirect_url": "/visualstudio/profiling/profiling-feature-tour",
2751+
"redirect_document_id": false
2752+
},
27482753
{
27492754
"source_path": "docs/debugger/gpu-usage.md",
27502755
"redirect_url": "/visualstudio/profiling/gpu-usage",

‎docs/code-quality/ca1806.md

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,41 +33,58 @@ There are several possible reasons for this warning:
3333

3434
- A method that creates and returns a new string is called and the new string is never used.
3535

36-
- A COM or P/Invoke method that returns a HRESULT or error code that is never used. Rule Description
36+
- A COM or P/Invoke method that returns a HRESULT or error code that is never used.
37+
38+
- A LINQ method that returns a result that is never used.
39+
40+
## Rule description
3741

3842
Unnecessary object creation and the associated garbage collection of the unused object degrade performance.
3943

4044
Strings are immutable and methods such as String.ToUpper returns a new instance of a string instead of modifying the instance of the string in the calling method.
4145

4246
Ignoring HRESULT or error code can lead to unexpected behavior in error conditions or to low-resource conditions.
4347

48+
LINQ methods are known to not have side effects, and the result should not be ignored.
49+
4450
## How to fix violations
45-
If method A creates a new instance of B object that is never used, pass the instance as an argument to another method or assign the instance to a variable. If the object creation is unnecessary, remove the it.-or-
4651

47-
If method A calls method B, but does not use the new string instance that the method B returns. Pass the instance as an argument to another method, assign the instance to a variable. Or remove the call if it is unnecessary.
52+
If method A creates a new instance of B object that is never used, pass the instance as an argument to another method or assign the instance to a variable. If the object creation is unnecessary, remove the it.
53+
54+
-or-
55+
56+
If method A calls method B, but does not use the new string instance that the method B returns, pass the instance as an argument to another method, assign the instance to a variable. Or remove the call if it is unnecessary.
57+
58+
-or-
4859

49-
-or-
60+
If method A calls method B, but does not use the HRESULT or error code that the method returns, use the result in a conditional statement, assign the result to a variable, or pass it as an argument to another method.
5061

51-
If method A calls method B, but does not use the HRESULT or error code that the method returns. Use the result in a conditional statement, assign the result to a variable, or pass it as an argument to another method.
62+
-or-
63+
64+
If a LINQ method A calls method B, but does not use the result, use the result in a conditional statement, assign the result to a variable, or pass it as an argument to another method.
5265

5366
## When to suppress warnings
67+
5468
Do not suppress a warning from this rule unless the act of creating the object serves some purpose.
5569

5670
## Example
71+
5772
The following example shows a class that ignores the result of calling String.Trim.
5873

5974
[!code-csharp[FxCop.Usage.DoNotIgnoreMethodResults3#1](../code-quality/codesnippet/CSharp/ca1806-do-not-ignore-method-results_1.cs)]
6075
[!code-vb[FxCop.Usage.DoNotIgnoreMethodResults3#1](../code-quality/codesnippet/VisualBasic/ca1806-do-not-ignore-method-results_1.vb)]
6176
[!code-cpp[FxCop.Usage.DoNotIgnoreMethodResults3#1](../code-quality/codesnippet/CPP/ca1806-do-not-ignore-method-results_1.cpp)]
6277

6378
## Example
79+
6480
The following example fixes the previous violation by assigning the result of String.Trim back to the variable it was called on.
6581

6682
[!code-csharp[FxCop.Usage.DoNotIgnoreMethodResults4#1](../code-quality/codesnippet/CSharp/ca1806-do-not-ignore-method-results_2.cs)]
6783
[!code-vb[FxCop.Usage.DoNotIgnoreMethodResults4#1](../code-quality/codesnippet/VisualBasic/ca1806-do-not-ignore-method-results_2.vb)]
6884
[!code-cpp[FxCop.Usage.DoNotIgnoreMethodResults4#1](../code-quality/codesnippet/CPP/ca1806-do-not-ignore-method-results_2.cpp)]
6985

7086
## Example
87+
7188
The following example shows a method that does not use an object that it creates.
7289

7390
> [!NOTE]
@@ -77,6 +94,7 @@ The following example shows a method that does not use an object that it creates
7794
[!code-csharp[FxCop.Usage.DoNotIgnoreMethodResults5#1](../code-quality/codesnippet/CSharp/ca1806-do-not-ignore-method-results_3.cs)]
7895

7996
## Example
97+
8098
The following example fixes the previous violation by removing the unnecessary creation of an object.
8199

82100
[!code-csharp[FxCop.Usage.DoNotIgnoreMethodResults6#1](../code-quality/codesnippet/CSharp/ca1806-do-not-ignore-method-results_4.cs)]

‎docs/code-quality/ca2002.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,9 @@ To fix a violation of this rule, use an object from a type that is not in the li
6161

6262
## When to suppress warnings
6363

64-
Do not suppress a warning from this rule.
64+
It is safe to suppress the warning if the locked object is `this` or `Me` and the visibility of the self object type is private or internal, and the instance is not accessible using any public reference.
65+
66+
Otherwise, do not suppress a warning from this rule.
6567

6668
## Related rules
6769

‎docs/code-quality/ca2013.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
title: "ca2013: Do not use ReferenceEquals with value types"
3+
ms.date: 05/27/2020
4+
ms.topic: reference
5+
f1_keywords:
6+
- "DoNotUseReferenceEqualsWithValueTypes"
7+
- "CA2013"
8+
helpviewer_keywords:
9+
- "DoNotUseReferenceEqualsWithValueTypes"
10+
- "CA2013"
11+
author: buyaa-n
12+
ms.author: bunamnan
13+
manager: jeffhand
14+
ms.workload:
15+
- "multiple"
16+
---
17+
# CA2013: Do not use ReferenceEquals with value types
18+
19+
|||
20+
|-|-|
21+
|CheckId|CA2013|
22+
|Category|Microsoft.Reliability|
23+
|Breaking change|Non-breaking|
24+
25+
## Cause
26+
27+
Using <xref:System.Object.ReferenceEquals%2A?displayProperty=fullName> method to test one or more value types for equality.
28+
29+
## Rule description
30+
31+
When comparing values using <xref:System.Object.ReferenceEquals%2A>, if objA and objB are value types, they are boxed before they are passed to the <xref:System.Object.ReferenceEquals%2A> method. This means that even if both objA and objB represent the same instance of a value type, the <xref:System.Object.ReferenceEquals%2A> method nevertheless returns false, as the following example shows.
32+
33+
## How to fix violations
34+
35+
To fix the violation, replace it with a more appropriate equality check such as `==`.
36+
37+
```csharp
38+
39+
int int1 = 1, int2 = 1;
40+
41+
// Violation occurs, returns false.
42+
Console.WriteLine(Object.ReferenceEquals(int1, int2)); // false
43+
44+
// Use appropriate equality operator or method instead
45+
Console.WriteLine(int1 == int2); // true
46+
Console.WriteLine(Object.Equals(int1, int2)); // true
47+
```
48+
49+
## When to suppress warnings
50+
51+
It is NOT safe to suppress a warning from this rule, we recommend using the more appropriate equality operator such as `==`.
52+
53+
## Related rules
54+
55+
- [CA2231: Overload operator equals on overriding ValueType.Equals](CA2231.md)
56+
- [CA2224: Override equals on overloading operator equals](../code-quality/ca2224.md)
57+
- [CA2218: Override GetHashCode on overriding Equals](../code-quality/ca2218.md)
58+
59+
## See also
60+
61+
- [Reliability warnings](../code-quality/reliability-warnings.md)

‎docs/code-quality/ca5360.md

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
title: "CA5360: Do not call dangerous methods in deserialization"
3+
description: Provides information about code analysis rule CA5360, including causes, how to fix violations, and when to suppress it.
4+
ms.date: 05/27/2020
5+
ms.topic: reference
6+
author: LLLXXXCCC
7+
ms.author: linche
8+
manager: jillfra
9+
ms.workload:
10+
- "multiple"
11+
f1_keywords:
12+
- "CA5360"
13+
- "DoNotCallDangerousMethodsInDeserialization"
14+
---
15+
# CA5360: Do not call dangerous methods in deserialization
16+
17+
|||
18+
|-|-|
19+
|CheckId|CA5360|
20+
|Category|Microsoft.Security|
21+
|Breaking change|Non-breaking|
22+
23+
## Cause
24+
25+
Calling one of the following dangerous methods in deserialization:
26+
- <xref:System.IO.Directory.Delete%2A?displayProperty=fullName>
27+
- <xref:System.IO.DirectoryInfo.Delete%2A?displayProperty=fullName>
28+
- <xref:System.IO.File.AppendAllLines%2A?displayProperty=fullName>
29+
- <xref:System.IO.File.AppendAllText%2A?displayProperty=fullName>
30+
- <xref:System.IO.File.AppendText%2A?displayProperty=fullName>
31+
- <xref:System.IO.File.Copy%2A?displayProperty=fullName>
32+
- <xref:System.IO.File.Delete%2A?displayProperty=fullName>
33+
- <xref:System.IO.File.WriteAllBytes%2A?displayProperty=fullName>
34+
- <xref:System.IO.File.WriteAllLines%2A?displayProperty=fullName>
35+
- <xref:System.IO.File.WriteAllText%2A?displayProperty=fullName>
36+
- <xref:System.IO.FileInfo.Delete%2A?displayProperty=fullName>
37+
- <xref:System.IO.Log.LogStore.Delete%2A?displayProperty=fullName>
38+
- <xref:System.Reflection.Assembly.GetLoadedModules%2A?displayProperty=fullName>
39+
- <xref:System.Reflection.Assembly.Load%2A?displayProperty=fullName>
40+
- <xref:System.Reflection.Assembly.LoadFrom%2A?displayProperty=fullName>
41+
- <xref:System.Reflection.Assembly.LoadFile%2A?displayProperty=fullName>
42+
- <xref:System.Reflection.Assembly.LoadModule%2A?displayProperty=fullName>
43+
- <xref:System.Reflection.Assembly.LoadWithPartialName%2A?displayProperty=fullName>
44+
- <xref:System.Reflection.Assembly.ReflectionOnlyLoad%2A?displayProperty=fullName>
45+
- <xref:System.Reflection.Assembly.ReflectionOnlyLoadFrom%2A?displayProperty=fullName>
46+
- <xref:System.Reflection.Assembly.UnsafeLoadFrom%2A?displayProperty=fullName>
47+
48+
All methods meets one of the following requirements could be the callback of deserialization:
49+
- Marked with <xref:System.Runtime.Serialization.OnDeserializingAttribute?displayProperty=fullName>.
50+
- Marked with <xref:System.Runtime.Serialization.OnDeserializedAttribute?displayProperty=fullName>.
51+
- Implementing <xref:System.Runtime.Serialization.IDeserializationCallback.OnDeserialization%2A?displayProperty=fullName>.
52+
- Implementing <xref:System.IDisposable.Dispose%2A?displayProperty=fullName>.
53+
- Is a destructor.
54+
55+
## Rule description
56+
57+
Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application, inflict a Denial-of-Service (DoS) attack, or even execute arbitrary code upon it being deserialized. It's frequently possible for malicious users to abuse these deserialization features when the application is deserializing untrusted data which is under their control. Specifically, invoke dangerous methods in the process of deserialization. Successful insecure deserialization attacks could allow an attacker to carry out attacks such as DoS attacks, authentication bypasses, and remote code execution.
58+
59+
## How to fix violations
60+
61+
Remove these dangerous methods from automatically run deserialization callbacks. Call dangerous methods only after validating the input.
62+
63+
## When to suppress warnings
64+
65+
It's safe to suppress this rule if:
66+
- You know the input is trusted. Consider that your application's trust boundary and data flows may change over time.
67+
- The serialized data is tamper-proof. After serialization, cryptographically sign the serialized data. Before deserialization, validate the cryptographic signature. Protect the cryptographic key from being disclosed and design for key rotations.
68+
- The data is validated as safe to the application.
69+
70+
## Pseudo-code examples
71+
72+
### Violation
73+
74+
```csharp
75+
using System;
76+
using System.IO;
77+
using System.Runtime.Serialization;
78+
79+
[Serializable()]
80+
public class ExampleClass : IDeserializationCallback
81+
{
82+
private string member;
83+
84+
void IDeserializationCallback.OnDeserialization(Object sender)
85+
{
86+
var sourceFileName = "malicious file";
87+
var destFileName = "sensitive file";
88+
File.Copy(sourceFileName, destFileName);
89+
}
90+
}
91+
```
92+
93+
### Solution
94+
95+
```csharp
96+
using System;
97+
using System.IO;
98+
using System.Runtime.Serialization;
99+
100+
[Serializable()]
101+
public class ExampleClass : IDeserializationCallback
102+
{
103+
private string member;
104+
105+
void IDeserializationCallback.OnDeserialization(Object sender)
106+
{
107+
var sourceFileName = "malicious file";
108+
var destFileName = "sensitive file";
109+
// Remove the potential dangerous operation.
110+
// File.Copy(sourceFileName, destFileName);
111+
}
112+
}
113+
```

‎docs/code-quality/code-analysis-warnings-for-managed-code-by-checkid.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,7 @@ f1_keywords:
177177
- CA2007
178178
- CA2009
179179
- CA2011
180+
- CA2013
180181
- CA2015
181182
- CA2100
182183
- CA2101
@@ -449,6 +450,7 @@ The following table lists Code Analysis warnings for managed code by the CheckId
449450
| CA2007 | [CA2007: Do not directly await a Task](ca2007.md) | An asynchronous method [awaits](/dotnet/csharp/language-reference/keywords/await) a <xref:System.Threading.Tasks.Task> directly. When an asynchronous method awaits a <xref:System.Threading.Tasks.Task> directly, continuation occurs in the same thread that created the task. This behavior can be costly in terms of performance and can result in a deadlock on the UI thread. Consider calling <xref:System.Threading.Tasks.Task.ConfigureAwait(System.Boolean)?displayProperty=nameWithType> to signal your intention for continuation. |
450451
| CA2009 | [CA2009: Do not call ToImmutableCollection on an ImmutableCollection value](ca2009.md) | `ToImmutable` method was unnecessarily called on an immutable collection from <xref:System.Collections.Immutable> namespace. |
451452
| CA2011 | [CA2011: Do not assign property within its setter](ca2011.md) | A property was accidentally assigned a value within its own [set accessor](/dotnet/csharp/programming-guide/classes-and-structs/using-properties#the-set-accessor). |
453+
| CA2013 | [CA2013: Do not use ReferenceEquals with value types](ca2013.md) | When comparing values using <xref:System.Object.ReferenceEquals%2A?displayProperty=fullName>, if objA and objB are value types, they are boxed before they are passed to the <xref:System.Object.ReferenceEquals%2A> method. This means that even if both objA and objB represent the same instance of a value type, the <xref:System.Object.ReferenceEquals%2A> method nevertheless returns false. |
452454
| CA2015 | [CA2015: Do not define finalizers for types derived from MemoryManager&lt;T&gt;](ca2015.md) | Adding a finalizer to a type derived from <xref:System.Buffers.MemoryManager%601> may permit memory to be freed while it is still in use by a <xref:System.Span%601>. |
453455
| CA2100 | [CA2100: Review SQL queries for security vulnerabilities](../code-quality/ca2100.md) | A method sets the System.Data.IDbCommand.CommandText property by using a string that is built from a string argument to the method. This rule assumes that the string argument contains user input. A SQL command string that is built from user input is vulnerable to SQL injection attacks. |
454456
| CA2101 |[CA2101: Specify marshaling for P/Invoke string arguments](../code-quality/ca2101.md) | A platform invoke member allows partially trusted callers, has a string parameter, and does not explicitly marshal the string. This can cause a potential security vulnerability. |
@@ -543,6 +545,7 @@ The following table lists Code Analysis warnings for managed code by the CheckId
543545
| CA2246 | [CA2246: Do not assign a symbol and its member in the same statement](../code-quality/ca2246.md) | Assigning a symbol and its member, that is, a field or a property, in the same statement is not recommended. It is not clear if the member access was intended to use the symbol's old value prior to the assignment or the new value from the assignment in this statement. |
544546
| CA5122 | [CA5122 P/Invoke declarations should not be safe critical](../code-quality/ca5122.md) | Methods are marked as SecuritySafeCritical when they perform a security sensitive operation, but are also safe to be used by transparent code. Transparent code may never directly call native code through a P/Invoke. Therefore, marking a P/Invoke as security safe critical will not enable transparent code to call it, and is misleading for security analysis. |
545547
| CA5359 | [CA5359 Do not disable certificate validation](../code-quality/ca5359.md) | A certificate can help authenticate the identity of the server. Clients should validate the server certificate to ensure requests are sent to the intended server. If the ServerCertificateValidationCallback always returns `true`, any certificate will pass validation. |
548+
| CA5360 | [CA5360 Do not call dangerous methods in deserialization](../code-quality/ca5360.md) | Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application, inflict a Denial-of-Service (DoS) attack, or even execute arbitrary code upon it being deserialized. It's frequently possible for malicious users to abuse these deserialization features when the application is deserializing untrusted data which is under their control. Specifically, invoke dangerous methods in the process of deserialization. Successful insecure deserialization attacks could allow an attacker to carry out attacks such as DoS attacks, authentication bypasses, and remote code execution. |
546549
| CA5362 | [CA5362 Potential reference cycle in deserialized object graph](../code-quality/ca5362.md) | If deserializing untrusted data, then any code processing the deserialized object graph needs to handle reference cycles without going into infinite loops. This includes both code that's part of a deserialization callback and code that processes the object graph after deserialization completed. Otherwise, an attacker could perform a Denial-of-Service attack with malicious data containing a reference cycle. |
547550
| CA5365 | [CA5365 Do Not Disable HTTP Header Checking](../code-quality/ca5365.md) | HTTP header checking enables encoding of the carriage return and newline characters, \r and \n, that are found in response headers. This encoding can help to avoid injection attacks that exploit an application that echoes untrusted data contained by the header. |
548551
| CA5366 | [CA5366 Use XmlReader For DataSet Read XML](../code-quality/ca5366.md) | Using a <xref:System.Data.DataSet> to read XML with untrusted data may load dangerous external references, which should be restricted by using an <xref:System.Xml.XmlReader> with a secure resolver or with DTD processing disabled. |

‎docs/code-quality/reliability-warnings.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,5 @@ Reliability warnings support library and application reliability, such as correc
3030
|[CA2007: Do not directly await a Task](../code-quality/ca2007.md)|An asynchronous method [awaits](/dotnet/csharp/language-reference/keywords/await) a <xref:System.Threading.Tasks.Task> directly.|
3131
|[CA2009: Do not call ToImmutableCollection on an ImmutableCollection value](../code-quality/ca2009.md)|`ToImmutable` method was unnecessarily called on an immutable collection from <xref:System.Collections.Immutable> namespace.|
3232
|[CA2011: Do not assign property within its setter](../code-quality/ca2011.md) | A property was accidentally assigned a value within its own [set accessor](/dotnet/csharp/programming-guide/classes-and-structs/using-properties#the-set-accessor). |
33+
|[CA2013: Do not use ReferenceEquals with value types](../code-quality/ca2013.md) | When comparing values using <xref:System.Object.ReferenceEquals%2A?displayProperty=fullName>, if objA and objB are value types, they are boxed before they are passed to the <xref:System.Object.ReferenceEquals%2A> method. This means that even if both objA and objB represent the same instance of a value type, the <xref:System.Object.ReferenceEquals%2A> method nevertheless returns false. |
3334
|[CA2015: Do not define finalizers for types derived from MemoryManager&lt;T&gt;](../code-quality/ca2015.md) | Adding a finalizer to a type derived from <xref:System.Buffers.MemoryManager%601> may permit memory to be freed while it is still in use by a <xref:System.Span%601>. |

0 commit comments

Comments
 (0)