OWASP, vulnerabilities, and taint analysis in PVS-Studio for C#. Stir, but don’t shake

We continue to develop PVS-Studio as a SAST solution. Thus, one of our major goals is expanding OWASP coverage. You might ask, what’s the use when there’s no taint analysis? That’s exactly what we thought – and decided to implement taint analysis in the C# analyzer. Curious about what we accomplished? Read on!

Note. This article briefly touches upon the topics of SQL injections and working with SQL in C#. This theory serves as context. For in-depth information on these topics, do additional research.

Continue reading

Creating Roslyn API-based static analyzer for C#

After you read this article, you’ll have the knowledge to create your own static analyzer for C#. With the help of the analyzer, you can find potential errors and vulnerabilities in the source code of your own and other projects. Are you intrigued? Well, let’s get started.

Continue reading

XSS: attack, defense – and C# programming

XSS – or cross-site scripting – is one of the most common vulnerabilities in web applications. It has been on the OWASP Top 10 list (the list of the most critical security risks to web applications) for a while now. So let’s figure out together how your browser can acquire and execute a script from a third-party website, and what this may lead to (spoiler: your cookies could get stolen, for example). And while we’re at it, we’ll talk about ways you can protect yourself from XSS.

Continue reading

Optimization of .NET applications: a big result of small edits

Today we’re going to discuss how small optimizations in the right places of the application can improve its performance. Imagine: we remove the creation of an extra iterator in one place, get rid of boxing in the other. As a result, we get drastic improvements because of such small edits.

Continue reading

Enums in C#: hidden pitfalls

C# has low barriers to entry and forgives a lot. Seriously, you may not understand how things work under the hood but still write code and remain easy-going about this. Though you still have to deal with different nuances over time. Today, we’ll look at one of such subtle aspects – handling enumerations.

Continue reading

How WCF shoots itself in the foot with TraceSource

We don’t often get the chance to write something on parallel programming issues. This time we “got lucky”. The TraceEvent standard method has some implementation peculiarities. They resulted in an error with multiple threads blocking. So we’d like to warn users about this nuance and cover this interesting case from our users support practice. Why was our support involved? Keep reading to find out. Enjoy the reading!

Continue reading

Unity projects analysis: the solution file has two projects named “UnityEngine.UI”

While PVS-Studio analyses a Unity project, one may stumble upon such an error: Error was encountered while trying to open solution file ‘…’: The solution file has two projects named “UnityEngine.UI”. This note discusses the reasons for this error and how to eliminate it.

Continue reading