diff --git a/.editorconfig b/.editorconfig index 17cf350b4..260613982 100644 --- a/.editorconfig +++ b/.editorconfig @@ -7,6 +7,8 @@ root = true # Default settings ############################################# [*] +charset = utf-8 +end_of_line = lf insert_final_newline = true indent_style = space indent_size = 4 @@ -182,25 +184,26 @@ csharp_space_between_square_brackets = false dotnet_diagnostic.AvoidAsyncVoid.severity = suggestion ################### -# Microsoft .NET Analyzers (CA) - Design Rules +# Microsoft.CodeAnalysis.NetAnalyzers (CA) ################### +# Design dotnet_diagnostic.CA1000.severity = none # Do not declare static members on generic types — common factory pattern dotnet_diagnostic.CA1001.severity = error # Types that own disposable fields should be disposable dotnet_diagnostic.CA1002.severity = none # Do not expose generic lists — we deliberately expose List; interface-based collections are an older convention we don't follow -dotnet_diagnostic.CA1003.severity = error # Use generic event handler instances +dotnet_diagnostic.CA1003.severity = none # Use generic event handler instances — covered by SST2304 dotnet_diagnostic.CA1005.severity = none # Avoid excessive parameters on generic types — we deliberately expose 3+ type-parameter types (tuple-style handles, raw engine signals); the ergonomic guidance conflicts with that design dotnet_diagnostic.CA1008.severity = error # Enums should have zero value dotnet_diagnostic.CA1010.severity = none # Collections should implement generic interface — we deliberately expose concrete collection types; interface-based collections are an older convention we don't follow -dotnet_diagnostic.CA1012.severity = error # Abstract types should not have public constructors +dotnet_diagnostic.CA1012.severity = none # Abstract types should not have public constructors — covered by SST1428 dotnet_diagnostic.CA1014.severity = none # Mark assemblies with CLSCompliantAttribute — we don't ship CLS-compliant assemblies dotnet_diagnostic.CA1016.severity = error # Mark assemblies with AssemblyVersionAttribute dotnet_diagnostic.CA1017.severity = none # Mark assemblies with ComVisibleAttribute — we don't ship COM-visible assemblies dotnet_diagnostic.CA1018.severity = error # Mark attributes with AttributeUsageAttribute -dotnet_diagnostic.CA1019.severity = error # Define accessors for attribute arguments +dotnet_diagnostic.CA1019.severity = none # Define accessors for attribute arguments — conflicts with SST2324, which caps an internal attribute's accessor at internal dotnet_diagnostic.CA1021.severity = none # Avoid out parameters - disabled - needed for the zero-allocation idiom in Try/Find APIs and other performance-critical paths dotnet_diagnostic.CA1024.severity = error # Use properties where appropriate dotnet_diagnostic.CA1027.severity = error # Mark enums with FlagsAttribute -dotnet_diagnostic.CA1028.severity = error # Enum storage should be Int32 +dotnet_diagnostic.CA1028.severity = none # Enum storage should be Int32 — covered by SST2313 dotnet_diagnostic.CA1030.severity = none # Use events where appropriate — we use Rx observables instead of CLR events dotnet_diagnostic.CA1031.severity = none # Do not catch general exception types — required at logging/dispose/IO boundaries dotnet_diagnostic.CA1032.severity = none # Implement standard exception constructors — covered by SST1488 @@ -215,17 +218,17 @@ dotnet_diagnostic.CA1045.severity = none # Do not pass types by reference — we dotnet_diagnostic.CA1046.severity = error # Do not overload operator equals on reference types dotnet_diagnostic.CA1047.severity = none # Do not declare protected member in sealed type — covered by SST1427 dotnet_diagnostic.CA1048.severity = none # Do not declare virtual members in sealed types — covered by SST1491 -dotnet_diagnostic.CA1050.severity = error # Declare types in namespaces +dotnet_diagnostic.CA1050.severity = none # Declare types in namespaces — covered by SST2312 dotnet_diagnostic.CA1051.severity = none # Duplicate of SST1401 (canonical) — do not declare visible instance fields -dotnet_diagnostic.CA1052.severity = error # Static holder types should be sealed -dotnet_diagnostic.CA1053.severity = error # Static holder types should not have constructors +dotnet_diagnostic.CA1052.severity = none # Static holder types should be sealed — covered by SST1432 +dotnet_diagnostic.CA1053.severity = none # Static holder types should not have constructors — covered by SST1432 dotnet_diagnostic.CA1054.severity = suggestion # URI parameters should not be strings dotnet_diagnostic.CA1055.severity = suggestion # URI return values should not be strings dotnet_diagnostic.CA1056.severity = suggestion # URI properties should not be strings dotnet_diagnostic.CA1058.severity = error # Types should not extend certain base types dotnet_diagnostic.CA1059.severity = error # Members should not expose certain concrete types dotnet_diagnostic.CA1060.severity = error # Move P/Invokes to NativeMethods class -dotnet_diagnostic.CA1061.severity = error # Do not hide base class methods +dotnet_diagnostic.CA1061.severity = none # Do not hide base class methods — covered by SST2427 dotnet_diagnostic.CA1062.severity = none # Validate arguments of public methods - Nullable=enable + we own every consumer, so the compiler already guarantees non-null params dotnet_diagnostic.CA1063.severity = none # Implement IDisposable correctly — covered by SST2300 dotnet_diagnostic.CA1064.severity = error # Exceptions should be public @@ -236,45 +239,37 @@ dotnet_diagnostic.CA1068.severity = error # CancellationToken parameters must co dotnet_diagnostic.CA1069.severity = error # Enums should not have duplicate values dotnet_diagnostic.CA1070.severity = error # Do not declare event fields as virtual -################### -# Microsoft .NET Analyzers (CA) - Globalization Rules -################### +# Globalization dotnet_diagnostic.CA1303.severity = none # Do not pass literals as localized parameters — we don't ship localized resources +dotnet_diagnostic.CA1307.severity = none # Covered by PSH1207 (canonical) dotnet_diagnostic.CA1308.severity = none # Normalize strings to uppercase — ToLowerInvariant is correct for filesystem path / cache key normalization +dotnet_diagnostic.CA1310.severity = none # Covered by PSH1207 (canonical) -################### -# Microsoft .NET Analyzers (CA) - Interoperability Rules -################### +# Interoperability dotnet_diagnostic.CA1401.severity = error # P/Invokes should not be visible -################### -# Microsoft .NET Analyzers (CA) - Maintainability Rules -################### +# Maintainability dotnet_diagnostic.CA1500.severity = none # Variable names should not match field names — covered by SST1484 -dotnet_diagnostic.CA1501.severity = none # Avoid excessive inheritance — disabled because the analyzer noticeably slows down the build -dotnet_diagnostic.CA1502.severity = none # Avoid excessive complexity — disabled because the analyzer noticeably slows down the build +dotnet_diagnostic.CA1501.severity = none # Covered by SST1446 (canonical) +dotnet_diagnostic.CA1502.severity = none # Covered by SST1442 (canonical) dotnet_diagnostic.CA1505.severity = error # Avoid unmaintainable code dotnet_diagnostic.CA1506.severity = none # Avoid excessive class coupling — adds little signal here, mostly trips on legitimate orchestration code dotnet_diagnostic.CA1507.severity = none # Use nameof in place of string — covered by SST1463 dotnet_diagnostic.CA1508.severity = error # Avoid dead conditional code dotnet_diagnostic.CA1509.severity = error # Invalid entry in code metrics configuration file -dotnet_diagnostic.CA1510.severity = none # Use ArgumentNullException throw helper — disabled because we target older TFMs and use ArgumentExceptionHelper for cross-platform parity -dotnet_diagnostic.CA1511.severity = none # Use ArgumentException throw helper — disabled because we target older TFMs and use ArgumentExceptionHelper for cross-platform parity -dotnet_diagnostic.CA1512.severity = none # Use ArgumentOutOfRangeException throw helper — disabled because we target older TFMs and use ArgumentExceptionHelper for cross-platform parity -dotnet_diagnostic.CA1513.severity = none # Use ObjectDisposedException throw helper — disabled because we target older TFMs and use ArgumentExceptionHelper for cross-platform parity -dotnet_diagnostic.CA1514.severity = error # Avoid redundant length argument +dotnet_diagnostic.CA1510.severity = none # Covered by PSH1409 (canonical) +dotnet_diagnostic.CA1511.severity = none # Covered by PSH1409 (canonical) +dotnet_diagnostic.CA1512.severity = none # Covered by PSH1409 (canonical) +dotnet_diagnostic.CA1513.severity = none # Covered by PSH1409 (canonical) +dotnet_diagnostic.CA1514.severity = none # Avoid redundant length argument — covered by PSH1220 dotnet_diagnostic.CA1515.severity = none # Consider making public types internal — interferes with tests and reflection-discovered types (BenchmarkDotNet, TUnit, etc.) dotnet_diagnostic.CA1516.severity = error # Use cross-platform intrinsics -################### -# Microsoft .NET Analyzers (CA) - Naming Rules -################### +# Naming dotnet_diagnostic.CA1710.severity = suggestion # Identifiers should have correct suffix dotnet_diagnostic.CA1724.severity = none # Type Names Should Not Match Namespaces — namespace/type name overlap is intentional API surface -################### -# Microsoft .NET Analyzers (CA) - Performance Rules -################### +# Performance dotnet_diagnostic.CA1802.severity = none # Use literals where appropriate — covered by PSH1402 dotnet_diagnostic.CA1805.severity = none # Do not initialize unnecessarily — covered by PSH1403 dotnet_diagnostic.CA1806.severity = error # Do not ignore method results @@ -286,18 +281,18 @@ dotnet_diagnostic.CA1815.severity = none # Override equals and operator equals o dotnet_diagnostic.CA1819.severity = none # Properties should not return arrays — incompatible with the RxUI/sqlite-net mapping style we use throughout the codebase dotnet_diagnostic.CA1820.severity = none # Test for empty strings using string length — covered by PSH1204 dotnet_diagnostic.CA1821.severity = none # Remove empty finalizers — covered by PSH1002 -dotnet_diagnostic.CA1822.severity = error # Mark members as static +dotnet_diagnostic.CA1822.severity = none # Mark members as static — covered by PSH1414 dotnet_diagnostic.CA1823.severity = none # Avoid unused private fields — covered by SST1441 dotnet_diagnostic.CA1824.severity = error # Mark assemblies with NeutralResourcesLanguageAttribute dotnet_diagnostic.CA1825.severity = none # Avoid zero-length array allocations — covered by PSH1001 dotnet_diagnostic.CA1826.severity = none # Use property instead of Linq Enumerable method — covered by PSH1103 dotnet_diagnostic.CA1827.severity = none # Do not use Count/LongCount when Any can be used — covered by PSH1119 -dotnet_diagnostic.CA1828.severity = error # Do not use CountAsync/LongCountAsync when AnyAsync can be used +dotnet_diagnostic.CA1828.severity = none # Do not use CountAsync/LongCountAsync when AnyAsync can be used — covered by PSH1126 dotnet_diagnostic.CA1829.severity = none # Use Length/Count property instead of Enumerable.Count — covered by PSH1103 dotnet_diagnostic.CA1830.severity = none # Prefer strongly-typed Append/Insert overloads on StringBuilder — covered by PSH1202 dotnet_diagnostic.CA1831.severity = none # Use AsSpan instead of Range-based indexers for string — covered by PSH1212 dotnet_diagnostic.CA1832.severity = none # Use AsSpan or AsMemory instead of Range-based indexers for getting ReadOnlySpan or ReadOnlyMemory portion of an array — covered by PSH1019 -dotnet_diagnostic.CA1833.severity = error # Use AsSpan or AsMemory instead of Range-based indexers for getting Span or Memory portion of an array +dotnet_diagnostic.CA1833.severity = none # Use AsSpan or AsMemory instead of Range-based indexers for getting Span or Memory portion of an array — conflicts with PSH1019, which owns the array range-indexer rewrite and refuses it for mutable Span/Memory targets dotnet_diagnostic.CA1834.severity = none # Use StringBuilder.Append(char) for single character strings — covered by PSH1202 dotnet_diagnostic.CA1835.severity = none # Prefer the memory-based overloads of ReadAsync/WriteAsync methods in stream-based classes — covered by PSH1314 dotnet_diagnostic.CA1836.severity = none # Prefer IsEmpty over Count when available — covered by PSH1117 @@ -309,9 +304,9 @@ dotnet_diagnostic.CA1841.severity = none # Prefer Dictionary.Contains methods dotnet_diagnostic.CA1842.severity = none # Do not use 'WhenAll' with a single task — covered by PSH1301 dotnet_diagnostic.CA1843.severity = none # Do not use 'WaitAll' with a single task — covered by PSH1301 dotnet_diagnostic.CA1844.severity = error # Provide memory-based overrides of async methods when subclassing 'Stream' -dotnet_diagnostic.CA1845.severity = error # Use span-based 'string.Concat' +dotnet_diagnostic.CA1845.severity = none # Use span-based 'string.Concat' — covered by PSH1222 dotnet_diagnostic.CA1846.severity = none # Prefer AsSpan over Substring — covered by PSH1212 -dotnet_diagnostic.CA1847.severity = none # Use char literal for a single character lookup — disabled because the string.Contains(char) overload doesn't exist on .NET Framework / netstandard2.0 and we target both +dotnet_diagnostic.CA1847.severity = none # Covered by PSH1201 (canonical) dotnet_diagnostic.CA1848.severity = error # Use the LoggerMessage delegates dotnet_diagnostic.CA1849.severity = none # Call async methods when in an async method — covered by PSH1313 dotnet_diagnostic.CA1850.severity = none # Prefer static HashData method over ComputeHash — covered by PSH1400 @@ -323,29 +318,27 @@ dotnet_diagnostic.CA1854.severity = none # Prefer the IDictionary.TryGetValue me dotnet_diagnostic.CA1855.severity = error # Prefer 'Clear' over 'Fill' dotnet_diagnostic.CA1856.severity = error # Incorrect usage of ConstantExpected attribute dotnet_diagnostic.CA1857.severity = error # A constant is expected for the parameter -dotnet_diagnostic.CA1858.severity = error # Use 'StartsWith' instead of 'IndexOf' +dotnet_diagnostic.CA1858.severity = none # Use 'StartsWith' instead of 'IndexOf' — covered by PSH1221 dotnet_diagnostic.CA1859.severity = error # Use concrete types when possible for improved performance dotnet_diagnostic.CA1860.severity = none # Avoid using 'Enumerable.Any()' extension method — covered by PSH1103 dotnet_diagnostic.CA1861.severity = none # Avoid constant arrays as arguments — covered by PSH1004 dotnet_diagnostic.CA1862.severity = none # Use the 'StringComparison' overloads for case-insensitive comparisons — covered by PSH1200 -dotnet_diagnostic.CA1863.severity = error # Use 'CompositeFormat' +dotnet_diagnostic.CA1863.severity = none # Use 'CompositeFormat' — covered by PSH1223 dotnet_diagnostic.CA1864.severity = none # Prefer the 'IDictionary.TryAdd' method — covered by PSH1115 -dotnet_diagnostic.CA1865.severity = none # Use char overload (string.StartsWith) — disabled because the string.StartsWith(char) overload doesn't exist on .NET Framework / netstandard2.0 and we target both -dotnet_diagnostic.CA1866.severity = none # Use char overload (string.EndsWith) — disabled because the string.EndsWith(char) overload doesn't exist on .NET Framework / netstandard2.0 and we target both -dotnet_diagnostic.CA1867.severity = none # Use char overload (string.IndexOf / string.LastIndexOf) — disabled because the char overloads don't exist on .NET Framework / netstandard2.0 and we target both +dotnet_diagnostic.CA1865.severity = none # Covered by PSH1201 (canonical) +dotnet_diagnostic.CA1866.severity = none # Covered by PSH1201 (canonical) +dotnet_diagnostic.CA1867.severity = none # Covered by PSH1201 (canonical) dotnet_diagnostic.CA1868.severity = none # Unnecessary call to 'Contains' for sets — covered by PSH1105 dotnet_diagnostic.CA1869.severity = none # Cache and reuse 'JsonSerializerOptions' instances — covered by PSH1416 dotnet_diagnostic.CA1870.severity = none # Use a cached 'SearchValues' instance — covered by PSH1213 dotnet_diagnostic.CA1871.severity = error # Do not pass a nullable struct to 'ArgumentNullException.ThrowIfNull' dotnet_diagnostic.CA1872.severity = none # Prefer 'Convert.ToHexString' and 'Convert.ToHexStringLower' over call chains based on 'BitConverter.ToString' — covered by PSH1224 -dotnet_diagnostic.CA1873.severity = error # Avoid potentially expensive evaluation of arguments to 'Debug.Assert' +dotnet_diagnostic.CA1873.severity = none # Avoid potentially expensive evaluation of arguments to 'Debug.Assert' — covered by PSH1417 dotnet_diagnostic.CA1874.severity = none # Use 'Regex.IsMatch' — covered by PSH1406 dotnet_diagnostic.CA1875.severity = none # Use 'Regex.Count' — covered by PSH1406 -dotnet_diagnostic.CA1877.severity = error # Use 'Encoding.GetString' instead of 'Encoding.GetChars' +dotnet_diagnostic.CA1877.severity = none # Use 'Encoding.GetString' instead of 'Encoding.GetChars' — covered by PSH1225 -################### -# Microsoft .NET Analyzers (CA) - Reliability Rules -################### +# Reliability dotnet_diagnostic.CA2000.severity = suggestion # Dispose objects before losing scope dotnet_diagnostic.CA2002.severity = error # Do not lock on objects with weak identity dotnet_diagnostic.CA2007.severity = none # Do not directly await a Task — Rx and library callers drive synchronization context themselves @@ -368,41 +361,39 @@ dotnet_diagnostic.CA2024.severity = error # Do not use 'StreamReader.EndOfStream dotnet_diagnostic.CA2025.severity = error # Do not pass 'IDisposable' instances into unawaited tasks dotnet_diagnostic.CA2026.severity = error # Do not use methods or types annotated with [RequiresDynamicCode] in code that uses [RequiresDynamicCode] -################### -# Microsoft .NET Analyzers (CA) - Usage Rules -################### +# Usage dotnet_diagnostic.CA1801.severity = error # Review unused parameters dotnet_code_quality.CA1801.api_surface = private, internal # only flag non-public APIs so we don't break public signatures dotnet_diagnostic.CA1816.severity = error # Call GC.SuppressFinalize correctly -dotnet_diagnostic.CA2200.severity = error # Rethrow to preserve stack details +dotnet_diagnostic.CA2200.severity = none # Rethrow to preserve stack details — covered by SST1430 dotnet_diagnostic.CA2201.severity = error # Do not raise reserved exception types dotnet_diagnostic.CA2207.severity = error # Initialize value type static fields inline dotnet_diagnostic.CA2208.severity = none # Instantiate argument exceptions correctly — too sensitive: flags valid context-forwarding nameof(arg.Property) patterns dotnet_diagnostic.CA2211.severity = none # Non-constant fields should not be visible — covered by SST1499 dotnet_diagnostic.CA2213.severity = error # Disposable fields should be disposed -dotnet_diagnostic.CA2214.severity = error # Do not call overridable methods in constructors +dotnet_diagnostic.CA2214.severity = none # Do not call overridable methods in constructors — covered by SST1483 dotnet_diagnostic.CA2215.severity = error # Dispose methods should call base class dispose -dotnet_diagnostic.CA2216.severity = error # Disposable types should declare finalizer +dotnet_diagnostic.CA2216.severity = none # Disposable types should declare finalizer — conflicts with SST2317, which owns the owned-native-handle shape and prescribes a SafeHandle instead of a finalizer dotnet_diagnostic.CA2217.severity = none # Do not mark enums with FlagsAttribute — covered by SST2303 dotnet_diagnostic.CA2218.severity = error # Override GetHashCode on overriding Equals dotnet_diagnostic.CA2219.severity = error # Do not raise exceptions in finally clauses -dotnet_diagnostic.CA2224.severity = error # Override Equals on overloading operator equals +dotnet_diagnostic.CA2224.severity = none # Override Equals on overloading operator equals — covered by SST2302 dotnet_diagnostic.CA2225.severity = error # Operator overloads have named alternates dotnet_diagnostic.CA2226.severity = error # Operators should have symmetrical overloads dotnet_diagnostic.CA2227.severity = none # Collection properties should be read only — settable collection properties are common in our DTOs and config types dotnet_diagnostic.CA2231.severity = error # Overload operator equals on overriding ValueType.Equals dotnet_diagnostic.CA2234.severity = error # Pass System.Uri objects instead of strings dotnet_diagnostic.CA2241.severity = error # Provide correct arguments to formatting methods -dotnet_diagnostic.CA2242.severity = error # Test for NaN correctly +dotnet_diagnostic.CA2242.severity = none # Test for NaN correctly — covered by SST1473 dotnet_diagnostic.CA2243.severity = error # Attribute string literals should parse correctly dotnet_diagnostic.CA2244.severity = error # Do not duplicate indexed element initializations -dotnet_diagnostic.CA2245.severity = error # Do not assign a property to itself +dotnet_diagnostic.CA2245.severity = none # Do not assign a property to itself — covered by SST1189 dotnet_diagnostic.CA2246.severity = error # Do not assign a symbol and its member in the same statement dotnet_diagnostic.CA2247.severity = error # Argument passed to TaskCompletionSource constructor should be TaskCreationOptions enum dotnet_diagnostic.CA2248.severity = error # Provide correct enum argument to Enum.HasFlag dotnet_diagnostic.CA2249.severity = error # Use String.Contains instead of String.IndexOf for substring checks dotnet_diagnostic.CA2250.severity = error # Use ThrowIfCancellationRequested -dotnet_diagnostic.CA2251.severity = error # Use String.Equals over String.Compare +dotnet_diagnostic.CA2251.severity = none # Covered by PSH1216 (canonical) dotnet_diagnostic.CA2252.severity = error # Opt in to preview features before using them dotnet_diagnostic.CA2253.severity = error # Named placeholders should not be numeric values dotnet_diagnostic.CA2254.severity = error # Template should be a static expression @@ -423,9 +414,7 @@ dotnet_diagnostic.CA2268.severity = error # Use 'string.Equals(string, string, S # Skipped (deprecated ISerializable formatter): CA2229 Implement serialization constructors, # CA2235 Mark all non-serializable fields, CA2237 Mark ISerializable types with SerializableAttribute. -################### -# Microsoft .NET Analyzers (CA) - Security Rules -################### +# Security # SQL Injection & Command Injection dotnet_diagnostic.CA2100.severity = error # Review SQL queries for security vulnerabilities @@ -548,16 +537,9 @@ dotnet_diagnostic.CA2153.severity = error # Do not catch corrupted state excepti dotnet_diagnostic.CA5367.severity = error # Do not serialize types with pointer fields ################### -# SonarAnalyzer (Sxxxx) — global suppressions -################### -dotnet_diagnostic.S1075.severity = none # Hardcoded URI — canonical SourceLink hosts are the point -dotnet_diagnostic.S2436.severity = none # Too many generic parameters — needed for the projector overload -dotnet_diagnostic.S4036.severity = none # PATH-relative process spawn — benchmark only, trusted env -dotnet_diagnostic.S8969.severity = none # Null-forgiving operators preserve intent across target-framework nullable annotations - -################### -# Microsoft .NET Runtime Obsoletions (SYSLIB0xxx) +# Microsoft .NET SDK Diagnostics (SYSLIB) ################### +# Runtime obsoletions dotnet_diagnostic.SYSLIB0001.severity = error # The UTF-7 encoding is insecure and should not be used dotnet_diagnostic.SYSLIB0002.severity = error # PrincipalPermissionAttribute is not honored by the runtime and must not be used dotnet_diagnostic.SYSLIB0003.severity = error # Code Access Security (CAS) is not supported or honored by the runtime @@ -620,9 +602,7 @@ dotnet_diagnostic.SYSLIB0059.severity = error # SystemEvents.EventsThreadShutdow dotnet_diagnostic.SYSLIB0060.severity = error # Constructors of DirectoryServices.ActiveDirectory.ConfigurationContext are obsolete dotnet_diagnostic.SYSLIB0061.severity = error # CryptographyConfig.AddOID and AddAlgorithm methods are obsolete -################### -# Microsoft .NET Source Generator Diagnostics (SYSLIB1xxx) -################### +# Source generators # LoggerMessage source generator dotnet_diagnostic.SYSLIB1001.severity = error # Logging method names cannot start with _ dotnet_diagnostic.SYSLIB1002.severity = error # Don't include log level parameters as templates in the logging message @@ -710,8 +690,9 @@ dotnet_diagnostic.SYSLIB1103.severity = error # Configuration binding source gen dotnet_diagnostic.SYSLIB1104.severity = error # Configuration binding source generator: language version is too low ################### -# Microsoft .NET Style Rules (IDExxxx) - Language Rules +# Microsoft .NET Code Style Analyzers (IDE) ################### +# Language rules # EnforceCodeStyleInBuild=true (set in Directory.Build.props) promotes these # IDE rules into `dotnet build` so they fire at compile time, not just in the # IDE. We enable the ones that are unambiguous wins and skip the rules that @@ -738,11 +719,11 @@ dotnet_diagnostic.IDE0047.severity = none # Remove unnecessary parentheses — c dotnet_diagnostic.IDE0049.severity = none # Use language keywords instead of framework type names for type references — covered by SST1121 dotnet_diagnostic.IDE0057.severity = none # Use range operator — covered by SST2204 dotnet_diagnostic.IDE0059.severity = none # Remove unnecessary value assignment — covered by SST2222 -dotnet_diagnostic.IDE0064.severity = error # Make struct fields writable — flag readonly-but-mutable struct fields where intent diverges from declaration +dotnet_diagnostic.IDE0064.severity = none # Make struct fields writable — flag readonly-but-mutable struct fields where intent diverges from declaration dotnet_diagnostic.IDE0066.severity = none # Use switch expression — covered by SST2201 dotnet_diagnostic.IDE0075.severity = none # Simplify conditional expression — covered by SST1182 dotnet_diagnostic.IDE0078.severity = none # Use pattern matching — covered by SST2006/SST2231 -dotnet_diagnostic.IDE0084.severity = error # Use pattern matching ('IsNot' operator) +dotnet_diagnostic.IDE0084.severity = none # Use pattern matching ('IsNot' operator) dotnet_diagnostic.IDE0120.severity = none # Simplify LINQ expression — covered by PSH1100/PSH1101 dotnet_diagnostic.IDE0221.severity = none # Add explicit cast — covered by SST2226 dotnet_diagnostic.IDE0250.severity = none # Make struct 'readonly' — covered by PSH1014 @@ -776,9 +757,71 @@ dotnet_diagnostic.IDE0310.severity = none # Convert lambda expression to method dotnet_diagnostic.IDE0360.severity = none # Simplify property accessor — covered by SST2219 dotnet_diagnostic.IDE0370.severity = none # Remove unnecessary suppression (null-forgiving operator) — disabled for the same reason as RCS1249: multi-TFM nullability annotations can differ per platform -################### -# Microsoft .NET Style Rules (IDE1xxx / IDE3xxx) - Naming & Miscellaneous -################### +# Language and unnecessary code rules. +dotnet_diagnostic.IDE0001.severity = none # Simplify name +dotnet_diagnostic.IDE0003.severity = none # Name can be simplified +dotnet_diagnostic.IDE0005.severity = none # Remove unnecessary import +dotnet_diagnostic.IDE0010.severity = none # Add missing cases to switch statement +dotnet_diagnostic.IDE0011.severity = none # Add braces +dotnet_diagnostic.IDE0017.severity = none # Use object initializers +dotnet_diagnostic.IDE0018.severity = none # Inline variable declaration +dotnet_diagnostic.IDE0020.severity = none # Use pattern matching to avoid is check followed by a cast (with variable) +dotnet_diagnostic.IDE0027.severity = none # Use expression body for accessors +dotnet_diagnostic.IDE0029.severity = none # Null check can be simplified +dotnet_diagnostic.IDE0030.severity = none # Null check can be simplified +dotnet_diagnostic.IDE0032.severity = none # Use auto property +dotnet_diagnostic.IDE0033.severity = none # Use explicitly provided tuple name +dotnet_diagnostic.IDE0034.severity = none # Simplify default expression +dotnet_diagnostic.IDE0036.severity = none # Order modifiers +dotnet_diagnostic.IDE0037.severity = none # Use inferred member name +dotnet_diagnostic.IDE0039.severity = none # Use local function instead of lambda +dotnet_diagnostic.IDE0040.severity = none # Add accessibility modifiers +dotnet_diagnostic.IDE0045.severity = none # Use conditional expression for assignment +dotnet_diagnostic.IDE0046.severity = none # Use conditional expression for return +dotnet_diagnostic.IDE0051.severity = none # Remove unused private member +dotnet_diagnostic.IDE0053.severity = none # Use expression body for lambdas +dotnet_diagnostic.IDE0054.severity = none # Use compound assignment +dotnet_diagnostic.IDE0056.severity = none # Use index operator +dotnet_diagnostic.IDE0062.severity = none # Make local function static +dotnet_diagnostic.IDE0063.severity = none # Use simple using statement +dotnet_diagnostic.IDE0065.severity = none # Using directive placement +dotnet_diagnostic.IDE0070.severity = none # Use System.HashCode.Combine +dotnet_diagnostic.IDE0071.severity = none # Simplify interpolation +dotnet_diagnostic.IDE0072.severity = none # Add missing cases to switch expression +dotnet_diagnostic.IDE0073.severity = none # Use file header +dotnet_diagnostic.IDE0074.severity = none # Use coalesce compound assignment +dotnet_diagnostic.IDE0076.severity = none # Remove invalid global SuppressMessageAttribute +dotnet_diagnostic.IDE0077.severity = none # Avoid legacy format target in global SuppressMessageAttribute +dotnet_diagnostic.IDE0080.severity = none # Remove unnecessary suppression operator +dotnet_diagnostic.IDE0082.severity = none # Convert typeof to nameof +dotnet_diagnostic.IDE0083.severity = none # Use pattern matching (not operator) +dotnet_diagnostic.IDE0090.severity = none # Simplify new expression +dotnet_diagnostic.IDE0100.severity = none # Remove unnecessary equality operator +dotnet_diagnostic.IDE0110.severity = none # Remove unnecessary discard +dotnet_diagnostic.IDE0150.severity = none # Prefer null check over type check +dotnet_diagnostic.IDE0161.severity = none # Use file-scoped namespace +dotnet_diagnostic.IDE0170.severity = none # Simplify property pattern +dotnet_diagnostic.IDE0180.severity = none # Use tuple to swap values +dotnet_diagnostic.IDE0200.severity = none # Remove unnecessary lambda expression +dotnet_diagnostic.IDE0220.severity = none # Add explicit cast in foreach loop +dotnet_diagnostic.IDE0230.severity = none # Use UTF-8 string literal +dotnet_diagnostic.IDE0240.severity = none # Nullable directive is redundant +dotnet_diagnostic.IDE0241.severity = none # Nullable directive is unnecessary +dotnet_diagnostic.IDE0251.severity = none # Member can be made readonly +dotnet_diagnostic.IDE0270.severity = none # Null check can be simplified +dotnet_diagnostic.IDE0280.severity = none # Use nameof +dotnet_diagnostic.IDE0290.severity = none # Use primary constructor +dotnet_diagnostic.IDE0301.severity = none # Use collection expression for empty +dotnet_diagnostic.IDE0302.severity = none # Use collection expression for stackalloc +dotnet_diagnostic.IDE0303.severity = none # Use collection expression for Create() +dotnet_diagnostic.IDE0304.severity = none # Use collection expression for builder +dotnet_diagnostic.IDE0305.severity = none # Use collection expression for fluent +dotnet_diagnostic.IDE0340.severity = none # Use unbound generic type +dotnet_diagnostic.IDE0350.severity = none # Use implicitly typed lambda +dotnet_diagnostic.IDE0380.severity = none # Remove unnecessary unsafe modifier +dotnet_diagnostic.IDE1005.severity = none # Use conditional delegate call + +# Naming and miscellaneous # Naming conventions — SA1300 family already enforces PascalCase / interface # prefix / field casing (with our _underscore convention on SA1306/1309/1311 # deliberately disabled). Leaving IDE1006 off because configuring @@ -788,31 +831,33 @@ dotnet_diagnostic.IDE1006.severity = none # Naming rule violation — SA1300 fam dotnet_diagnostic.IDE3000.severity = none # Disabled per project convention — not enforced ################### -# Roslynator Analyzers (RCS1xxx) - Code Simplification +# Roslynator.CSharp.Analyzers (RCS) ################### -dotnet_diagnostic.RCS1001.severity = error # Add braces (when expression spans over multiple lines) -dotnet_diagnostic.RCS1003.severity = error # Add braces to if-else (when expression spans over multiple lines) -dotnet_diagnostic.RCS1005.severity = error # Simplify nested using statement -dotnet_diagnostic.RCS1006.severity = error # Merge 'else' with nested 'if' +# Code simplification +dotnet_diagnostic.RCS1001.severity = none # Add braces (when expression spans over multiple lines) — covered by SST1519 +dotnet_diagnostic.RCS1003.severity = none # Add braces to if-else (when expression spans over multiple lines) — covered by SST1519 +dotnet_diagnostic.RCS1005.severity = none # Simplify nested using statement — stacks the usings so the outer statement's child is a bare using, which SST1503 then reports for omitting braces; SST2236 covers the using-declaration direction +dotnet_diagnostic.RCS1006.severity = none # Merge 'else' with nested 'if' — covered by SST1465 dotnet_diagnostic.RCS1007.severity = error # Add braces dotnet_diagnostic.RCS1031.severity = none # Remove unnecessary braces in switch section -- we don't mind braces in switch statements dotnet_diagnostic.RCS1032.severity = error # Remove redundant parentheses -dotnet_diagnostic.RCS1033.severity = error # Remove redundant boolean literal -dotnet_diagnostic.RCS1039.severity = error # Remove argument list from attribute +dotnet_diagnostic.RCS1033.severity = none # Remove redundant boolean literal — covered by SST1143 +dotnet_diagnostic.RCS1039.severity = none # Remove argument list from attribute — covered by SST1411 +dotnet_diagnostic.RCS1040.severity = none # Remove empty statement — covered by SST1180 dotnet_diagnostic.RCS1042.severity = none # Remove enum default underlying type — covered by SST1177 dotnet_diagnostic.RCS1043.severity = error # Remove 'partial' modifier from type with a single part -dotnet_diagnostic.RCS1049.severity = error # Simplify boolean comparison +dotnet_diagnostic.RCS1049.severity = none # Simplify boolean comparison — covered by SST1143 dotnet_diagnostic.RCS1058.severity = none # Use compound assignment — covered by SST1185 dotnet_diagnostic.RCS1061.severity = none # Merge 'if' with nested 'if' — covered by SST2013 dotnet_diagnostic.RCS1068.severity = none # Simplify logical negation — covered by SST1172/SST2006 -dotnet_diagnostic.RCS1069.severity = error # Remove unnecessary case label +dotnet_diagnostic.RCS1069.severity = none # Remove unnecessary case label — covered by SST1466 dotnet_diagnostic.RCS1070.severity = none # Remove redundant default switch section — covered by SST1179 dotnet_diagnostic.RCS1071.severity = none # Remove redundant base constructor call — covered by SST1178 dotnet_diagnostic.RCS1072.severity = none # Remove empty namespace declaration — covered by SST1435 -dotnet_diagnostic.RCS1073.severity = error # Convert 'if' to 'return' statement +dotnet_diagnostic.RCS1073.severity = none # Convert 'if' to 'return' statement — covered by SST1197 dotnet_diagnostic.RCS1074.severity = none # Remove redundant constructor — covered by SST1433 -dotnet_diagnostic.RCS1078.severity = error # Use "" or 'string.Empty' -dotnet_diagnostic.RCS1084.severity = error # Use coalesce expression instead of conditional expression +dotnet_diagnostic.RCS1078.severity = none # Use "" or 'string.Empty' — conflicts with SST1122, which owns the string.Empty direction +dotnet_diagnostic.RCS1084.severity = none # Use coalesce expression instead of conditional expression — covered by SST1195 dotnet_diagnostic.RCS1085.severity = none # Use auto-implemented property — covered by SST1420 dotnet_diagnostic.RCS1089.severity = error # Use --/++ operator instead of assignment dotnet_diagnostic.RCS1097.severity = error # Remove redundant 'ToString' call @@ -820,105 +865,103 @@ dotnet_diagnostic.RCS1103.severity = error # Convert 'if' to assignment dotnet_diagnostic.RCS1104.severity = none # Simplify conditional expression — covered by SST1182 dotnet_diagnostic.RCS1105.severity = error # Unnecessary interpolation dotnet_diagnostic.RCS1106.severity = none # Remove empty destructor — covered by PSH1002 -dotnet_diagnostic.RCS1107.severity = error # Remove redundant 'ToCharArray' call +dotnet_diagnostic.RCS1107.severity = none # Remove redundant 'ToCharArray' call — covered by PSH1217 dotnet_diagnostic.RCS1114.severity = error # Remove redundant delegate creation -dotnet_diagnostic.RCS1124.severity = error # Inline local variable +dotnet_diagnostic.RCS1124.severity = none # Inline local variable — duplicates SST2266, and inlining the last local leaves a single-statement body that SST2275 then reports, so the two rules cannot both be satisfied dotnet_diagnostic.RCS1126.severity = error # Add braces to if-else dotnet_diagnostic.RCS1128.severity = error # Use coalesce expression dotnet_diagnostic.RCS1129.severity = none # Remove redundant field initialization — covered by SST1176 dotnet_diagnostic.RCS1132.severity = none # Remove redundant overriding member — covered by SST1181 dotnet_diagnostic.RCS1133.severity = error # Remove redundant Dispose/Close call -dotnet_diagnostic.RCS1134.severity = error # Remove redundant statement +dotnet_diagnostic.RCS1134.severity = none # Remove redundant statement — covered by SST1174 dotnet_diagnostic.RCS1143.severity = error # Simplify coalesce expression dotnet_diagnostic.RCS1145.severity = error # Remove redundant 'as' operator dotnet_diagnostic.RCS1146.severity = error # Use conditional access dotnet_diagnostic.RCS1151.severity = none # Remove redundant cast — covered by SST1175 dotnet_diagnostic.RCS1171.severity = error # Simplify lazy initialization dotnet_diagnostic.RCS1173.severity = error # Use coalesce expression instead of 'if' -dotnet_diagnostic.RCS1174.severity = error # Remove redundant async/await +dotnet_diagnostic.RCS1174.severity = none # Remove redundant async/await — covered by PSH1311 dotnet_diagnostic.RCS1179.severity = error # Unnecessary assignment dotnet_diagnostic.RCS1180.severity = error # Inline lazy initialization dotnet_diagnostic.RCS1188.severity = none # Remove redundant auto-property initialization — covered by SST1176 dotnet_diagnostic.RCS1192.severity = none # Unnecessary usage of verbatim string literal — covered by SST1184 dotnet_diagnostic.RCS1199.severity = error # Unnecessary null check dotnet_diagnostic.RCS1206.severity = error # Use conditional access instead of conditional expression -dotnet_diagnostic.RCS1207.severity = error # Use anonymous function or method group -dotnet_diagnostic.RCS1211.severity = error # Remove unnecessary 'else' +dotnet_diagnostic.RCS1207.severity = none # Use anonymous function or method group — conflicts with SST2239, which owns the method-group direction +dotnet_diagnostic.RCS1211.severity = none # Remove unnecessary 'else' — covered by SST1464 dotnet_diagnostic.RCS1212.severity = error # Remove redundant assignment dotnet_diagnostic.RCS1214.severity = none # Unnecessary interpolated string — covered by SST1183 dotnet_diagnostic.RCS1216.severity = error # Unnecessary unsafe context -dotnet_diagnostic.RCS1217.severity = error # Convert interpolated string to concatenation +dotnet_diagnostic.RCS1217.severity = none # Convert interpolated string to concatenation — reverses SST2249, which owns the concatenation-to-interpolation direction dotnet_diagnostic.RCS1218.severity = error # Simplify code branching -dotnet_diagnostic.RCS1220.severity = error # Use pattern matching instead of combination of 'is' and cast +dotnet_diagnostic.RCS1220.severity = none # Use pattern matching instead of combination of 'is' and cast — covered by SST2007 dotnet_diagnostic.RCS1221.severity = error # Use pattern matching instead of combination of 'as' and null check -dotnet_diagnostic.RCS1238.severity = error # Avoid nested ?: operators -dotnet_diagnostic.RCS1244.severity = error # Simplify 'default' expression +dotnet_diagnostic.RCS1238.severity = none # Avoid nested ?: operators — covered by SST1147 +dotnet_diagnostic.RCS1244.severity = none # Simplify 'default' expression — covered by SST1188 dotnet_diagnostic.RCS1249.severity = none # Unnecessary null-forgiving operator — disabled because multi-TFM nullability annotations can differ per platform, leading to false positives dotnet_diagnostic.RCS1251.severity = error # Remove unnecessary braces from record declaration dotnet_diagnostic.RCS1259.severity = error # Remove empty syntax (replaces RCS1066) dotnet_diagnostic.RCS1262.severity = error # Unnecessary raw string literal -dotnet_diagnostic.RCS1265.severity = error # Remove redundant catch block +dotnet_diagnostic.RCS1265.severity = none # Remove redundant catch block — covered by SST1470 dotnet_diagnostic.RCS1268.severity = error # Simplify numeric comparison -################### -# Roslynator Analyzers (RCS1xxx) - Code Quality -################### -dotnet_diagnostic.RCS1013.severity = error # Use predefined type +# Code quality +dotnet_diagnostic.RCS1013.severity = none # Use predefined type — covered by SST1121 dotnet_diagnostic.RCS1014.severity = error # Use explicitly/implicitly typed array dotnet_diagnostic.RCS1015.severity = error # Use nameof operator -dotnet_diagnostic.RCS1016.severity = error # Use block body or expression body -dotnet_diagnostic.RCS1020.severity = error # Simplify Nullable to T? +dotnet_diagnostic.RCS1016.severity = none # Use block body or expression body — conflicts with SST2219, which owns the expression-bodied accessor direction +dotnet_diagnostic.RCS1020.severity = none # Covered by SST2234 (canonical) dotnet_diagnostic.RCS1021.severity = error # Convert lambda expression body to expression body dotnet_diagnostic.RCS1044.severity = none # Remove original exception from throw statement — covered by SST1430 dotnet_diagnostic.RCS1046.severity = none # Asynchronous method name should end with 'Async' — TUnit test method naming convention doesn't follow the Async suffix — covered by SST1317 dotnet_diagnostic.RCS1047.severity = error # Non-asynchronous method name should not end with 'Async' -dotnet_diagnostic.RCS1048.severity = error # Use lambda expression instead of anonymous method +dotnet_diagnostic.RCS1048.severity = none # Use lambda expression instead of anonymous method — covered by SST1130 dotnet_diagnostic.RCS1050.severity = error # Include/omit parentheses when creating new object -dotnet_diagnostic.RCS1051.severity = error # Add/remove parentheses from condition in conditional operator +dotnet_diagnostic.RCS1051.severity = none # Add/remove parentheses from condition in conditional operator — conflicts with SST1459, which owns the non-grouping-parenthesis removal direction dotnet_diagnostic.RCS1056.severity = none # Avoid usage of using alias directive - used to avoid conflicts -dotnet_diagnostic.RCS1059.severity = error # Avoid locking on publicly accessible instance +dotnet_diagnostic.RCS1059.severity = none # Avoid locking on publicly accessible instance — covered by SST1901 dotnet_diagnostic.RCS1075.severity = none # Avoid empty catch clause that catches System.Exception — covered by SST1429 dotnet_diagnostic.RCS1079.severity = error # Throwing of new NotImplementedException dotnet_diagnostic.RCS1081.severity = error # Split variable declaration dotnet_diagnostic.RCS1093.severity = error # File contains no code -dotnet_diagnostic.RCS1094.severity = error # Declare using directive on top level -dotnet_diagnostic.RCS1096.severity = error # Use 'HasFlag' method or bitwise operator +dotnet_diagnostic.RCS1094.severity = none # Declare using directive on top level — covered by SST1200 +dotnet_diagnostic.RCS1096.severity = none # Use 'HasFlag' method or bitwise operator — covered by PSH1016 dotnet_diagnostic.RCS1098.severity = none # Constant values should be placed on right side of comparisons — covered by SST1186 -dotnet_diagnostic.RCS1099.severity = error # Default label should be the last label in a switch section +dotnet_diagnostic.RCS1099.severity = none # Default label should be the last label in a switch section — covered by SST1466 dotnet_diagnostic.RCS1102.severity = none # Make class static — covered by SST1432 dotnet_diagnostic.RCS1108.severity = error # Add 'static' modifier to all partial class declarations dotnet_diagnostic.RCS1111.severity = error # Add braces to switch section with multiple statements dotnet_diagnostic.RCS1113.severity = error # Use 'string.IsNullOrEmpty' method -dotnet_diagnostic.RCS1118.severity = error # Mark local variable as const -dotnet_diagnostic.RCS1123.severity = error # Add parentheses when necessary -dotnet_diagnostic.RCS1130.severity = error # Bitwise operation on enum without Flags attribute +dotnet_diagnostic.RCS1118.severity = none # Mark local variable as const — covered by PSH1402 +dotnet_diagnostic.RCS1123.severity = none # Add parentheses when necessary — covered by SST1407 +dotnet_diagnostic.RCS1130.severity = none # Bitwise operation on enum without Flags attribute — covered by SST2458 dotnet_diagnostic.RCS1135.severity = error # Declare enum member with zero value (when enum has FlagsAttribute) -dotnet_diagnostic.RCS1136.severity = error # Merge switch sections with equivalent content +dotnet_diagnostic.RCS1136.severity = none # Merge switch sections with equivalent content — covered by SST2414 dotnet_diagnostic.RCS1154.severity = error # Sort enum members -dotnet_diagnostic.RCS1155.severity = error # Use StringComparison when comparing strings -dotnet_diagnostic.RCS1156.severity = error # Use string.Length instead of comparison with empty string +dotnet_diagnostic.RCS1155.severity = none # Use StringComparison when comparing strings — covered by PSH1207 +dotnet_diagnostic.RCS1156.severity = none # Use string.Length instead of comparison with empty string — covered by PSH1204 dotnet_diagnostic.RCS1157.severity = none # Composite enum value contains undefined flag — covered by SST2303 dotnet_diagnostic.RCS1159.severity = error # Use EventHandler dotnet_diagnostic.RCS1160.severity = none # Abstract type should not have public constructors — covered by SST1428 dotnet_diagnostic.RCS1161.severity = none # Enum should declare explicit values - do not need explicit values dotnet_diagnostic.RCS1162.severity = none # Avoid chain of assignments — covered by SST1187 -dotnet_diagnostic.RCS1166.severity = error # Value type object is never equal to null +dotnet_diagnostic.RCS1166.severity = none # Value type object is never equal to null — covered by SST1469 dotnet_diagnostic.RCS1168.severity = none # Parameter name differs from base name — covered by SST1318 dotnet_diagnostic.RCS1169.severity = error # Make field read-only -dotnet_diagnostic.RCS1170.severity = error # Use read-only auto-implemented property +dotnet_diagnostic.RCS1170.severity = none # Use read-only auto-implemented property — covered by SST2332 dotnet_diagnostic.RCS1172.severity = none # Use 'is' operator instead of 'as' operator — covered by SST2005 -dotnet_diagnostic.RCS1187.severity = error # Use constant instead of field +dotnet_diagnostic.RCS1187.severity = none # Use constant instead of field — covered by PSH1402 dotnet_diagnostic.RCS1191.severity = error # Declare enum value as combination of names -dotnet_diagnostic.RCS1193.severity = error # Overriding member should not change 'params' modifier +dotnet_diagnostic.RCS1193.severity = none # Overriding member should not change 'params' modifier — covered by SST2426 dotnet_diagnostic.RCS1196.severity = error # Call extension method as instance method -dotnet_diagnostic.RCS1200.severity = error # Call 'Enumerable.ThenBy' instead of 'Enumerable.OrderBy' +dotnet_diagnostic.RCS1200.severity = none # Call 'Enumerable.ThenBy' instead of 'Enumerable.OrderBy' — covered by PSH1108 dotnet_diagnostic.RCS1201.severity = error # Use method chaining dotnet_diagnostic.RCS1202.severity = error # Avoid NullReferenceException dotnet_diagnostic.RCS1204.severity = error # Use EventArgs.Empty dotnet_diagnostic.RCS1205.severity = error # Order named arguments according to the order of parameters dotnet_diagnostic.RCS1208.severity = error # Reduce 'if' nesting dotnet_diagnostic.RCS1209.severity = error # Order type parameter constraints -dotnet_diagnostic.RCS1210.severity = error # Return completed task instead of returning null +dotnet_diagnostic.RCS1210.severity = none # Return completed task instead of returning null — covered by PSH1312 dotnet_diagnostic.RCS1215.severity = error # Expression is always equal to true/false dotnet_diagnostic.RCS1222.severity = error # Merge preprocessor directives dotnet_diagnostic.RCS1223.severity = suggestion # Mark publicly visible type with DebuggerDisplay attribute — only data types benefit; the rule is too broad to be an error @@ -926,46 +969,42 @@ dotnet_diagnostic.RCS1224.severity = error # Make method an extension method dotnet_diagnostic.RCS1225.severity = error # Make class sealed dotnet_diagnostic.RCS1227.severity = none # Validate arguments correctly — covered by SST2404 dotnet_diagnostic.RCS1229.severity = error # Use async/await when necessary -dotnet_diagnostic.RCS1231.severity = suggestion # Make parameter ref read-only -dotnet_diagnostic.RCS1233.severity = error # Use short-circuiting operator +dotnet_diagnostic.RCS1231.severity = none # Make parameter ref read-only — covered by PSH1007 +dotnet_diagnostic.RCS1233.severity = none # Use short-circuiting operator — covered by SST1468 dotnet_diagnostic.RCS1234.severity = error # Duplicate enum value dotnet_diagnostic.RCS1239.severity = error # Use 'for' statement instead of 'while' statement dotnet_diagnostic.RCS1240.severity = error # Operator is unnecessary -dotnet_diagnostic.RCS1242.severity = error # Do not pass non-read-only struct by read-only reference -dotnet_diagnostic.RCS1243.severity = error # Duplicate word in a comment +dotnet_diagnostic.RCS1242.severity = none # Do not pass non-read-only struct by read-only reference — covered by PSH1003 +dotnet_diagnostic.RCS1243.severity = none # Duplicate word in a comment — covered by SST1658 (documentation comments) dotnet_diagnostic.RCS1247.severity = error # Fix documentation comment tag -dotnet_diagnostic.RCS1248.severity = error # Normalize null check -dotnet_diagnostic.RCS1250.severity = error # Use implicit/explicit object creation +dotnet_diagnostic.RCS1248.severity = none # Normalize null check — conflicts with SST1149, which owns the 'is null' pattern direction +dotnet_diagnostic.RCS1250.severity = none # Use implicit/explicit object creation — conflicts with SST2202, which owns the implicit-target-type direction dotnet_diagnostic.RCS1252.severity = error # Normalize usage of infinite loop dotnet_diagnostic.RCS1254.severity = error # Normalize format of enum flag value dotnet_diagnostic.RCS1255.severity = none # Simplify argument null check — conflicts with our ArgumentExceptionHelper helper pattern dotnet_diagnostic.RCS1257.severity = error # Use enum field explicitly dotnet_diagnostic.RCS1258.severity = error # Unnecessary enum flag -dotnet_diagnostic.RCS1260.severity = error # Add/remove trailing comma -dotnet_diagnostic.RCS1261.severity = error # Resource can be disposed asynchronously +dotnet_diagnostic.RCS1260.severity = none # Add/remove trailing comma — conflicts with SST1413, which owns the trailing-comma direction +dotnet_diagnostic.RCS1261.severity = none # Resource can be disposed asynchronously — covered by PSH1310 dotnet_diagnostic.RCS1264.severity = error # Use 'var' or explicit type (replaces RCS1010, RCS1176, RCS1177) -dotnet_diagnostic.RCS1266.severity = error # Use raw string literal +dotnet_diagnostic.RCS1266.severity = none # Use raw string literal — covered by SST2243 dotnet_diagnostic.RCS1267.severity = error # Use string interpolation instead of 'string.Concat' -################### -# Roslynator Analyzers (RCS1xxx) - Performance -################### -dotnet_diagnostic.RCS1077.severity = error # Optimize LINQ method call -dotnet_diagnostic.RCS1080.severity = error # Use 'Count/Length' property instead of 'Any' method -dotnet_diagnostic.RCS1112.severity = error # Combine 'Enumerable.Where' method chain +# Performance +dotnet_diagnostic.RCS1077.severity = none # Covered by the PSH1101-PSH1111 family (canonical) +dotnet_diagnostic.RCS1080.severity = none # Covered by PSH1106 (canonical) +dotnet_diagnostic.RCS1112.severity = none # Combine 'Enumerable.Where' method chain — covered by PSH1109 dotnet_diagnostic.RCS1186.severity = error # Use Regex instance instead of static method -dotnet_diagnostic.RCS1190.severity = error # Join string expressions +dotnet_diagnostic.RCS1190.severity = none # Join string expressions — conflicts with SST2470, which reports the fused-literal seam this would create dotnet_diagnostic.RCS1195.severity = error # Use ^ operator -dotnet_diagnostic.RCS1197.severity = error # Optimize StringBuilder.Append/AppendLine call +dotnet_diagnostic.RCS1197.severity = none # Optimize StringBuilder.Append/AppendLine call — covered by PSH1203/PSH1214 dotnet_diagnostic.RCS1198.severity = none # Avoid unnecessary boxing of value type — boxing is unavoidable bridging Rx and IEnumerable -dotnet_diagnostic.RCS1230.severity = error # Unnecessary explicit use of enumerator +dotnet_diagnostic.RCS1230.severity = none # Unnecessary explicit use of enumerator — covered by SST1467 dotnet_diagnostic.RCS1235.severity = error # Optimize method call -dotnet_diagnostic.RCS1236.severity = error # Use exception filter -dotnet_diagnostic.RCS1246.severity = error # Use element access +dotnet_diagnostic.RCS1236.severity = none # Use exception filter — covered by SST2009 +dotnet_diagnostic.RCS1246.severity = none # Use element access — covered by PSH1106 -################### -# Roslynator Analyzers (RCS1xxx) - Maintainability -################### +# Maintainability dotnet_diagnostic.RCS1158.severity = none # Static member in generic type should use a type parameter — common factory pattern — covered by SST1431 dotnet_diagnostic.RCS1163.severity = none # Unused parameter — interface implementations and Rx selectors often have unused parameters dotnet_diagnostic.RCS1164.severity = none # Unused type parameter - DUPLICATE IDE0060 (UnusedParameter analyzer 210ms; IDE0060 bundled at lower cost) @@ -975,9 +1014,7 @@ dotnet_diagnostic.RCS1213.severity = none # Remove unused member declaration - D dotnet_diagnostic.RCS1241.severity = error # Implement non-generic counterpart dotnet_diagnostic.RCS1256.severity = none # Invalid argument null check — conflicts with our ArgumentExceptionHelper helper pattern -################### -# Roslynator Analyzers (RCS1xxx) - Documentation -################### +# Documentation dotnet_diagnostic.RCS1181.severity = error # Convert comment to documentation comment dotnet_diagnostic.RCS1189.severity = error # Add or remove region name dotnet_diagnostic.RCS1226.severity = none # Add paragraph to documentation comment — <para> wrapping is subjective and adds noise @@ -986,9 +1023,7 @@ dotnet_diagnostic.RCS1232.severity = error # Order elements in documentation com dotnet_diagnostic.RCS1253.severity = error # Format documentation comment summary dotnet_diagnostic.RCS1263.severity = none # Invalid reference in a documentation comment -################### -# Roslynator Analyzers (RCS1xxx) - Disabled (covered by CA/SA equivalent) -################### +# Disabled dotnet_diagnostic.RCS1018.severity = none # Add/remove accessibility modifiers — covered by SA1400 dotnet_diagnostic.RCS1019.severity = none # Order modifiers — covered by SA1206 / SA1208 dotnet_diagnostic.RCS1037.severity = none # Remove trailing white-space — covered by SA1028 @@ -1006,9 +1041,7 @@ dotnet_diagnostic.RCS1175.severity = none # Unused 'this' parameter — covered dotnet_diagnostic.RCS1194.severity = none # Implement exception constructors — covered by CA1032 dotnet_diagnostic.RCS1203.severity = none # Use AttributeUsageAttribute — covered by CA1018 -################### -# Roslynator Formatting Analyzers (RCS0xxx) - covered by StyleCop SA equivalents -################### +# Formatting dotnet_diagnostic.RCS0001.severity = none # Add blank line after embedded statement — covered by StyleCop layout rules dotnet_diagnostic.RCS0002.severity = none # Add blank line after #region — covered by StyleCop SA1517 family dotnet_diagnostic.RCS0003.severity = none # Add blank line after using directive list — covered by SA1516 @@ -1080,11 +1113,20 @@ stylesharp.document_private_fields = true stylesharp.document_interfaces = all stylesharp.SST1305.allowed_hungarian_prefixes = rx stylesharp.instance_member_qualification = omit_this +# SST2271 enforces one var-versus-explicit choice. Track the csharp_style_var_* preferences +# above, which ask for var everywhere, rather than the rule's when_obvious default. +stylesharp.use_var = always stylesharp.max_cyclomatic_complexity = 10 stylesharp.max_cognitive_complexity = 15 stylesharp.max_property_cognitive_complexity = 3 # SST1484 also reports a field that shadows one inherited from a base type. stylesharp.SST1484.check_base_types = true + +# SST2403 reports `this` escaping a constructor. These two take `this` and hand it straight back +# to the object it came from, so nothing else can observe a half-built instance: ToProperty stores +# the helper on the same object, and WhenActivated defers its callback until activation. Both are +# the shapes the MVVM framework documents writing in a constructor. +stylesharp.SST2403.allowed_escape_methods = WhenActivated, ToProperty stylesharp.max_line_length = 200 # SST1521 (characters; keeps the limit this repo has always enforced) stylesharp.max_file_lines = 1000 # SST1522 (code lines; blank lines and comments do not count) # stylesharp.max_member_lines = 60 # SST1523 (code lines) @@ -1092,11 +1134,6 @@ stylesharp.max_file_lines = 1000 # SST1522 (code lines # stylesharp.include_internal = true # SST1499 (set false to report only fields visible outside the assembly) # stylesharp.require_parameterless = true # SST1488 (set false where every exception must carry a message) # stylesharp.include_non_public_types = true # SST1488 (set false to check only externally visible exceptions) -performancesharp.avoid_linq_on_hot_path = true # PSH1100 (product code bans LINQ outright; tests relax this) -# performancesharp.empty_string_style = pattern # PSH1204 (pattern | length | is_null_or_empty; the last two are only offered where the string is provably not null) -# performancesharp.include_public = false # PSH1411 (set true in an app to seal public types too; a break in a library) -# performancesharp.excluded_properties = Items, Keys # PSH1017 (comma-separated; properties allowed to copy on read) - # Spacing dotnet_diagnostic.SST1000.severity = error # A control-flow keyword is not followed by a space dotnet_diagnostic.SST1001.severity = error # A comma is spaced incorrectly @@ -1130,6 +1167,7 @@ dotnet_diagnostic.SST1028.severity = error # A line ends with trailing whitespac # Readability and maintainability dotnet_diagnostic.SST1100.severity = error # A base. prefix is used where the type does not override the member +dotnet_diagnostic.SST1101.severity = none # see docs/rules/SST1101.md dotnet_diagnostic.SST1102.severity = error # A query clause is separated from the previous clause by a blank line dotnet_diagnostic.SST1103.severity = error # Query clauses mix single-line and multi-line layout dotnet_diagnostic.SST1104.severity = error # A query clause shares the last line of a multi-line previous clause @@ -1144,9 +1182,14 @@ dotnet_diagnostic.SST1114.severity = error # A blank line separates the declarat dotnet_diagnostic.SST1115.severity = error # A blank line separates a parameter from the preceding comma dotnet_diagnostic.SST1116.severity = error # A qualified name can be shortened without changing the symbol it binds to dotnet_diagnostic.SST1117.severity = error # Instance member access follows the configured this. qualification style +# SST1118 wants each parameter or argument on one line, which collides with the 200-character +# max_line_length above. Of the 41 sites here, 18 cannot be collapsed inside 200 characters - +# multi-line diagnostic message concatenations and [DynamicallyAccessedMembers(A | B | C)] lists +# reach 429. The two rules cannot both hold, and the line limit is the one this repo enforces. dotnet_diagnostic.SST1118.severity = none # A parameter should not span multiple lines +dotnet_diagnostic.SST1119.severity = error # A numeric literal groups its digit separators irregularly dotnet_diagnostic.SST1120.severity = error # A comment contains no text -dotnet_diagnostic.SST1121.severity = none # A framework type name is used instead of its built-in alias — duplicate of RCS1013 +dotnet_diagnostic.SST1121.severity = error # A framework type name is used instead of its built-in alias (opt-in rule, enabled here) dotnet_diagnostic.SST1122.severity = error # An empty string literal is used instead of string.Empty dotnet_diagnostic.SST1123.severity = error # A #region is placed inside a code element body dotnet_diagnostic.SST1124.severity = error # A #region directive is used @@ -1162,6 +1205,7 @@ dotnet_diagnostic.SST1134.severity = error # An attribute shares a line with ano dotnet_diagnostic.SST1135.severity = error # A using directive names a namespace or type that is not fully qualified dotnet_diagnostic.SST1136.severity = error # Several enum members share a line dotnet_diagnostic.SST1137.severity = error # Sibling elements are indented differently from one another +dotnet_diagnostic.SST1138.severity = error # A free-standing block declares nothing dotnet_diagnostic.SST1139.severity = error # A numeric literal is cast where a literal suffix would express the type dotnet_diagnostic.SST1140.severity = error # Wrapped conditional operators should start indented continuation lines dotnet_diagnostic.SST1141.severity = error # An explicit ValueTuple<...> is used where tuple syntax would do @@ -1215,7 +1259,7 @@ dotnet_diagnostic.SST1188.severity = error # Use the 'default' literal instead o dotnet_diagnostic.SST1189.severity = error # Variables should not be self-assigned dotnet_diagnostic.SST1190.severity = error # Doubled negation operators should be removed dotnet_diagnostic.SST1191.severity = error # Long numeric literals should use digit separators -dotnet_diagnostic.SST1192.severity = none # Control characters in string literals should be escaped +dotnet_diagnostic.SST1192.severity = error # Control characters in string literals should be escaped dotnet_diagnostic.SST1193.severity = error # Keep initial member values with construction dotnet_diagnostic.SST1194.severity = error # Keep initial collection values with construction dotnet_diagnostic.SST1195.severity = error # Write null fallback with ?? @@ -1225,7 +1269,7 @@ dotnet_diagnostic.SST1198.severity = error # Collapse assignment-only branches i dotnet_diagnostic.SST1199.severity = error # Prefer compile-time type names # Ordering -dotnet_diagnostic.SST1200.severity = none # Using directives should be placed outside the namespace — usings live outside file-scoped namespaces +dotnet_diagnostic.SST1200.severity = error # Using directives should be placed outside the namespace dotnet_diagnostic.SST1201.severity = error # Members should be ordered by kind dotnet_diagnostic.SST1202.severity = error # Members should be ordered by accessibility dotnet_diagnostic.SST1203.severity = error # Constants should appear before fields @@ -1244,9 +1288,12 @@ dotnet_diagnostic.SST1215.severity = error # Instance readonly fields should app dotnet_diagnostic.SST1216.severity = error # Using static directives should be placed after regular usings and before aliases dotnet_diagnostic.SST1217.severity = error # Using static directives should be ordered alphabetically dotnet_diagnostic.SST1218.severity = error # Other members separate a method's overloads +dotnet_diagnostic.SST1219.severity = error # A switch default clause is not placed last +dotnet_diagnostic.SST1220.severity = error # An all-named argument list is in a different order than the parameters. Code fix reorders it to declaration order. Info. +dotnet_diagnostic.SST1221.severity = error # `where` constraint clauses are not ordered to match the type-parameter list. Code fix reorders them. Info. # Naming -dotnet_diagnostic.SST1300.severity = none # Types and members should be PascalCase — naming duplicates existing analyzers +dotnet_diagnostic.SST1300.severity = error # Types and members should be PascalCase dotnet_diagnostic.SST1302.severity = error # Interface names should begin with I dotnet_diagnostic.SST1303.severity = error # Const names should be PascalCase dotnet_diagnostic.SST1304.severity = error # Non-private readonly fields should be PascalCase @@ -1261,10 +1308,12 @@ dotnet_diagnostic.SST1312.severity = error # Local variables should be camelCase dotnet_diagnostic.SST1313.severity = error # Parameters should be camelCase dotnet_diagnostic.SST1314.severity = error # Type parameters should begin with T dotnet_diagnostic.SST1315.severity = error # Union member names should match the configured casing -dotnet_diagnostic.SST1316.severity = none # Tuple element names should use the configured casing — tuple naming is not enforced here +dotnet_diagnostic.SST1316.severity = error # Tuple element names should use the configured casing dotnet_diagnostic.SST1317.severity = none # Asynchronous method names should end with 'Async' — conflicts with this project's Rx-compatibility and naming mechanism dotnet_diagnostic.SST1318.severity = error # Overriding parameter names should match the base declaration dotnet_diagnostic.SST1319.severity = error # An enumeration's type name is not PascalCase +dotnet_diagnostic.SST1320.severity = error # A parameter name matches its method's name +dotnet_diagnostic.SST1321.severity = none # Public APIs intentionally use Async to describe asynchronous observable behavior without returning an awaitable. # Maintainability dotnet_diagnostic.SST1400.severity = error # An element does not declare an access modifier @@ -1279,11 +1328,22 @@ dotnet_diagnostic.SST1408.severity = error # Mixed conditional operators are not dotnet_diagnostic.SST1410.severity = error # An anonymous method has an empty parameter list dotnet_diagnostic.SST1411.severity = error # An attribute uses an empty argument list dotnet_diagnostic.SST1412.severity = none # Store files as UTF-8 with a byte order mark — conflicts with SST1450 (UTF-8 without BOM) -dotnet_diagnostic.SST1413.severity = none # A multi-line initializer omits the trailing comma — trailing commas are not required here +dotnet_diagnostic.SST1413.severity = error # A multi-line initializer omits the trailing comma dotnet_diagnostic.SST1414.severity = error # A tuple type in a member signature has an unnamed element dotnet_diagnostic.SST1415.severity = error # An argument-exception constructor uses a string literal where nameof would track renames +# SST1416 treats a public member of a non-public type as pointless, which stops holding the +# moment the type is reached reflectively: Type.GetProperty and Activator.CreateInstance(Type) +# use binding flags that see public members only. Demoting them compiles but silently changes +# behaviour - it hid every property on the reflection request-model fixtures, and would stop the +# JSON converter factory from constructing EnumConverter. The Index/Range polyfills likewise +# need the public members the compiler recognises for index and range lowering. dotnet_diagnostic.SST1416.severity = none # Do not declare public members in a non-public type -dotnet_diagnostic.SST1417.severity = suggestion # Namespace should match the folder structure +# SST1417 derives the expected namespace from the folder, so it cannot be satisfied by a type +# that deliberately lives in a BCL namespace: PushStreamContent extends System.Net.Http and +# NameValueCollection backfills System.Collections.Specialized. Moving them under a matching +# folder would make the expected namespace Refit.System.Net.Http, so there is no layout that +# both satisfies the rule and keeps the namespace these types must have. +dotnet_diagnostic.SST1417.severity = none # Namespace should match the folder structure dotnet_diagnostic.SST1418.severity = error # Declare precedence when mixing the null-coalescing operator dotnet_diagnostic.SST1419.severity = error # Remove redundant modifiers dotnet_diagnostic.SST1420.severity = error # Trivial properties should be auto-implemented @@ -1300,6 +1360,7 @@ dotnet_diagnostic.SST1430.severity = error # Rethrow with 'throw;' to preserve t dotnet_diagnostic.SST1431.severity = error # Static members of a generic type should use a type parameter dotnet_diagnostic.SST1432.severity = error # Classes with only static members should be static dotnet_diagnostic.SST1433.severity = error # Redundant constructors should be removed +dotnet_diagnostic.SST1434.severity = error # see docs/rules/SST1434.md dotnet_diagnostic.SST1435.severity = error # Empty namespace declarations should be removed dotnet_diagnostic.SST1436.severity = error # Empty types should not be declared dotnet_diagnostic.SST1437.severity = error # Empty interfaces should not be declared @@ -1312,7 +1373,7 @@ dotnet_diagnostic.SST1443.severity = error # A function has too much nested cont dotnet_diagnostic.SST1444.severity = error # A loop cannot naturally reach a second iteration dotnet_diagnostic.SST1445.severity = error # A using directive is unnecessary dotnet_diagnostic.SST1446.severity = error # An inheritance chain is deeper than the configured maximum -dotnet_diagnostic.SST1447.severity = error # An equality override delegates to object's reference semantics +dotnet_diagnostic.SST1447.severity = error # An equality override delegates to object reference semantics dotnet_diagnostic.SST1448.severity = error # An argument is passed explicitly to a caller-info parameter dotnet_diagnostic.SST1449.severity = error # Code writes directly to the console dotnet_diagnostic.SST1450.severity = error # Store files as UTF-8 without a byte order mark @@ -1329,13 +1390,13 @@ dotnet_diagnostic.SST1460.severity = error # Non-mutating struct members should dotnet_diagnostic.SST1461.severity = error # Private parameters that are never read should be removed dotnet_diagnostic.SST1462.severity = error # Suppressions for diagnostics already disabled by config should be removed dotnet_diagnostic.SST1463.severity = error # Symbol-name strings should use nameof -dotnet_diagnostic.SST1464.severity = error # An else follows a branch that never falls through -dotnet_diagnostic.SST1465.severity = error # An else block only wraps an if and should collapse to else if -dotnet_diagnostic.SST1466.severity = error # A case label shares its section with default and adds nothing -dotnet_diagnostic.SST1467.severity = error # An enumerator is driven by hand where foreach would do -dotnet_diagnostic.SST1468.severity = error # Boolean logic uses a non-short-circuiting operator -dotnet_diagnostic.SST1469.severity = error # A value type is compared to null -dotnet_diagnostic.SST1470.severity = error # A catch clause only rethrows +dotnet_diagnostic.SST1464.severity = error # An else clause follows a branch that always jumps and can be unwrapped +dotnet_diagnostic.SST1465.severity = error # An else block that only wraps an if can collapse to else-if +dotnet_diagnostic.SST1466.severity = error # A case label sharing a section with default is redundant +dotnet_diagnostic.SST1467.severity = error # A hand-driven enumerator loop can use foreach +dotnet_diagnostic.SST1468.severity = error # Boolean logic should use the short-circuiting && and || operators +dotnet_diagnostic.SST1469.severity = error # A non-nullable value type is compared to null +dotnet_diagnostic.SST1470.severity = error # A trailing catch clause that only rethrows should be removed dotnet_diagnostic.SST1471.severity = error # Magic numbers should be named constants dotnet_diagnostic.SST1472.severity = error # Signatures should not declare too many parameters dotnet_diagnostic.SST1473.severity = error # A floating-point value is compared for exact equality (zero comparison allowed by default) @@ -1370,7 +1431,7 @@ dotnet_diagnostic.SST1499.severity = error # A static field visible outside its dotnet_diagnostic.SST1500.severity = error # A brace in a multi-line construct shares its line with other code dotnet_diagnostic.SST1501.severity = error # A statement block is collapsed onto a single line dotnet_diagnostic.SST1502.severity = error # An element body is collapsed onto a single line -dotnet_diagnostic.SST1503.severity = none # A control-flow statement omits the braces around its child statement — duplicate with existing brace preferences +dotnet_diagnostic.SST1503.severity = error # A control-flow statement omits the braces around its child statement dotnet_diagnostic.SST1504.severity = error # The accessors of a property/event mix single-line and multi-line forms dotnet_diagnostic.SST1505.severity = error # An opening brace is followed by a blank line dotnet_diagnostic.SST1506.severity = error # An element documentation header is followed by a blank line @@ -1392,6 +1453,21 @@ dotnet_diagnostic.SST1521.severity = error # A line is longer than the configure dotnet_diagnostic.SST1522.severity = error # A file has more code lines than the configured maximum (default 500) dotnet_diagnostic.SST1523.severity = error # A member has more code lines than the configured maximum (default 60) dotnet_diagnostic.SST1524.severity = error # A switch section has more code lines than the configured maximum (default 20) +dotnet_diagnostic.SST1525.severity = error # A multi-statement `switch` section has no braces; the braces-on policy extends to switch sections. Code fix wraps it. +dotnet_diagnostic.SST1526.severity = error # A wrapped binary expression places the operator inconsistently. Configurable (`before`/`after`, default before). Opt-in. +dotnet_diagnostic.SST1527.severity = error # The `=>` of an expression-bodied member wraps inconsistently. Configurable. Opt-in. +dotnet_diagnostic.SST1528.severity = error # The `=` of a wrapped initializer wraps inconsistently. Configurable. Opt-in. +dotnet_diagnostic.SST1529.severity = error # A wrapped `?.`/`.` call chain places the break inconsistently. Configurable. Opt-in. +dotnet_diagnostic.SST1530.severity = error # A newline sits between a type declaration and its base list. Code fix pulls the base list onto the declaration line. Opt-in. +dotnet_diagnostic.SST1531.severity = error # A short object initializer is split across lines. Code fix collapses it when it fits. Opt-in. +dotnet_diagnostic.SST1532.severity = error # A file mixes line endings. Configurable (`lf`/`crlf`, default lf). Opt-in. +# SST1533 reports a file that declares no type, which is what a polyfill wrapped in #if looks +# like on the frameworks that already have the API - HttpContentExtensions is empty on net9.0+ +# by design. The rule cannot distinguish that from a genuinely empty file. +dotnet_diagnostic.SST1533.severity = none # A source file contains no code +dotnet_diagnostic.SST1535.severity = error # A constructor initializer colon should not be followed by a blank line +dotnet_diagnostic.SST1536.severity = error # A conditional operator token should not be followed by a blank line +dotnet_diagnostic.SST1537.severity = error # An expression-body arrow should not be followed by a blank line # Documentation dotnet_diagnostic.SST1600.severity = error # Externally visible members should be documented @@ -1402,7 +1478,10 @@ dotnet_diagnostic.SST1605.severity = error # Partial element documentation shoul dotnet_diagnostic.SST1606.severity = error # The summary should have text dotnet_diagnostic.SST1607.severity = error # Partial element summary should have text dotnet_diagnostic.SST1608.severity = error # Documentation should not use the default placeholder summary -dotnet_diagnostic.SST1609.severity = none # Property documentation should have a value +# SST1609 wants a element on every documented property. On the 174 properties here that +# text only ever restates the ("Gets the request timeout." / "The request timeout."), +# so it adds a maintenance burden without telling a reader anything the summary did not. +dotnet_diagnostic.SST1609.severity = none # Property documentation should have a value dotnet_diagnostic.SST1610.severity = error # Property value documentation should have text dotnet_diagnostic.SST1611.severity = error # Parameters should be documented dotnet_diagnostic.SST1612.severity = error # Parameter documentation should match the parameters @@ -1439,23 +1518,31 @@ dotnet_diagnostic.SST1654.severity = error # Extension blocks should be document dotnet_diagnostic.SST1655.severity = error # Extension block parameters should be documented dotnet_diagnostic.SST1656.severity = error # Extension block type parameters should be documented dotnet_diagnostic.SST1657.severity = error # Extension block documentation should reference a real parameter or type parameter -dotnet_diagnostic.SST1658.severity = error # Documentation repeats a word +dotnet_diagnostic.SST1658.severity = error # Documentation text repeats a word dotnet_diagnostic.SST1659.severity = error # A comment has no text at all +dotnet_diagnostic.SST1660.severity = error # The `` tags are not in parameter order. Code fix reorders them. Info. +dotnet_diagnostic.SST1661.severity = error # A snippet uses ``/`` mismatched to single- vs multi-line content. Code fix swaps the tag. Info. +dotnet_diagnostic.SST1662.severity = error # A thrown exception type has no `` documentation. Code fix adds the skeleton. Opt-in. +dotnet_diagnostic.SST1663.severity = error # A `//` comment before a public member reads like a summary; use `///`. Code fix converts it. Opt-in. +dotnet_diagnostic.SST1664.severity = error # A summary separates paragraphs with blank lines instead of ``. Code fix wraps them. Opt-in. # Concurrency and modernization +dotnet_diagnostic.SST1900.severity = error # see docs/rules/SST1900.md dotnet_diagnostic.SST1901.severity = error # A lock targets a field or property reachable from outside the declaring type dotnet_diagnostic.SST1902.severity = error # Do not lock on 'this', a Type, or a string dotnet_diagnostic.SST1903.severity = error # Do not lock on a newly-created object -dotnet_diagnostic.SST2000.severity = suggestion # A null check plus throw should use ArgumentNullException.ThrowIfNull +dotnet_diagnostic.SST1904.severity = error # A lock targets a non-readonly field +dotnet_diagnostic.SST1905.severity = error # An async method or converted delegate returns void +dotnet_diagnostic.SST2000.severity = error # A null check plus throw should use ArgumentNullException.ThrowIfNull dotnet_diagnostic.SST2001.severity = error # Use ArgumentException.ThrowIfNullOrEmpty dotnet_diagnostic.SST2002.severity = error # Use ArgumentException.ThrowIfNullOrWhiteSpace -dotnet_diagnostic.SST2003.severity = suggestion # A disposed check should use ObjectDisposedException.ThrowIf -dotnet_diagnostic.SST2004.severity = suggestion # A range check should use an ArgumentOutOfRangeException.ThrowIf... helper +dotnet_diagnostic.SST2003.severity = error # A disposed check should use ObjectDisposedException.ThrowIf +dotnet_diagnostic.SST2004.severity = error # A range check should use an ArgumentOutOfRangeException.ThrowIf... helper dotnet_diagnostic.SST2005.severity = error # Use the 'is' type pattern instead of comparing an 'as' cast to null dotnet_diagnostic.SST2006.severity = error # Use the 'is not' pattern instead of negating an 'is' check dotnet_diagnostic.SST2007.severity = error # Use declaration patterns instead of an is check followed by a cast local dotnet_diagnostic.SST2008.severity = error # Negated pattern tests should use is-not patterns -dotnet_diagnostic.SST2009.severity = error # A catch that rethrows unless a condition holds should use a when filter +dotnet_diagnostic.SST2009.severity = error # A catch that tests then rethrows can use a when filter dotnet_diagnostic.SST2010.severity = error # A type reads the machine clock directly instead of through a TimeProvider dotnet_diagnostic.SST2011.severity = error # An instant is recorded from the local clock rather than in UTC dotnet_diagnostic.SST2012.severity = error # A GUID is constructed with the parameterless constructor instead of Guid.Empty @@ -1464,6 +1551,8 @@ dotnet_diagnostic.SST2014.severity = error # A goto jumps to a label dotnet_diagnostic.SST2015.severity = error # A ++ or -- is buried inside a larger expression dotnet_diagnostic.SST2016.severity = error # A DateTime on a visible signature loses its offset at the boundary dotnet_diagnostic.SST2017.severity = error # A .Date or .TimeOfDay read proves the value is only a date, or only a time of day +dotnet_diagnostic.SST2018.severity = error # A redundant null check sits beside an is type pattern +dotnet_diagnostic.SST2019.severity = error # Test for null rather than for the object type # Modern language and library usage dotnet_diagnostic.SST1700.severity = error # An extension block declares no members @@ -1474,10 +1563,13 @@ dotnet_diagnostic.SST1704.severity = error # A class declaring extension blocks dotnet_diagnostic.SST1705.severity = error # A class mixes classic extension methods with extension blocks dotnet_diagnostic.SST1706.severity = error # An extension block targets a broad receiver type such as object or dynamic dotnet_diagnostic.SST1707.severity = error # Extension blocks should be ordered by receiver type +dotnet_diagnostic.SST1708.severity = error # An extension method never uses its `this` receiver, so it need not be an extension. +dotnet_diagnostic.SST1709.severity = error # A method in a `*Extensions` class whose first parameter lacks `this`. Code fix converts it to an extension block. dotnet_diagnostic.SST1800.severity = error # Record classes should be sealed dotnet_diagnostic.SST1801.severity = error # A positional record parameter does not match the configured casing dotnet_diagnostic.SST1802.severity = error # A record declares a settable rather than init-only instance property dotnet_diagnostic.SST1803.severity = error # A record struct is not declared readonly +dotnet_diagnostic.SST1804.severity = error # A positional record has an empty `{ }` body where `;` would do. Code fix rewrites it. Info. dotnet_diagnostic.SST2100.severity = error # An empty collection creation can use [] dotnet_diagnostic.SST2101.severity = error # An explicit collection creation can use [...] dotnet_diagnostic.SST2102.severity = error # A span-targeted stackalloc initializer can use a collection expression @@ -1493,7 +1585,7 @@ dotnet_diagnostic.SST2205.severity = none # An enum switch statement omits named dotnet_diagnostic.SST2206.severity = error # An enum switch expression omits named enum values dotnet_diagnostic.SST2207.severity = error # A null guard and return can keep the throw in the returned expression dotnet_diagnostic.SST2208.severity = error # An out variable can be declared at the call site -dotnet_diagnostic.SST2209.severity = none # A null-forgiving operator has no local effect +dotnet_diagnostic.SST2209.severity = error # A null-forgiving operator has no local effect dotnet_diagnostic.SST2210.severity = error # A nullable directive repeats the current file-local state dotnet_diagnostic.SST2211.severity = error # A nullable restore directive has no file-local state to restore dotnet_diagnostic.SST2212.severity = error # Literal UTF-8 byte data can use a u8 string literal @@ -1513,8 +1605,11 @@ dotnet_diagnostic.SST2225.severity = error # A foreach loop hides an explicit el dotnet_diagnostic.SST2226.severity = error # A cast hides an inner explicit conversion dotnet_diagnostic.SST2227.severity = error # A post-assignment null fallback can be folded into the assigned expression dotnet_diagnostic.SST2228.severity = error # A delegate local used only as a call target can be a local function +dotnet_diagnostic.SST2229.severity = error # see docs/rules/SST2229.md +dotnet_diagnostic.SST2230.severity = error # see docs/rules/SST2230.md dotnet_diagnostic.SST2231.severity = error # A broad object pattern can use a direct null pattern dotnet_diagnostic.SST2232.severity = error # nameof does not need concrete generic type arguments +dotnet_diagnostic.SST2233.severity = none # see docs/rules/SST2233.md dotnet_diagnostic.SST2234.severity = error # Nullable should use the T? shorthand dotnet_diagnostic.SST2235.severity = error # Capture-free local functions should be static dotnet_diagnostic.SST2236.severity = error # Tail-position using blocks can use using declarations @@ -1524,11 +1619,46 @@ dotnet_diagnostic.SST2239.severity = error # Forwarding lambdas can use method g dotnet_diagnostic.SST2240.severity = error # Delegate null checks can use conditional invocation dotnet_diagnostic.SST2241.severity = error # Constructors that only store parameters can use primary-constructor storage dotnet_diagnostic.SST2242.severity = error # Enum switch statement mappings should name every enum value or include a catch-all -dotnet_diagnostic.SST2243.severity = error # A string literal escaping quotes or backslashes should be a raw string literal +dotnet_diagnostic.SST2243.severity = error # A verbatim string with escapes or line breaks can use a raw string literal dotnet_diagnostic.SST2244.severity = error # A numeric literal's suffix is lower case dotnet_diagnostic.SST2245.severity = error # A for loop with only a condition should be a while loop -dotnet_diagnostic.RCS1040.severity = none # covered by SST1180 - +dotnet_diagnostic.SST2246.severity = error # A chain of conditional expressions testing one value against constants can be a switch expression +dotnet_diagnostic.SST2247.severity = error # Consecutive locals copying one value's members in order can be a deconstruction +dotnet_diagnostic.SST2248.severity = error # Two constant comparisons of the same value can fold into one is-pattern +dotnet_diagnostic.SST2249.severity = error # A literal-format string.Format or literal concatenation can be an interpolated string +dotnet_diagnostic.SST2250.severity = error # A bare local assigned once by the next statement can be an initialized declaration +dotnet_diagnostic.SST2251.severity = error # A method call names type arguments that inference would supply +dotnet_diagnostic.SST2252.severity = error # A switch statement is nested inside another switch statement +dotnet_diagnostic.SST2254.severity = none # A target-typed `new()` is written where an explicit type reads more clearly; the code fix restores `new TypeName(...)`. Opt-in — the counterpart to SST2202's target-typed direction, so a team enables at most one. +dotnet_diagnostic.SST2255.severity = error # A hand-written null-or-empty string test. Code fix uses `string.IsNullOrEmpty`. +dotnet_diagnostic.SST2256.severity = error # An extension method called in static form. Code fix rewrites to instance form. Info. +dotnet_diagnostic.SST2257.severity = error # A lambda block body that is a single `return`. Code fix uses an expression body. Info. +dotnet_diagnostic.SST2258.severity = error # A redundant explicit delegate wrapper (`new EventHandler(M)`). Code fix drops it. Info. +dotnet_diagnostic.SST2259.severity = error # A stray `;` after a type declaration. Code fix removes it. Info. +dotnet_diagnostic.SST2260.severity = error # An `as` cast to a type the operand already has. Code fix removes it. Info. +dotnet_diagnostic.SST2261.severity = error # `(x && !y) +dotnet_diagnostic.SST2262.severity = error # A raw string literal whose content needs no raw syntax. Code fix demotes it. Info. +dotnet_diagnostic.SST2263.severity = error # An infinite loop whose body re-derives its stop condition. Code fix hoists the condition into the header. Info. +dotnet_diagnostic.SST2264.severity = error # A numeric literal cast to an enum. Code fix names the member. +dotnet_diagnostic.SST2265.severity = error # Consecutive fluent calls on one receiver can fold into a chain +dotnet_diagnostic.SST2266.severity = error # A local read exactly once can be inlined into that use +dotnet_diagnostic.SST2267.severity = error # Infinite loops written in mixed `while(true)`/`for(;;)` styles. Configurable. +dotnet_diagnostic.SST2268.severity = error # Inconsistent `()` on object creation with an initializer. Configurable. +dotnet_diagnostic.SST2269.severity = error # Inconsistent parentheses around a conditional's condition. Configurable. +dotnet_diagnostic.SST2270.severity = error # Inconsistent explicit-vs-implicit array-creation type. Configurable. +dotnet_diagnostic.SST2271.severity = error # `var`-vs-explicit local type per the configured preference. Configurable. +dotnet_diagnostic.SST2272.severity = error # `[Flags]` member values written as mixed decimals and shifts. Configurable. +dotnet_diagnostic.SST2273.severity = error # A function or loop body wraps its work in a trailing `if` that could be an early-exit guard clause. Code fix inverts it. Configurable threshold. +dotnet_diagnostic.SST2274.severity = error # A value assigned with `as` and then null-checked is an `is` declaration pattern in one step. Code fix rewrites it. +dotnet_diagnostic.SST2275.severity = error # A method whose block body is a single statement can use an expression body `=> expr`. Code fix rewrites it. +dotnet_diagnostic.SST2276.severity = error # A constructor whose block body is a single statement can use an expression body. Code fix rewrites it. +dotnet_diagnostic.SST2277.severity = error # An operator whose block body is a single `return` can use an expression body. Code fix rewrites it. +dotnet_diagnostic.SST2278.severity = error # A conversion operator whose block body is a single `return` can use an expression body. Code fix rewrites it. +dotnet_diagnostic.SST2279.severity = error # A get-only property whose getter is a single `return` can use a whole-member expression body. Code fix rewrites it. +dotnet_diagnostic.SST2280.severity = error # A get-only indexer whose getter is a single `return` can use a whole-member expression body. Code fix rewrites it. +dotnet_diagnostic.SST2281.severity = error # A local function whose block body is a single statement can use an expression body. Code fix rewrites it. +dotnet_diagnostic.SST2282.severity = error # A reference-type `ReferenceEquals` check against `null` reads as an `is null` / `is not null` pattern. Code fix rewrites it. +dotnet_diagnostic.SST2283.severity = error # A null guard that throws right before assigning the guarded value can fold into the assignment as `?? throw`. Code fix rewrites it. # Design dotnet_diagnostic.SST2300.severity = error # A class implements IDisposable but builds only half of the disposal pattern dotnet_diagnostic.SST2301.severity = error # A class implementing IEquatable for itself can still be derived from @@ -1537,7 +1667,7 @@ dotnet_diagnostic.SST2303.severity = error # A [Flags] enum's members are not di dotnet_diagnostic.SST2304.severity = error # An event's delegate does not have the standard (object sender, TEventArgs e) shape dotnet_diagnostic.SST2305.severity = error # A mutable collection property declares a caller-visible setter dotnet_diagnostic.SST2306.severity = error # A collection-returning member hands back null -dotnet_diagnostic.SST2307.severity = error # A generic method has a type parameter that cannot be inferred from its parameters +dotnet_diagnostic.SST2307.severity = error # A generic method's type parameter appears in no parameter, so no caller can infer it dotnet_diagnostic.SST2308.severity = error # An [Obsolete] attribute carries no message dotnet_diagnostic.SST2309.severity = error # An externally visible member declares an optional parameter, so callers bake in the default dotnet_diagnostic.SST2310.severity = error # Deprecated code is still here; remove it once its last caller is gone @@ -1545,6 +1675,27 @@ dotnet_diagnostic.SST2311.severity = error # A visible const is copied into ever dotnet_diagnostic.SST2312.severity = error # A type is declared outside any namespace dotnet_diagnostic.SST2313.severity = error # An enum is stored as a type the project does not allow dotnet_diagnostic.SST2314.severity = none # An [Obsolete] has a message but no DiagnosticId — unusable here: ObsoleteAttribute.DiagnosticId is .NET 5+, and this source is shared with net462 +dotnet_diagnostic.SST2315.severity = error # A type owns a disposable field but does not implement IDisposable +dotnet_diagnostic.SST2316.severity = error # A type declares Dispose or DisposeAsync without implementing IDisposable +dotnet_diagnostic.SST2317.severity = error # A disposable type owns a raw IntPtr without a SafeHandle or finalizer +dotnet_diagnostic.SST2318.severity = error # Two members have token-identical bodies +dotnet_diagnostic.SST2319.severity = error # An overload's optional default can never be used +dotnet_diagnostic.SST2320.severity = error # An interface inherits two interfaces that declare the same member +dotnet_diagnostic.SST2321.severity = error # Environment.Exit or Environment.FailFast is called from library code +dotnet_diagnostic.SST2322.severity = error # A non-private readonly field holds a mutable collection callers can still change +dotnet_diagnostic.SST2323.severity = error # A stateless abstract class declaring only public abstract members should be an interface +dotnet_diagnostic.SST2324.severity = error # A member is declared more accessible than its containing type +dotnet_diagnostic.SST2325.severity = error # An async method checks an argument after its first await +dotnet_diagnostic.SST2326.severity = none # An interface-typed value is narrowed to a concrete implementation — this is a high-performance core library, not strictly SOLID code, and narrowing to a known runtime type is a normal fast-path technique here: foreach over IEnumerable boxes List's struct enumerator (40 bytes per call, measured) where the indexed loop behind the type test allocates nothing +dotnet_diagnostic.SST2327.severity = error # A type tests its own runtime type against a class instead of dispatching through a virtual member +dotnet_diagnostic.SST2328.severity = error # A raw native pointer handle is exposed instead of a SafeHandle +dotnet_diagnostic.SST2329.severity = error # A `[Flags]` enum declares no zero-valued member. Code fix adds `None = 0`. +dotnet_diagnostic.SST2330.severity = error # A `[Flags]` member is a numeric literal equal to a combination of others (`All = 7`). Code fix writes `A +dotnet_diagnostic.SST2331.severity = error # An enum leaves member values implicit, so their numbers depend on declaration order +dotnet_diagnostic.SST2332.severity = error # An auto-property's `private set` is only written during construction; make it get-only. +dotnet_diagnostic.SST2333.severity = error # A generic comparison/equality contract is implemented without its non-generic counterpart +dotnet_diagnostic.SST2334.severity = error # A publicly visible type has no `[DebuggerDisplay]` +dotnet_diagnostic.SST2335.severity = error # Parts of a partial type disagree on the `static` modifier # Correctness dotnet_diagnostic.SST2400.severity = error # Two arguments name each other's parameters and have been transposed @@ -1558,11 +1709,120 @@ dotnet_diagnostic.SST2407.severity = error # A declared event is never raised dotnet_diagnostic.SST2408.severity = error # A StringBuilder is filled and never read dotnet_diagnostic.SST2409.severity = error # A throw constructs a general exception type (Exception/SystemException/ApplicationException) dotnet_diagnostic.SST2410.severity = error # A created disposable is never disposed and never leaves the method +dotnet_diagnostic.SST2411.severity = error # A for loop declares and tests a counter it never steps +dotnet_diagnostic.SST2412.severity = error # A for loop update moves the counter away from its stop condition +dotnet_diagnostic.SST2413.severity = error # A for loop condition can never be true on the first pass +dotnet_diagnostic.SST2414.severity = error # Two branches of a conditional share the same implementation +dotnet_diagnostic.SST2415.severity = error # A non-short-circuiting & or | evaluates a right operand that does work +dotnet_diagnostic.SST2416.severity = error # A modulus result on a signed type is compared directly to 1 +dotnet_diagnostic.SST2417.severity = error # A compound assignment operator is transposed (=+, =-, =!) +dotnet_diagnostic.SST2418.severity = error # The result of an immutable value's method is discarded +dotnet_diagnostic.SST2419.severity = error # A set or collection operation is performed against itself +dotnet_diagnostic.SST2420.severity = error # An IndexOf result is tested with > 0, skipping index 0 +dotnet_diagnostic.SST2421.severity = error # A write targets a readonly field of an unconstrained type parameter +dotnet_diagnostic.SST2422.severity = error # A property getter returns a different field than its setter writes +dotnet_diagnostic.SST2423.severity = error # A disposable created in a using statement is returned +dotnet_diagnostic.SST2424.severity = error # An override changes a parameter's default value +dotnet_diagnostic.SST2425.severity = error # An override drops an optional argument on its base call +dotnet_diagnostic.SST2426.severity = error # An override adds or removes params on a parameter +dotnet_diagnostic.SST2427.severity = error # A derived overload widens a parameter and hides the base overload +dotnet_diagnostic.SST2428.severity = error # A static initializer reads a static field declared later +dotnet_diagnostic.SST2429.severity = error # A setter, init, add, or remove accessor never reads value +dotnet_diagnostic.SST2430.severity = error # A serialization callback has the wrong signature +dotnet_diagnostic.SST2431.severity = error # A ToString override can return null +dotnet_diagnostic.SST2432.severity = error # GetType is called on a value that is already a System.Type +dotnet_diagnostic.SST2433.severity = error # A caller-info parameter is not last in the list +dotnet_diagnostic.SST2434.severity = error # An array is assigned through a covariant element type +dotnet_diagnostic.SST2435.severity = error # A non-object base's value-equality Equals is used as a reference-equality fast path +dotnet_diagnostic.SST2436.severity = error # An event is raised with a null sender or null args +dotnet_diagnostic.SST2437.severity = error # A generic type inherits from itself recursively +dotnet_diagnostic.SST2438.severity = error # A catch that discards its exception logs at Error or Critical without it +dotnet_diagnostic.SST2439.severity = error # An exception is passed as a log template argument instead of the exception parameter +dotnet_diagnostic.SST2440.severity = error # Log template arguments are transposed +dotnet_diagnostic.SST2441.severity = error # A log template has an empty or non-identifier placeholder +dotnet_diagnostic.SST2442.severity = error # A log template repeats a named placeholder +dotnet_diagnostic.SST2443.severity = error # An ILogger is injected or created with the wrong category type +dotnet_diagnostic.SST2444.severity = error # A regular expression pattern is invalid +dotnet_diagnostic.SST2445.severity = error # A culture-sensitive custom date or time format is used without an invariant culture +dotnet_diagnostic.SST2446.severity = error # A Stream.ReadAsync result is discarded through ConfigureAwait or a local +dotnet_diagnostic.SST2448.severity = error # A combined or opaque delegate is removed with - or -=, which strips only a contiguous run +dotnet_diagnostic.SST2449.severity = error # A lambda or anonymous-method handler is removed with -=, which never matches it +dotnet_diagnostic.SST2450.severity = error # A Debug.Assert condition performs a side effect that a release build compiles out +dotnet_diagnostic.SST2451.severity = error # Every constructor is private and no member ever creates an instance +dotnet_diagnostic.SST2452.severity = error # A [Pure] method returns void, Task, or ValueTask, so it has no observable result +dotnet_diagnostic.SST2456.severity = error # An override or new field-like event gets its own backing delegate field +dotnet_diagnostic.SST2457.severity = error # An integer Sum wrapped in unchecked still throws on overflow +dotnet_diagnostic.SST2458.severity = error # A bitwise operator is applied to an enum not declared [Flags] +dotnet_diagnostic.SST2459.severity = error # [Optional] on a ref or out parameter advertises an optionality no caller can use +dotnet_diagnostic.SST2460.severity = error # [DefaultValue] on a method or record parameter is inert +dotnet_diagnostic.SST2462.severity = error # A new member is less accessible than the inherited member it hides +dotnet_diagnostic.SST2463.severity = error # A field differs from an inherited accessible field only by case +dotnet_diagnostic.SST2464.severity = error # A mutable class declares a value-equality operator ==, so it is lost as a hash key +dotnet_diagnostic.SST2465.severity = error # A for loop body reassigns the counter or the local its condition tests +dotnet_diagnostic.SST2467.severity = error # A params overload is shadowed by a same-arity overload with a more specific last parameter +dotnet_diagnostic.SST2468.severity = error # A classic partial method is declared but never implemented, so its calls are removed +dotnet_diagnostic.SST2470.severity = error # Two string literals concatenate with no space, fusing a SQL keyword into the next token +dotnet_diagnostic.SST2472.severity = error # A type is exported for a contract it neither implements nor inherits +dotnet_diagnostic.SST2473.severity = error # A shared export part is constructed with new, bypassing the container +dotnet_diagnostic.SST2474.severity = error # A part-creation-policy attribute is applied to a type with no [Export] +dotnet_diagnostic.SST2475.severity = error # An entity's primary key is typed DateTime or DateTimeOffset +dotnet_diagnostic.SST2479.severity = error # A loop variable captured by a callback stored beyond the iteration reads its final value +dotnet_diagnostic.SST2481.severity = error # A GetHashCode override folds the base identity hash into a value hash +dotnet_diagnostic.SST2484.severity = error # A handle read through DangerousGetHandle is not reference-counted +dotnet_diagnostic.SST2485.severity = error # A NotImplementedException is left in shipped code +dotnet_diagnostic.SST2486.severity = error # An assembly is loaded by path or partial name instead of Assembly.Load +dotnet_diagnostic.SST2487.severity = error # A [ConstructorArgument] does not name a constructor parameter +dotnet_diagnostic.SST2488.severity = error # An exception is logged and rethrown, duplicating the record +dotnet_diagnostic.SST2489.severity = error # A relational comparison is decided by the operand's type rather than its value +dotnet_diagnostic.SST2490.severity = error # Adjacent try statements with identical handling should be merged +dotnet_diagnostic.SST2491.severity = error # A non-`async` method returns an awaitable from inside `using`/`try-finally`/`lock`, so the resource is torn down before the task completes. Code fix makes it `async`. +dotnet_diagnostic.SST2492.severity = error # A null-guard throws on a parameter the signature declares may be null. +dotnet_diagnostic.SST2493.severity = error # `== null`/`!= null` on an unconstrained generic `T`. Code fix uses `is null`/`is not null`. +dotnet_diagnostic.SST2494.severity = error # A `??` whose left operand is a constant null, so the right is always taken. Code fix folds it. +dotnet_diagnostic.SST2495.severity = error # A `[Flags]` combination includes an operand whose bits another already covers. Code fix removes it. +dotnet_diagnostic.SST2496.severity = error # An explicit `Dispose`/`Close` on a resource an enclosing `using` already disposes. Code fix removes it. Info. +dotnet_diagnostic.SST2497.severity = error # A member forwards to itself, so calling it recurses until the stack is gone +dotnet_diagnostic.SST2498.severity = error # `nameof` on a type parameter is the constant "T", not the substituted type's name + +# Testing +dotnet_diagnostic.SST2500.severity = error # A test method contains no assertion and no expected-exception check +dotnet_diagnostic.SST2501.severity = error # An equality or identity assertion compares an expression with itself +dotnet_diagnostic.SST2502.severity = error # An equality assertion passes the constant as actual and the computed value as expected +dotnet_diagnostic.SST2503.severity = error # An equality assertion compares a value against a boolean literal +dotnet_diagnostic.SST2504.severity = error # A test fixture declares and inherits no test method +dotnet_diagnostic.SST2505.severity = error # A test method declares parameters but no data source +dotnet_diagnostic.SST2506.severity = error # A test method calls Thread.Sleep +dotnet_diagnostic.SST2507.severity = error # A test method declares its expected failure with an expected-exception attribute +dotnet_diagnostic.SST2508.severity = error # A fluent assertion is started but never completed +dotnet_diagnostic.SST2509.severity = error # A test method has a shape the runner cannot execute + +# Logging +dotnet_diagnostic.SST2600.severity = error # Application output is written through legacy Trace instead of a structured logger +dotnet_diagnostic.SST2601.severity = error # A logger field or property does not follow the logger naming convention + +# Frameworks +dotnet_diagnostic.SST2700.severity = error # An MVC route template contains a backslash; route segments are separated by `/`, so the route is unreachable. Code fix replaces `\` with `/`. +dotnet_diagnostic.SST2701.severity = error # A `[JSInvokable]` method is not public, so JavaScript interop cannot call it. Code fix makes it public. +dotnet_diagnostic.SST2702.severity = error # A `[SupplyParameterFromQuery]` property has a type the framework cannot bind from the query string, which throws at runtime. +dotnet_diagnostic.SST2703.severity = error # A routable component's route constraint (`{id:int}`) disagrees with the matching `[Parameter]` CLR type, so the route silently fails to match. +dotnet_diagnostic.SST2704.severity = error # A public action on an `[ApiController]` declares no HTTP-verb attribute, so it answers every verb and can make routing ambiguous. +dotnet_diagnostic.SST2705.severity = error # A bound model member is a non-nullable value type with no required marker, so a request that omits it binds the default with no error +dotnet_diagnostic.SST2706.severity = error # A Windows Forms entry point carries neither `[STAThread]` nor `[MTAThread]`; without STA, clipboard, drag-and-drop, and common dialogs misbehave. Code fix adds `[STAThread]`. +dotnet_diagnostic.SST2707.severity = error # A fire-and-forget `Task.Run` in a controller captures the request's `HttpContext`, which is disposed when the request ends, so the background work throws `ObjectDisposedException` +dotnet_diagnostic.SST2708.severity = error # A component subscribes to an event in a lifecycle method but never unsubscribes, so the event source keeps the component alive — a per-session leak on a Server circuit. +dotnet_diagnostic.SST2709.severity = error # `StateHasChanged` is called while the component is being disposed, which the renderer no longer supports and throws. +dotnet_diagnostic.SST2710.severity = error # `StateHasChanged` is called directly from a timer callback, off the renderer's dispatcher; marshal it with `InvokeAsync(StateHasChanged)`. +dotnet_diagnostic.SST2711.severity = error # A synchronous component lifecycle method is overridden as `async void`, which the framework never awaits; override the `…Async` twin returning `Task`. Code fix rewrites the signature. +dotnet_diagnostic.SST2712.severity = error # An `[Inject]`/`[CascadingParameter]` property has no setter, so the framework's reflection-based binding leaves it null. Code fix adds a setter. +dotnet_diagnostic.SST2713.severity = error # A `DotNetObjectReference.Create(this)` is passed inline and never stored, so nothing can dispose it and it leaks on the JavaScript side. ################### # PerformanceSharp Analyzers (PSH) ################### -# Allocations +performancesharp.avoid_linq_on_hot_path = true +# performancesharp.empty_string_style = pattern # PSH1204 (pattern | length | is_null_or_empty; the last two are only offered where the string is provably not null) +# performancesharp.excluded_properties = Items, Keys # PSH1017 (comma-separated; properties allowed to copy on read) +# performancesharp.include_public = false # PSH1411 (set true in an app to seal public types too; a break in a library) dotnet_diagnostic.PSH1000.severity = error # Anonymous functions without captures should be static dotnet_diagnostic.PSH1001.severity = error # Avoid allocating zero-length arrays (fix prefers [] on C# 12+, else Array.Empty()) dotnet_diagnostic.PSH1002.severity = error # Empty finalizers should be removed @@ -1579,13 +1839,14 @@ dotnet_diagnostic.PSH1012.severity = error # Compare type parameter values with dotnet_diagnostic.PSH1013.severity = error # Expose constant UTF-8 data as a ReadOnlySpan property dotnet_diagnostic.PSH1014.severity = error # Declare immutable structs as readonly dotnet_diagnostic.PSH1015.severity = error # Avoid casting value types through object -dotnet_diagnostic.PSH1016.severity = error # Test enum flags with bitwise operators instead of boxing +dotnet_diagnostic.PSH1016.severity = error # Test enum flags with bitwise operators instead of Enum.HasFlag dotnet_diagnostic.PSH1017.severity = error # A property allocates a copy of a collection on every read (excludable via performancesharp.PSH1017.excluded_properties) dotnet_diagnostic.PSH1018.severity = error # A hand-written array is passed to a params parameter dotnet_diagnostic.PSH1019.severity = error # The range indexer on an array allocates a copy; slice with AsSpan/AsMemory dotnet_diagnostic.PSH1020.severity = error # Prefer a jagged array over a multidimensional one - -# Collections +dotnet_diagnostic.PSH1021.severity = error # An explicit GC.Collect or GC.WaitForPendingFinalizers forces collection the runtime tunes itself +dotnet_diagnostic.PSH1022.severity = error # A parameterless `new EventArgs()` allocates where the shared `EventArgs.Empty` singleton would serve. Code fix uses the singleton. +dotnet_diagnostic.PSH1023.severity = error # A local anonymous type allocates where a tuple would not dotnet_diagnostic.PSH1100.severity = error # Hot-path code should avoid System.Linq.Enumerable calls dotnet_diagnostic.PSH1101.severity = none # LINQ terminal predicate simplification is reserved for test code; production code should avoid LINQ on hot paths dotnet_diagnostic.PSH1102.severity = none # LINQ type-filter simplification is reserved for test code; production code should avoid LINQ on hot paths @@ -1600,20 +1861,18 @@ dotnet_diagnostic.PSH1110.severity = error # Use the collection's own predicate dotnet_diagnostic.PSH1111.severity = error # Use Contains for membership tests dotnet_diagnostic.PSH1112.severity = error # Seed the collection through its constructor (fix honors performancesharp.prefer_collection_expressions) dotnet_diagnostic.PSH1113.severity = error # Sort naturally instead of ordering by the element itself -# dotnet_diagnostic.PSH1114.severity = error # Freeze static lookup collections (opt-in; freezing trades slower construction for faster reads) +dotnet_diagnostic.PSH1114.severity = error # Freeze static lookup collections that are never mutated dotnet_diagnostic.PSH1115.severity = error # Insert-if-absent should probe the dictionary once dotnet_diagnostic.PSH1116.severity = error # Probe string-keyed collections with a span through GetAlternateLookup dotnet_diagnostic.PSH1117.severity = error # Ask the collection whether it is empty -dotnet_diagnostic.PSH1118.severity = error # Take the extreme element without sorting the whole sequence -dotnet_diagnostic.PSH1119.severity = error # Check for elements without counting them all -dotnet_diagnostic.PSH1120.severity = error # Do not materialize a sequence just to enumerate it +dotnet_diagnostic.PSH1118.severity = error # Take the extreme element with Min/Max/MinBy/MaxBy instead of sorting +dotnet_diagnostic.PSH1119.severity = error # Check for elements with Any instead of counting them all +dotnet_diagnostic.PSH1120.severity = error # Do not materialize a sequence with ToList/ToArray just to enumerate it dotnet_diagnostic.PSH1122.severity = error # Read a sorted set's extreme through its Min/Max property, not the LINQ extension dotnet_diagnostic.PSH1124.severity = error # Read a linked list's end through its First/Last property, not the LINQ extension dotnet_diagnostic.PSH1125.severity = error # Do not enumerate the same lazy sequence twice dotnet_diagnostic.PSH1126.severity = error # Ask whether an async sequence has elements instead of counting them dotnet_diagnostic.PSH1127.severity = error # Clear an array instead of filling it with its default - -# Strings dotnet_diagnostic.PSH1200.severity = error # Compare strings without allocating case-converted copies dotnet_diagnostic.PSH1201.severity = error # Use the char overload for single-character strings dotnet_diagnostic.PSH1202.severity = error # Append characters as char, not single-character strings @@ -1628,9 +1887,9 @@ dotnet_diagnostic.PSH1210.severity = error # Compare UTF-8 bytes without decodin dotnet_diagnostic.PSH1211.severity = error # Pass values directly instead of ToString results dotnet_diagnostic.PSH1212.severity = error # Slice with AsSpan when the call accepts a span dotnet_diagnostic.PSH1213.severity = error # Probe repeated character sets through SearchValues -dotnet_diagnostic.PSH1214.severity = error # Append the parts, not a concatenated whole -dotnet_diagnostic.PSH1215.severity = error # Concatenate when there is no separator to join on -dotnet_diagnostic.PSH1216.severity = error # Ask for equality, not ordering, when only equality matters +dotnet_diagnostic.PSH1214.severity = error # Append the parts of a concatenation separately, not the concatenated whole +dotnet_diagnostic.PSH1215.severity = error # Use string.Concat instead of string.Join with an empty separator +dotnet_diagnostic.PSH1216.severity = error # Use string.Equals instead of comparing string.Compare to zero dotnet_diagnostic.PSH1217.severity = error # A sequence is copied to an array just to be read straight back dotnet_diagnostic.PSH1218.severity = error # A substring is allocated only to search it; slice with AsSpan instead dotnet_diagnostic.PSH1219.severity = error # Ask whether a string is blank without trimming it @@ -1640,26 +1899,25 @@ dotnet_diagnostic.PSH1222.severity = error # Concatenate slices without material dotnet_diagnostic.PSH1223.severity = error # A reused composite format string is re-parsed on every call dotnet_diagnostic.PSH1224.severity = error # Convert bytes to hex in one call, not by building the string twice dotnet_diagnostic.PSH1225.severity = error # Decode bytes to a string in one call, without a throwaway char[] - -# Concurrency +dotnet_diagnostic.PSH1226.severity = error # A string's `ToCharArray()` result is only iterated, allocating a throwaway `char[]`; iterate the string directly. Code fix drops the copy. +dotnet_diagnostic.PSH1227.severity = error # A cheaper equivalent exists — `string.CompareOrdinal` over `Compare(…, Ordinal)`, `Debug.Fail` over `Debug.Assert(false, …)`. Info. Code fix rewrites the call. dotnet_diagnostic.PSH1300.severity = error # Use System.Threading.Lock for a dedicated lock object dotnet_diagnostic.PSH1301.severity = error # Do not wrap a single task in WhenAll or WaitAll dotnet_diagnostic.PSH1302.severity = error # TaskCompletionSource should run continuations asynchronously dotnet_diagnostic.PSH1303.severity = error # Do not block an async method with Thread.Sleep dotnet_diagnostic.PSH1304.severity = error # Use PeriodicTimer instead of pacing a loop with Task.Delay dotnet_diagnostic.PSH1305.severity = error # Enumerate a ConcurrentDictionary directly, not its Keys/Values snapshots -# dotnet_diagnostic.PSH1306.severity = error # Guard one-time execution with an interlocked latch (opt-in; thread-safety needs are contextual) +dotnet_diagnostic.PSH1306.severity = error # Guard one-time execution with an interlocked latch dotnet_diagnostic.PSH1307.severity = error # Access interlocked fields with Volatile dotnet_diagnostic.PSH1308.severity = error # Return the completed task instead of Task.FromResult -# dotnet_diagnostic.PSH1309.severity = error # Register cancellation callbacks without flowing the execution context (opt-in; changes AsyncLocal visibility) -dotnet_diagnostic.PSH1310.severity = error # Dispose asynchronously in async code -dotnet_diagnostic.PSH1311.severity = error # Remove a pass-through async state machine -dotnet_diagnostic.PSH1312.severity = error # Return a completed task, never null +dotnet_diagnostic.PSH1309.severity = error # Register cancellation callbacks without flowing the execution context +dotnet_diagnostic.PSH1310.severity = error # Dispose IAsyncDisposable resources with await using in async code +dotnet_diagnostic.PSH1311.severity = error # Remove a pass-through async state machine and return the task directly +dotnet_diagnostic.PSH1312.severity = error # Return a completed task instead of null dotnet_diagnostic.PSH1313.severity = error # A synchronous call where an async overload fits dotnet_diagnostic.PSH1314.severity = error # Read and write streams through the memory-based overloads dotnet_diagnostic.PSH1315.severity = error # A blocking wait on an awaitable that may not be done - -# API selection +dotnet_diagnostic.PSH1316.severity = error # A ValueTask is awaited in a loop or awaited after being copied dotnet_diagnostic.PSH1400.severity = error # Use the static HashData method for one-shot hashing dotnet_diagnostic.PSH1401.severity = error # Attribute types should be sealed dotnet_diagnostic.PSH1402.severity = error # Use const for compile-time constants @@ -1670,7 +1928,7 @@ dotnet_diagnostic.PSH1406.severity = error # Ask Regex for the answer directly dotnet_diagnostic.PSH1407.severity = error # Query the dictionary, not its Keys view dotnet_diagnostic.PSH1408.severity = error # Measure elapsed time with Stopwatch timestamps dotnet_diagnostic.PSH1409.severity = error # Use the built-in throw helpers for argument guards -# dotnet_diagnostic.PSH1410.severity = error # Mark trivial forwarders for aggressive inlining (opt-in; opinionated convention) +dotnet_diagnostic.PSH1410.severity = error # Mark trivial forwarders for aggressive inlining dotnet_diagnostic.PSH1411.severity = error # Seal non-public types nothing derives from so the JIT can devirtualize dotnet_diagnostic.PSH1412.severity = error # Use Random.Shared instead of allocating a Random dotnet_diagnostic.PSH1413.severity = error # Read the Unix epoch from the framework, not a hand-built DateTime @@ -1678,17 +1936,131 @@ dotnet_diagnostic.PSH1414.severity = error # Mark members that do not touch inst dotnet_diagnostic.PSH1415.severity = error # Hold the concrete type when the concrete type is what you have dotnet_diagnostic.PSH1416.severity = error # Cache the serializer options instead of building them per call dotnet_diagnostic.PSH1417.severity = error # Do not compute an expensive argument for an assertion +dotnet_diagnostic.PSH1418.severity = error # An HttpClient is constructed on every call +dotnet_diagnostic.PSH1419.severity = error # A time-zone is resolved with a platform-specific id instead of the cross-platform API +dotnet_diagnostic.PSH1420.severity = error # A shareable client held in an instance field of an Azure Functions worker class is rebuilt on every invocation, leaking sockets and connections; share a static/singleton client or inject `IHttpClientFactory`. + +# ASP.NET Core - inert in this repo (no route handlers or middleware), enabled so the set stays complete +dotnet_diagnostic.PSH1500.severity = error # A minimal API handler returns Results instead of TypedResults, boxing the result +dotnet_diagnostic.PSH1501.severity = error # Middleware uses the legacy nested-delegate Use overload, allocating a per-request closure +dotnet_diagnostic.PSH1502.severity = error # A route handler returns a deferred sequence the serializer enumerates on the request thread +dotnet_diagnostic.PSH1503.severity = error # Response caching is used where server-side output caching applies +dotnet_diagnostic.PSH1505.severity = error # Exceptions are handled in an MVC exception filter instead of an IExceptionHandler +dotnet_diagnostic.PSH1506.severity = error # The HTTP request or response body is read or written synchronously (`ReadToEnd`, `Body.Read`, `Body.Write`), which blocks a thread on Kestrel and buffers the whole payload; use the async overload. Code fix awaits it when the method is already async. + +# Blazor +dotnet_diagnostic.PSH1600.severity = error # A delegate captured per iteration inside a component render loop reallocates on every render (measured ~128 B per row per render) and churns the diff; hoist it to a cached delegate or a precomputed per-item model. +dotnet_diagnostic.PSH1601.severity = error # A JavaScript-interop call is issued once per loop iteration; on Interactive Server each is a separate SignalR round-trip. Batch into a single call over the collection. +dotnet_diagnostic.PSH1602.severity = error # `StateHasChanged` is called unconditionally in `OnAfterRender`/`OnAfterRenderAsync`, scheduling another render every time — a runaway loop. Guard it with `firstRender` or a state flag. +dotnet_diagnostic.PSH1603.severity = error # A non-delegate allocation is used as a component-parameter value inside a render loop, allocating per item and forcing the child to re-render each pass. Sibling of PSH1600. + +################### +# SecuritySharp Analyzers (SES) +################### +# Every rule is raised to error, including the three that ship at suggestion (SES1403, SES1506, +# SES1605). Security rules only ever suggest an API they can resolve in the compilation and report +# local shapes only - there is no interprocedural taint tracking, so the taint-flow CA rules stay on. +# securitysharp.SES1003.iterations = 100000 # minimum accepted PBKDF2 iteration count +# securitysharp.SES1403.maxdepth = 64 # highest accepted System.Text.Json MaxDepth + +# Cryptography +dotnet_diagnostic.SES1001.severity = error # AEAD encryption must not use a constant or reused nonce +dotnet_diagnostic.SES1002.severity = error # Password-based key derivation must not use a constant or predictable salt +dotnet_diagnostic.SES1003.severity = error # Password-based key derivation must use a sufficient iteration count +dotnet_diagnostic.SES1004.severity = error # A secret must not be produced from Guid.NewGuid() +dotnet_diagnostic.SES1005.severity = error # Compare secret values in constant time +dotnet_diagnostic.SES1006.severity = error # A Data Protection key ring is persisted without a ProtectKeysWith call, so keys sit unencrypted at rest +dotnet_diagnostic.SES1007.severity = error # A cryptographic primitive is implemented by hand instead of using a vetted platform algorithm +dotnet_diagnostic.SES1008.severity = error # An XML signature is verified with the no-key CheckSignature overload, trusting the document's own KeyInfo +dotnet_diagnostic.SES1009.severity = error # A password is stored without a slow, salted key-derivation function + +# Transport +dotnet_diagnostic.SES1102.severity = error # Do not accept any server certificate +dotnet_diagnostic.SES1104.severity = error # Certificate-chain validation must not be deliberately weakened +dotnet_diagnostic.SES1105.severity = error # Bearer and OpenID Connect metadata must not be retrieved over plain HTTP outside development +dotnet_diagnostic.SES1106.severity = error # Do not send HttpClient requests to a cleartext http URL +dotnet_diagnostic.SES1107.severity = error # A SQL connection string weakens transport security via TrustServerCertificate or a disabled Encrypt +dotnet_diagnostic.SES1108.severity = error # A custom server-certificate validation callback unconditionally returns true, so any certificate is trusted + +# Secrets +dotnet_diagnostic.SES1201.severity = error # Do not hard-code secrets in source +dotnet_diagnostic.SES1202.severity = error # Do not hard-code a credential value +dotnet_diagnostic.SES1203.severity = error # A connection string names a user but supplies an empty or missing password + +# Injection +dotnet_diagnostic.SES1301.severity = error # Do not build a process command line from non-constant string parts +dotnet_diagnostic.SES1302.severity = error # A shell-executed process must not use a non-constant FileName +dotnet_diagnostic.SES1303.severity = error # Regular-expression pattern must not be built from non-constant data +dotnet_diagnostic.SES1304.severity = error # An archive entry name must not build a write path without a containment check +dotnet_diagnostic.SES1305.severity = error # Do not build a storage path from an uploaded file name +dotnet_diagnostic.SES1306.severity = error # Do not compile or execute non-constant C# via the scripting API +dotnet_diagnostic.SES1307.severity = error # Path.GetTempFileName creates a predictable, world-readable temporary file +dotnet_diagnostic.SES1308.severity = error # A file or directory is created group- or world-writable +dotnet_diagnostic.SES1309.severity = error # An XSLT stylesheet is loaded with embedded script enabled +dotnet_diagnostic.SES1310.severity = error # A directory bind is performed without authenticating + +# Serialization +dotnet_diagnostic.SES1401.severity = error # A type resolved from non-constant data must not be instantiated or deserialized +dotnet_diagnostic.SES1402.severity = error # Do not load an assembly from raw bytes or a non-constant location +dotnet_diagnostic.SES1403.severity = error # JSON deserialization depth limit must stay within a safe ceiling +dotnet_diagnostic.SES1404.severity = error # A type is instantiated by name from a non-constant Activator typeName +dotnet_diagnostic.SES1405.severity = error # MessagePack typeless deserialization reconstructs whatever type the payload names +dotnet_diagnostic.SES1406.severity = error # Reflection must not reach non-public members via BindingFlags.NonPublic + +# Web hardening +dotnet_diagnostic.SES1501.severity = error # A CORS policy must not allow credentials together with any origin +dotnet_diagnostic.SES1502.severity = error # A CORS origin predicate must not unconditionally allow every origin +dotnet_diagnostic.SES1503.severity = error # JWT signature verification must not be disabled on TokenValidationParameters +dotnet_diagnostic.SES1504.severity = error # A cookie with SameSite=None must be marked Secure +dotnet_diagnostic.SES1505.severity = error # The request body size limit must not be removed +dotnet_diagnostic.SES1506.severity = error # The developer exception page must be guarded by a development-environment check +dotnet_diagnostic.SES1507.severity = error # AllowAnonymous and Authorize on the same declaration conflict +dotnet_diagnostic.SES1508.severity = error # A validation method must not fail open by returning success from a catch +dotnet_diagnostic.SES1509.severity = error # A backtracking-prone constant regex runs without a match timeout or NonBacktracking +dotnet_diagnostic.SES1510.severity = error # A controller redirects to a non-constant URL, allowing an open redirect +dotnet_diagnostic.SES1511.severity = error # The forwarded-headers trust boundary is cleared, letting proxies spoof the client IP +dotnet_diagnostic.SES1512.severity = error # Sensitive framework diagnostics are enabled without a development-environment guard +dotnet_diagnostic.SES1513.severity = error # An AuthorizeAsync result is discarded, so the guarded operation runs regardless +dotnet_diagnostic.SES1514.severity = error # OpenID Connect protections (PKCE, state, nonce) are disabled +dotnet_diagnostic.SES1515.severity = error # A Content-Security-Policy value disables its own protection + +# AI trust boundaries +dotnet_diagnostic.SES1601.severity = error # An LLM system prompt must be a constant, trusted template +dotnet_diagnostic.SES1602.severity = error # Do not route AI model output into a process, file, or raw SQL sink +dotnet_diagnostic.SES1603.severity = error # An AI tool declared read-only or non-destructive must not call a state-changing API +dotnet_diagnostic.SES1604.severity = error # Prompt-template input encoding must not be disabled +dotnet_diagnostic.SES1605.severity = error # AI instrumentation must not enable sensitive-data capture +dotnet_diagnostic.SES1606.severity = error # Do not fetch model weights over cleartext HTTP + +# Web UI trust boundaries +dotnet_diagnostic.SES1701.severity = error # Raw HTML is rendered from a non-constant value (`MarkupString`/`AddMarkupContent`), bypassing automatic encoding — an XSS risk. Sanitizer allow-list via `securitysharp.SES1701.sanitizers`. +dotnet_diagnostic.SES1702.severity = error # A JavaScript-interop call targets a script-evaluation primitive (`eval`, `Function`, `document.write`), turning interop into a script-injection channel. +dotnet_diagnostic.SES1703.severity = error # `[Authorize]` on a non-routable component enforces nothing — authorization runs as a routing concern. Exempt types via `securitysharp.SES1703.exempt_types`. +dotnet_diagnostic.SES1704.severity = error # `IHttpContextAccessor` or a cascading `HttpContext` is used in an interactively-rendered component, where it is null or frozen at circuit start. +dotnet_diagnostic.SES1705.severity = error # `NavigationManager.NavigateTo` is called with a target that is not a verified relative URL — an open-redirect risk. Validator allow-list via `securitysharp.SES1705.validators`. +dotnet_diagnostic.SES1706.severity = error # An uploaded file is read with an unbounded or client-chosen size limit, letting an attacker fill server memory. Threshold via `securitysharp.SES1706.max_bytes`. +dotnet_diagnostic.SES1707.severity = error # A secret-shaped literal appears in code reachable as WebAssembly, which downloads to the browser in full — guaranteed disclosure. +dotnet_diagnostic.SES1708.severity = error # `CircuitOptions.DetailedErrors` is enabled, shipping server exception detail to every connected client. +dotnet_diagnostic.SES1709.severity = error # `SerializeAllClaims` serializes every claim into client-readable WebAssembly authentication state, exposing internal ids, tokens, and PII. +dotnet_diagnostic.SES1710.severity = error # Antiforgery validation is disabled on a form (`[RequireAntiforgeryToken(required: false)]`), removing CSRF protection. + ################### -# Public API surface tracking (PASxxxx) -# PAS0001/PAS0002/PAS0003/PAS0005 are errors by default and need no entry here. +# Public API surface tracking (PAS) ################### -dotnet_diagnostic.PAS0004.severity = warning # no public API baseline for this target framework +dotnet_diagnostic.PAS0001.severity = error # A public symbol is missing from the baseline for this target framework +dotnet_diagnostic.PAS0002.severity = error # A baseline entry no longer exists in the public API +dotnet_diagnostic.PAS0003.severity = error # A public symbol differs from its baseline entry +dotnet_diagnostic.PAS0004.severity = error # No public API baseline for this target framework +dotnet_diagnostic.PAS0005.severity = error # The public API baseline could not be read +dotnet_diagnostic.RS0016.severity = error # A public symbol is missing from the PublicAPI baseline +dotnet_diagnostic.RS0017.severity = error # A PublicAPI baseline entry no longer exists in source ################### -# Trimming Analyzer Warnings (IL2001 - IL2123) -# See: https://learn.microsoft.com/en-us/dotnet/core/deploying/trimming/trim-warnings/ +# Microsoft.NET.ILLink.Analyzers (IL) ################### +# Trimming +# See: https://learn.microsoft.com/en-us/dotnet/core/deploying/trimming/trim-warnings/ dotnet_diagnostic.IL2001.severity = error # Type in UnreferencedCode attribute doesn't have matching RequiresUnreferencedCode dotnet_diagnostic.IL2002.severity = error # Method with RequiresUnreferencedCode called from code without that attribute dotnet_diagnostic.IL2003.severity = error # RequiresUnreferencedCode attribute is only supported on methods @@ -1804,10 +2176,8 @@ dotnet_diagnostic.IL2117.severity = error # Methods with DynamicallyAccessedMemb dotnet_diagnostic.IL2122.severity = error # Reflection call to method with UnreferencedCode attribute cannot be statically analyzed dotnet_diagnostic.IL2123.severity = error # DynamicallyAccessedMembers on method or parameter doesn't match overridden member -################### -# AOT Analyzer Warnings (IL3xxx) +# Native AOT # See: https://learn.microsoft.com/en-us/dotnet/core/deploying/native-aot/warnings/ -################### dotnet_diagnostic.IL3050.severity = error # Using member annotated with RequiresDynamicCode dotnet_diagnostic.IL3051.severity = error # RequiresDynamicCode attribute is only supported on methods and constructors dotnet_diagnostic.IL3052.severity = error # RequiresDynamicCode attribute on type is not supported @@ -1818,8 +2188,15 @@ dotnet_diagnostic.IL3056.severity = error # MakeGenericMethod on non-supported m dotnet_diagnostic.IL3057.severity = error # Reflection access to generic parameter requires dynamic code ################### -# SonarAnalyzer (Sxxxx) - Blocker Bug +# SonarAnalyzer.CSharp (S) ################### +# Repository suppressions +dotnet_diagnostic.S1075.severity = none # Hardcoded URI — canonical SourceLink hosts are the point +dotnet_diagnostic.S2436.severity = none # Too many generic parameters — needed for the projector overload +dotnet_diagnostic.S4036.severity = none # PATH-relative process spawn — benchmark only, trusted env +dotnet_diagnostic.S8969.severity = none # Nullability inference is inconsistent across the repository's target frameworks + +# Blocker bugs dotnet_diagnostic.S1048.severity = none # Finalizers should not throw exceptions — covered by SST1485 dotnet_diagnostic.S2190.severity = none # Loops and recursions should not be infinite dotnet_diagnostic.S2275.severity = none # Composite format strings should not lead to unexpected behavior at runtime - DUPLICATE CA2241 @@ -1831,9 +2208,7 @@ dotnet_diagnostic.S3869.severity = none # "SafeHandle.DangerousGetHandle" should dotnet_diagnostic.S3889.severity = none # "Thread.Resume" and "Thread.Suspend" should not be used -> replaced by obsolete or compiler dotnet_diagnostic.S4159.severity = none # Classes should implement their "ExportAttribute" interfaces — covered by SST2472 -################### -# SonarAnalyzer (Sxxxx) - Critical Bug -################### +# Critical bugs dotnet_diagnostic.S2551.severity = none # Shared resources should not be used for locking — covered by SST1902 dotnet_diagnostic.S2952.severity = none # Classes should "Dispose" of members from the classes' own "Dispose" methods -> replaced by SST2315 dotnet_diagnostic.S3449.severity = none # Right operands of shift operators should be integers -> replaced by SST1478 @@ -1844,9 +2219,7 @@ dotnet_diagnostic.S4586.severity = none # Non-async "Task/Task" methods shoul dotnet_diagnostic.S5856.severity = none # Regular expressions should be syntactically valid — covered by SST2444 dotnet_diagnostic.S6674.severity = none # Log message template should be syntactically correct — covered by SST2441 -################### -# SonarAnalyzer (Sxxxx) - Major Bug -################### +# Major bugs dotnet_diagnostic.S1244.severity = none # Floating point numbers should not be tested for equality — covered by SST1473 dotnet_diagnostic.S1656.severity = none # Variables should not be self-assigned — covered by SST1189 dotnet_diagnostic.S1751.severity = none # Loops with at most one iteration should be refactored - covered by SST1444 @@ -1896,9 +2269,7 @@ dotnet_diagnostic.S6798.severity = none # [JSInvokable] attribute should only be dotnet_diagnostic.S6800.severity = none # Component parameter type should match the route parameter type constraint -> replaced by SST2703 dotnet_diagnostic.S6930.severity = none # Backslash should be avoided in route templates -> replaced by SST2700 -################### -# SonarAnalyzer (Sxxxx) - Minor Bug -################### +# Minor bugs dotnet_diagnostic.S1206.severity = none # "Equals(Object)" and "GetHashCode()" should be overridden in pairs - DUPLICATE CA2218 dotnet_diagnostic.S1226.severity = none # Method parameters, caught exceptions and foreach variables' initial values should not be ignored dotnet_diagnostic.S2183.severity = none # Integral numbers should not be shifted by zero or more than their number of bits-1 — covered by SST1478 @@ -1913,17 +2284,13 @@ dotnet_diagnostic.S3397.severity = none # "base.Equals" should not be used to ch dotnet_diagnostic.S3456.severity = none # "string.ToCharArray()" and "ReadOnlySpan.ToArray()" should not be called redundantly — covered by PSH1217 dotnet_diagnostic.S3887.severity = none # Mutable, non-private fields should not be "readonly" — covered by SST2322 -################### -# SonarAnalyzer (Sxxxx) - Blocker Vulnerability -################### +# Blocker vulnerabilities dotnet_diagnostic.S2115.severity = none # A secure password should be used when connecting to a database -> replaced by SES1203 dotnet_diagnostic.S2755.severity = none # XML parsers should not be vulnerable to XXE attacks -> replaced by CA3075 dotnet_diagnostic.S3884.severity = none # "CoSetProxyBlanket" and "CoInitializeSecurity" should not be used -> replaced by obsolete (COM interop security) dotnet_diagnostic.S6418.severity = none # Secrets should not be hard-coded — covered by SES1201 -################### -# SonarAnalyzer (Sxxxx) - Critical Vulnerability -################### +# Critical vulnerabilities dotnet_diagnostic.S4423.severity = none # Weak SSL/TLS protocols should not be used -> replaced by CA5397/CA5398 dotnet_diagnostic.S4426.severity = none # Cryptographic keys should be robust -> replaced by CA5385 (RSA) / CA5384 (DSA) dotnet_diagnostic.S4433.severity = none # LDAP connections should be authenticated -> replaced by SES1310 @@ -1934,9 +2301,7 @@ dotnet_diagnostic.S5542.severity = none # Encryption algorithms should be used w dotnet_diagnostic.S5547.severity = none # Cipher algorithms should be robust -> replaced by CA5351 dotnet_diagnostic.S5659.severity = none # JWT should be signed and verified with strong cipher algorithms -> replaced by SES1503 -################### -# SonarAnalyzer (Sxxxx) - Major Vulnerability -################### +# Major vulnerabilities dotnet_diagnostic.S2068.severity = none # Credentials should not be hard-coded -> replaced by SES1201 dotnet_diagnostic.S2612.severity = none # File permissions should not be set to world-accessible values -> replaced by SES1308 dotnet_diagnostic.S4211.severity = none # Members should not have conflicting transparency annotations -> replaced by obsolete (Code Access Security) @@ -1944,9 +2309,7 @@ dotnet_diagnostic.S4212.severity = none # Serialization constructors should be s dotnet_diagnostic.S6377.severity = none # XML signatures should be validated securely -> replaced by SES1008 dotnet_diagnostic.S7039.severity = none # Content Security Policies should be restrictive -> replaced by SES1515 -################### -# SonarAnalyzer (Sxxxx) - Blocker Code Smell -################### +# Blocker code smells dotnet_diagnostic.S1147.severity = none # Exit methods should not be called — covered by SST2321 dotnet_diagnostic.S1451.severity = none # Track lack of copyright and license headers dotnet_diagnostic.S2178.severity = none # Short-circuit logic should be used in boolean contexts — covered by SST2415 @@ -1969,9 +2332,7 @@ dotnet_diagnostic.S4462.severity = none # Calls to "async" methods should not be dotnet_diagnostic.S6422.severity = none # Calls to "async" methods should not be blocking in Azure Functions — covered by PSH1315 dotnet_diagnostic.S6424.severity = none # Interfaces for durable entities should satisfy the restrictions -> off: Durable Entity-specific; not used in this library -################### -# SonarAnalyzer (Sxxxx) - Critical Code Smell -################### +# Critical code smells dotnet_diagnostic.S1006.severity = none # Method overrides should not change parameter defaults — covered by SST2424 dotnet_diagnostic.S1067.severity = none # Expressions should not be too complex dotnet_diagnostic.S1163.severity = none # Exceptions should not be thrown in finally blocks -> replaced by CA2219 @@ -2034,9 +2395,7 @@ dotnet_diagnostic.S8380.severity = none # Return types named "partial" should be dotnet_diagnostic.S8381.severity = none # "scoped" should be escaped when used as an identifier or type name in parenthesized lambda parameter lists -> replaced by compiler dotnet_diagnostic.S927.severity = none # Parameter names should match base declaration and other partial definitions - DUPLICATE CA1725 -################### -# SonarAnalyzer (Sxxxx) - Major Code Smell -################### +# Major code smells dotnet_diagnostic.S103.severity = none # Lines should not be too long — covered by SST1521 dotnet_diagnostic.S104.severity = none # Files should not have too many lines of code — covered by SST1522 dotnet_diagnostic.S106.severity = none # Covered by SST1449 (canonical) @@ -2082,348 +2441,6 @@ dotnet_diagnostic.S2933.severity = none # Fields that are only assigned in the c dotnet_diagnostic.S2971.severity = none # LINQ expressions should be simplified — covered by PSH1101/PSH1102 dotnet_diagnostic.S3010.severity = none # Static fields should not be updated in constructors — covered by SST2402 dotnet_diagnostic.S3011.severity = none # Reflection should not be used to increase accessibility of classes, methods, or fields -> replaced by SES1406 -dotnet_diagnostic.SES1406.severity = warning # Reflection must not reach non-public members via BindingFlags.NonPublic (opt-in; replaces S3011) - -# RoslynCommonAnalyzers rules added to reach 3.37.0 (on-by-default enforced; opt-in left off) -dotnet_diagnostic.PSH1021.severity = error # An explicit `GC.Collect` or `GC.WaitForPendingFinalizers` call forces collection the runtime tunes itself. -dotnet_diagnostic.PSH1022.severity = error # A parameterless `new EventArgs()` allocates where the shared `EventArgs.Empty` singleton would serve. Code fix uses the singleton. -dotnet_diagnostic.PSH1114.severity = none # Freeze static lookup collections that are never mutated. Opt-in. -dotnet_diagnostic.PSH1226.severity = error # A string's `ToCharArray()` result is only iterated, allocating a throwaway `char[]`; iterate the string directly. Code fix drops the copy. -dotnet_diagnostic.PSH1227.severity = error # A cheaper equivalent exists — `string.CompareOrdinal` over `Compare(…, Ordinal)`, `Debug.Fail` over `Debug.Assert(false, …)`. Info. Code fix rewrites the call. -dotnet_diagnostic.PSH1306.severity = none # Guard one-time execution with an interlocked latch. Opt-in. -dotnet_diagnostic.PSH1309.severity = none # Register cancellation callbacks without flowing the execution context. Opt-in. -dotnet_diagnostic.PSH1316.severity = error # A `ValueTask` is consumed more than once - awaited across loop iterations, or through a copy - so a later consume reads a recycled pooled token. Code fix hoists the producer into the loop. -dotnet_diagnostic.PSH1410.severity = none # Mark trivial forwarders for aggressive inlining. Opt-in. -dotnet_diagnostic.PSH1418.severity = error # A shareable client (`HttpClient` or an Azure SDK service client) is constructed for a single call, so its pooled connections and caches die with it and every call pays the setup cost again. -dotnet_diagnostic.PSH1419.severity = error # A call to the TimeZoneConverter package where the built-in `TimeZoneInfo` now resolves IANA and Windows ids cross-platform (.NET 6+). Code fix rewrites `GetTimeZoneInfo` to `TimeZoneInfo.FindSystemTimeZoneById`. -dotnet_diagnostic.PSH1420.severity = error # A shareable client held in an instance field of an Azure Functions worker class is rebuilt on every invocation, leaking sockets and connections; share a static/singleton client or inject `IHttpClientFactory`. -dotnet_diagnostic.PSH1500.severity = error # A route handler returns `Results.*`; `TypedResults.*` avoids boxing the result and gives the endpoint its response metadata. Code fix rewrites the call. -dotnet_diagnostic.PSH1501.severity = error # Middleware is registered in the legacy `Use(next => context => ...)` nested-delegate form, which allocates a per-request closure; the two-parameter `Use((context, next) => ...)` overload does not. -dotnet_diagnostic.PSH1502.severity = error # A route handler returns a deferred `IEnumerable` (an `IQueryable` or an un-materialized LINQ query), so the response serializer enumerates it synchronously on the request thread. -dotnet_diagnostic.PSH1503.severity = error # The legacy response-caching middleware only honors HTTP cache-control headers; output caching (.NET 7+) caches on the server under keys you control and can be invalidated. Info. -dotnet_diagnostic.PSH1505.severity = error # A class implements an MVC exception filter (`IExceptionFilter`/`IAsyncExceptionFilter`); centralized error handling belongs in an `IExceptionHandler` the pipeline runs once. Info. -dotnet_diagnostic.PSH1506.severity = error # The HTTP request or response body is read or written synchronously (`ReadToEnd`, `Body.Read`, `Body.Write`), which blocks a thread on Kestrel and buffers the whole payload; use the async overload. Code fix awaits it when the method is already async. -dotnet_diagnostic.PSH1600.severity = error # A delegate captured per iteration inside a component render loop reallocates on every render (measured ~128 B per row per render) and churns the diff; hoist it to a cached delegate or a precomputed per-item model. -dotnet_diagnostic.PSH1601.severity = error # A JavaScript-interop call is issued once per loop iteration; on Interactive Server each is a separate SignalR round-trip. Batch into a single call over the collection. -dotnet_diagnostic.PSH1602.severity = error # `StateHasChanged` is called unconditionally in `OnAfterRender`/`OnAfterRenderAsync`, scheduling another render every time — a runaway loop. Guard it with `firstRender` or a state flag. -dotnet_diagnostic.PSH1603.severity = error # A non-delegate allocation is used as a component-parameter value inside a render loop, allocating per item and forcing the child to re-render each pass. Sibling of PSH1600. -dotnet_diagnostic.SES1001.severity = error # AEAD encryption (`AesGcm`/`AesCcm`/`ChaCha20Poly1305`) uses a constant or reused nonce, which is catastrophic under a fixed key. -dotnet_diagnostic.SES1002.severity = error # Password-based key derivation (`Rfc2898DeriveBytes`/`Pbkdf2`) is given a constant or predictable salt, letting an attacker precompute rainbow tables and defeating per-secret salting. -dotnet_diagnostic.SES1003.severity = error # A `Rfc2898DeriveBytes.Pbkdf2` one-shot derives a key with a constant iteration count below the configured floor (default 100000), leaving offline password cracking cheap. -dotnet_diagnostic.SES1004.severity = error # A secret (token, key, password, nonce, salt, session id, OTP, reset token) is minted from `Guid.NewGuid()`; a GUID is an identifier, not a cryptographically strong secret. -dotnet_diagnostic.SES1005.severity = error # A secret (HMAC, signature, tag, token, or hash) is compared with a non-constant-time equality (`==`, `.Equals`, `SequenceEqual`), leaking it a byte at a time through timing. Code fix rewrites a byte-buffer comparison to `CryptographicOperations.FixedTimeEquals`. -dotnet_diagnostic.SES1006.severity = error # A Data Protection key ring is persisted to an explicit repository (`PersistKeysToFileSystem`/`DbContext`/`AzureBlobStorage`/`StackExchangeRedis`/`Registry`) with no `ProtectKeysWith...` call in the same chain, so the keys are stored unencrypted at rest. -dotnet_diagnostic.SES1007.severity = error # A type derives from an abstract cryptographic primitive base (`HashAlgorithm`/`KeyedHashAlgorithm`/`HMAC`/`SymmetricAlgorithm`/`AsymmetricAlgorithm`/`DeriveBytes`) and implements the algorithm by hand; use a vetted platform implementation. Subclassing a concrete algorithm to configure it is not reported. -dotnet_diagnostic.SES1008.severity = error # An XML signature is verified with the no-key `SignedXml.CheckSignature()` overload, which trusts the key embedded in the document's `KeyInfo`, so an attacker can re-sign tampered XML with their own key and still pass; pass a known key or certificate instead. -dotnet_diagnostic.SES1009.severity = error # A password is hashed with a fast general-purpose hash (`MD5`/`SHA-1`/`SHA-256`/`SHA-384`/`SHA-512`) via `HashData`/`ComputeHash` instead of a slow, salted password KDF; a fast hash is cheap to brute-force even when salted. -dotnet_diagnostic.SES1102.severity = error # A read of `HttpClientHandler.DangerousAcceptAnyServerCertificateValidator` disables TLS server-certificate validation, so the client trusts any certificate and the connection is open to man-in-the-middle attacks. -dotnet_diagnostic.SES1104.severity = error # X509 certificate-chain validation is deliberately weakened: `RevocationMode` set to `NoCheck`, or `VerificationFlags` set to a value naming `AllowUnknownCertificateAuthority` or `AllFlags` (alone or OR-combined), so revoked or untrusted certificates are accepted. -dotnet_diagnostic.SES1105.severity = error # Bearer/OpenID Connect metadata is fetched over plain HTTP because `RequireHttpsMetadata` is set to false outside a development-environment guard, exposing token validation to a network attacker. -dotnet_diagnostic.SES1106.severity = error # An `HttpClient` request targets a cleartext `http://` URL literal (a string overload, a `new Uri(...)` argument, or a `BaseAddress` assignment); non-loopback hosts only. -dotnet_diagnostic.SES1107.severity = error # A SQL connection weakens transport security: `TrustServerCertificate=true`, `Encrypt=false`, or `Encrypt=Optional` in a literal connection string or a `SqlConnectionStringBuilder`, bypassing server-certificate validation or transport encryption. -dotnet_diagnostic.SES1108.severity = error # A custom `HttpClientHandler.ServerCertificateCustomValidationCallback` always returns `true` (an expression/block lambda, an anonymous method, or a method group to a source method of that shape), disabling TLS server authentication so the client trusts any certificate. -dotnet_diagnostic.SES1201.severity = error # A string literal hard-codes a recognizable credential (API key, token, private key, or connection-string password), which is committed to source and must be treated as leaked. -dotnet_diagnostic.SES1202.severity = error # A non-empty string literal is hard-coded where a credential is expected (a credential-named parameter or a credential-type constructor), even when its text is not a recognizable secret pattern. -dotnet_diagnostic.SES1203.severity = error # A database connection-string literal names a user but supplies an empty or missing password, a zero-strength credential that lets anyone who can reach the server authenticate as that account. -dotnet_diagnostic.SES1301.severity = error # A process command line is composed from a non-constant interpolated or concatenated string via `ProcessStartInfo.Arguments` (assignment or object initializer) or `Process.Start(fileName, arguments)`; use `ArgumentList` so each argument is escaped. -dotnet_diagnostic.SES1302.severity = error # A `ProcessStartInfo` with `UseShellExecute = true` names a non-constant `FileName` (from the initializer or the constructor argument), so the OS shell resolves a data-derived program: a command-injection and unexpected-program risk. -dotnet_diagnostic.SES1303.severity = error # A regular-expression pattern is built from non-constant data, letting an attacker inject regex metacharacters (alternation, catastrophic backtracking, capture rewriting); reports the pattern argument of the `Regex` constructor and the static `Regex.IsMatch`/`Match`/`Matches`/`Replace`/`Split` overloads. -dotnet_diagnostic.SES1304.severity = error # An archive entry name (`ZipArchiveEntry.FullName` / `TarEntry.Name`) is joined via `Path.Combine` or `+` straight into a file-writing sink with no inline containment check, letting a crafted `../` or absolute entry escape the target directory (zip slip / path traversal). -dotnet_diagnostic.SES1305.severity = error # An uploaded file name (`IFormFile.FileName`) is used to build a storage path -- a `Path.Combine` argument, a `+` path concatenation, or a file-creating call (`File.Create`/`OpenWrite`/`WriteAllBytes`/`Copy`, `new FileStream`) -- enabling path traversal; sanitize with `Path.GetFileName` or use a server-generated name. -dotnet_diagnostic.SES1306.severity = error # Non-constant C# source is compiled and executed via the scripting API (`CSharpScript.EvaluateAsync`/`RunAsync`/`Create`), which is arbitrary code execution; the code channel must be a constant, trusted template rather than runtime data. -dotnet_diagnostic.SES1307.severity = error # `Path.GetTempFileName()` creates a predictable, world-readable temporary file open to a time-of-check/time-of-use race and a 65535-file limit (CWE-377); use `Path.GetRandomFileName()` for an unpredictable name, or `Directory.CreateTempSubdirectory()` (.NET 7+) for an isolated directory. -dotnet_diagnostic.SES1308.severity = error # A file or directory is created group- or world-writable (a `UnixFileMode` including `GroupWrite`/`OtherWrite`, CWE-732), letting other local users tamper with it. -dotnet_diagnostic.SES1309.severity = error # An XSLT stylesheet is loaded via `XslCompiledTransform.Load` with `XsltSettings` that enable embedded script (`EnableScript = true`, a constant `enableScript` constructor argument, or `XsltSettings.TrustedXslt`), letting a stylesheet run arbitrary code in the host process (CWE-95). -dotnet_diagnostic.SES1310.severity = error # A `DirectoryEntry` binds to the directory without proving identity — `AuthenticationTypes.Anonymous`, or an `LDAP://` path bound with an explicitly empty/`null` username and password (CWE-287). -dotnet_diagnostic.SES1401.severity = error # A type resolved from non-constant data via `Type.GetType` is passed inline to `Activator.CreateInstance` or a `Deserialize(Type, ...)` call, letting untrusted input choose which type is instantiated. -dotnet_diagnostic.SES1402.severity = error # An assembly is loaded from raw bytes (`Assembly.Load(byte[])` / `AssemblyLoadContext.LoadFromStream`) or from a non-constant `LoadFrom`/`LoadFile`/`UnsafeLoadFrom` path, running unverifiable code with full process trust. -dotnet_diagnostic.SES1403.severity = error # A constant `System.Text.Json` `MaxDepth` (on `JsonSerializerOptions`/`JsonReaderOptions`/`JsonDocumentOptions`) is raised above a configurable ceiling (default 64), re-opening the deep-nesting stack-exhaustion denial-of-service that the default limit guards against. -dotnet_diagnostic.SES1404.severity = error # A type is instantiated by name through the string overloads of `Activator.CreateInstance`/`Activator.CreateInstanceFrom` from a non-constant `typeName`, letting untrusted input choose which type is constructed (CWE-470). -dotnet_diagnostic.SES1405.severity = error # MessagePack typeless deserialization (`MessagePackSerializer.Typeless`, or a serializer built on `TypelessObjectResolver`/`TypelessContractlessStandardResolver`) reconstructs whatever .NET type the payload names, letting untrusted input instantiate arbitrary types (CWE-502). -dotnet_diagnostic.SES1501.severity = error # A single CORS policy calls both `AllowAnyOrigin()` and `AllowCredentials()` on `CorsPolicyBuilder`; a wildcard origin combined with credentials is rejected by browsers and throws when the policy is applied. -dotnet_diagnostic.SES1502.severity = error # A CORS origin predicate passed to `CorsPolicyBuilder.SetIsOriginAllowed` unconditionally returns true (`_ => true`), allowing every origin -- equivalent to `AllowAnyOrigin` and dangerous with credentials. -dotnet_diagnostic.SES1503.severity = error # JWT signature verification is turned off on `TokenValidationParameters` because `RequireSignedTokens` or `ValidateIssuerSigningKey` is set to false, so a forged or unsigned token passes validation. -dotnet_diagnostic.SES1504.severity = error # A cookie initializer (`CookieOptions`/`CookieBuilder`) sets `SameSite=None` without securing the cookie in the same initializer (`Secure = true`, or a non-`None` `SecurePolicy`), so the browser drops it or it travels over plain HTTP. -dotnet_diagnostic.SES1505.severity = error # The request body size limit is removed -- `[DisableRequestSizeLimit]` on a controller or action, or `MaxRequestBodySize` set to null on `KestrelServerLimits`/`IHttpMaxRequestBodySizeFeature` -- letting a client stream an unbounded upload and exhaust server memory or disk. -dotnet_diagnostic.SES1506.severity = error # The developer exception page (`UseDeveloperExceptionPage`) is enabled without a development-environment guard, so in production it renders full exception detail and stack traces to the client. -dotnet_diagnostic.SES1507.severity = error # A single method or type declaration carries both `[AllowAnonymous]` and `[Authorize]`; the anonymous marker wins at runtime, so the co-located `[Authorize]` is dead and the endpoint is unauthenticated. -dotnet_diagnostic.SES1508.severity = error # A validation/verification method (`bool`/`Task` named `Validate`/`Verify`/`Authenticate`/`Authorize`/`Check`/`IsValid`/`IsAuthentic`/`Ensure`) fails open: a `catch` swallows a broad or security-relevant exception and returns success. -dotnet_diagnostic.SES1509.severity = error # A constant, backtracking-prone regular expression (an unbounded quantifier over a group that itself repeats or alternates, as in `(a+)+` or `(a -dotnet_diagnostic.SES1510.severity = error # A controller (`ControllerBase`) redirects to a non-constant URL via `Redirect`/`RedirectPermanent`/`RedirectPreserveMethod`/`RedirectPermanentPreserveMethod`; an attacker-controlled target is an open redirect (CWE-601) to a phishing site — validate the URL is local (e.g. `LocalRedirect`). -dotnet_diagnostic.SES1511.severity = error # The forwarded-headers trust boundary is removed — `.Clear()` on `KnownProxies`/`KnownNetworks`/`KnownIPNetworks`, or `ForwardLimit` set to null — so untrusted proxies can spoof the client IP, host, and scheme via `X-Forwarded-*` headers (CWE-348). -dotnet_diagnostic.SES1512.severity = error # Sensitive framework diagnostics — EF Core `EnableSensitiveDataLogging()`, or `IdentityModelEventSource.ShowPII`/`LogCompleteSecurityArtifact = true` — are enabled without a development-environment guard, so parameter values, PII, and full tokens land in production logs (CWE-215/532). -dotnet_diagnostic.SES1513.severity = error # An `IAuthorizationService.AuthorizeAsync` call discards its `AuthorizationResult` (a bare await or `_ =`), so nothing reads `Succeeded` and the guarded operation runs whether or not authorization passed (CWE-863). -dotnet_diagnostic.SES1514.severity = error # OpenID Connect protocol protections are disabled — `UsePkce`, `RequireState`, `RequireStateValidation`, or `RequireNonce` set to false — weakening the authorization-code flow against CSRF and replay (CWE-352/294). -dotnet_diagnostic.SES1515.severity = error # A `Content-Security-Policy` value carries `'unsafe-inline'`, `'unsafe-eval'`, or a bare `*` source on a `default-src`/`script-src`/`style-src`/`object-src`/`base-uri` directive, re-permitting injected inline scripts and defeating the header's XSS protection (CWE-1021/79). -dotnet_diagnostic.SES1601.severity = error # An LLM system-role message (`Microsoft.Extensions.AI` `ChatMessage(ChatRole.System, ...)`, or Semantic Kernel `ChatHistory.AddSystemMessage`/`AddMessage(AuthorRole.System, ...)`/`ChatMessageContent(AuthorRole.System, ...)`) is given non-constant content; runtime or user data in the instruction channel is a prompt-injection risk. -dotnet_diagnostic.SES1602.severity = error # AI model output (`ChatResponse`/`ChatMessage` `.Text`) flows inline into a dangerous sink (a process start, a scripting call, a raw SQL command, or a `File` path); executing or evaluating model output is a prompt-injection-to-code-execution path. -dotnet_diagnostic.SES1603.severity = error # A model-facing tool declared read-only (`ReadOnly = true`) or non-destructive (`Destructive = false`) via `[McpServerTool]` calls a state-changing API in its body (a file delete or overwrite, a directory delete, a process start, an ADO.NET non-query, an EF bulk mutation, or `SaveChanges`), so a host may auto-invoke it and cause irreversible damage. -dotnet_diagnostic.SES1604.severity = error # A Semantic Kernel prompt template disables the default encoding of substituted input by setting `AllowDangerouslySetContent = true` on `PromptTemplateConfig`/`InputVariable`/a template factory, re-opening prompt injection through template variables. -dotnet_diagnostic.SES1605.severity = error # Sensitive AI telemetry capture is enabled (`EnableSensitiveData = true`) on a `Microsoft.Extensions.AI` OpenTelemetry instrumentation client, shipping raw prompts and model responses -- which routinely carry secrets and PII -- verbatim to the telemetry backend. -dotnet_diagnostic.SES1606.severity = error # A string literal targets a model-weights file (`.onnx`, `.gguf`, `.safetensors`, `.pt`, `.pth`, `.ckpt`) over a cleartext `http://` URL, letting a network attacker swap in a tampered or backdoored model; non-loopback hosts only, and the `HttpClient`-sink case is left to SES1106. -dotnet_diagnostic.SES1701.severity = error # Raw HTML is rendered from a non-constant value (`MarkupString`/`AddMarkupContent`), bypassing automatic encoding — an XSS risk. Sanitizer allow-list via `securitysharp.SES1701.sanitizers`. -dotnet_diagnostic.SES1702.severity = error # A JavaScript-interop call targets a script-evaluation primitive (`eval`, `Function`, `document.write`), turning interop into a script-injection channel. -dotnet_diagnostic.SES1703.severity = error # `[Authorize]` on a non-routable component enforces nothing — authorization runs as a routing concern. Exempt types via `securitysharp.SES1703.exempt_types`. -dotnet_diagnostic.SES1704.severity = error # `IHttpContextAccessor` or a cascading `HttpContext` is used in an interactively-rendered component, where it is null or frozen at circuit start. -dotnet_diagnostic.SES1705.severity = error # `NavigationManager.NavigateTo` is called with a target that is not a verified relative URL — an open-redirect risk. Validator allow-list via `securitysharp.SES1705.validators`. -dotnet_diagnostic.SES1706.severity = error # An uploaded file is read with an unbounded or client-chosen size limit, letting an attacker fill server memory. Threshold via `securitysharp.SES1706.max_bytes`. -dotnet_diagnostic.SES1707.severity = error # A secret-shaped literal appears in code reachable as WebAssembly, which downloads to the browser in full — guaranteed disclosure. -dotnet_diagnostic.SES1708.severity = error # `CircuitOptions.DetailedErrors` is enabled, shipping server exception detail to every connected client. -dotnet_diagnostic.SES1709.severity = error # `SerializeAllClaims` serializes every claim into client-readable WebAssembly authentication state, exposing internal ids, tokens, and PII. -dotnet_diagnostic.SES1710.severity = error # Antiforgery validation is disabled on a form (`[RequireAntiforgeryToken(required: false)]`), removing CSRF protection. -dotnet_diagnostic.SST1101.severity = none # see docs/rules/SST1101.md -dotnet_diagnostic.SST1119.severity = error # A numeric literal's digit separators group its digits irregularly. Code fix regroups them evenly. -dotnet_diagnostic.SST1138.severity = error # A free-standing block declares nothing and only nests its statements. Code fix splices them into the enclosing block. -dotnet_diagnostic.SST1219.severity = error # A `switch` statement's `default` section is not last. Code fix moves it to the end. -dotnet_diagnostic.SST1220.severity = error # An all-named argument list is in a different order than the parameters. Code fix reorders it to declaration order. Info. -dotnet_diagnostic.SST1221.severity = error # `where` constraint clauses are not ordered to match the type-parameter list. Code fix reorders them. Info. -dotnet_diagnostic.SST1320.severity = error # A method parameter's name is identical to its containing method's name. -dotnet_diagnostic.SST1321.severity = error # A method whose name ends in `Async` returns nothing awaitable — the inverse of SST1317. Code fix (rename) drops the suffix. -dotnet_diagnostic.SST1434.severity = error # see docs/rules/SST1434.md -dotnet_diagnostic.SST1525.severity = error # A multi-statement `switch` section has no braces; the braces-on policy extends to switch sections. Code fix wraps it. -dotnet_diagnostic.SST1526.severity = none # A wrapped binary expression places the operator inconsistently. Configurable (`before`/`after`, default before). Opt-in. -dotnet_diagnostic.SST1527.severity = none # The `=>` of an expression-bodied member wraps inconsistently. Configurable. Opt-in. -dotnet_diagnostic.SST1528.severity = none # The `=` of a wrapped initializer wraps inconsistently. Configurable. Opt-in. -dotnet_diagnostic.SST1529.severity = none # A wrapped `?.`/`.` call chain places the break inconsistently. Configurable. Opt-in. -dotnet_diagnostic.SST1530.severity = none # A newline sits between a type declaration and its base list. Code fix pulls the base list onto the declaration line. Opt-in. -dotnet_diagnostic.SST1531.severity = none # A short object initializer is split across lines. Code fix collapses it when it fits. Opt-in. -dotnet_diagnostic.SST1532.severity = none # A file mixes line endings. Configurable (`lf`/`crlf`, default lf). Opt-in. -dotnet_diagnostic.SST1533.severity = none # A source file contains no code. Opt-in. -dotnet_diagnostic.SST1660.severity = error # The `` tags are not in parameter order. Code fix reorders them. Info. -dotnet_diagnostic.SST1661.severity = error # A snippet uses ``/`` mismatched to single- vs multi-line content. Code fix swaps the tag. Info. -dotnet_diagnostic.SST1662.severity = none # A thrown exception type has no `` documentation. Code fix adds the skeleton. Opt-in. -dotnet_diagnostic.SST1663.severity = none # A `//` comment before a public member reads like a summary; use `///`. Code fix converts it. Opt-in. -dotnet_diagnostic.SST1664.severity = none # A summary separates paragraphs with blank lines instead of ``. Code fix wraps them. Opt-in. -dotnet_diagnostic.SST1708.severity = error # An extension method never uses its `this` receiver, so it need not be an extension. -dotnet_diagnostic.SST1709.severity = none # A method in a `*Extensions` class whose first parameter lacks `this`. Code fix converts it to an extension block. Opt-in. -dotnet_diagnostic.SST1804.severity = error # A positional record has an empty `{ }` body where `;` would do. Code fix rewrites it. Info. -dotnet_diagnostic.SST1900.severity = error # see docs/rules/SST1900.md -dotnet_diagnostic.SST1904.severity = error # A lock targets a non-readonly field, which a later assignment can swap out from under a caller. Code fix makes it readonly. -dotnet_diagnostic.SST1905.severity = error # An `async void` method, lambda, or local function that is not a genuine event handler. Code fix returns `Task`. -dotnet_diagnostic.SST2018.severity = error # A null check sits beside an `is` type pattern that already excludes null. Code fix removes the null check. -dotnet_diagnostic.SST2229.severity = error # see docs/rules/SST2229.md -dotnet_diagnostic.SST2230.severity = error # see docs/rules/SST2230.md -dotnet_diagnostic.SST2233.severity = none # see docs/rules/SST2233.md -dotnet_diagnostic.SST2246.severity = error # A chain of `?:` expressions that tests one value against constants can be a switch expression. Code fix rewrites it. -dotnet_diagnostic.SST2247.severity = error # Consecutive locals that copy one tuple- or `Deconstruct`-able value's members in order should be a deconstruction. Code fix folds them into `var (a, b) = source;`. -dotnet_diagnostic.SST2248.severity = error # Two comparisons of the same value against constants can fold into one `is`-pattern. Code fix rewrites them. -dotnet_diagnostic.SST2249.severity = error # A `string.Format` call with a literal format, or a concatenation of literals with values, reads more clearly as an interpolated string. Code fix rewrites it; a call passing an explicit format provider is left alone so its culture is not dropped. -dotnet_diagnostic.SST2250.severity = error # A bare local declared without a value and assigned once by the next straight-line statement can be joined into an initialized declaration. Code fix joins them. -dotnet_diagnostic.SST2251.severity = error # A method call names type arguments that inference would supply. Code fix removes them. -dotnet_diagnostic.SST2252.severity = error # A `switch` statement nested inside another `switch` statement's section; lift it into a method, a `switch` expression, or a lookup. -dotnet_diagnostic.SST2254.severity = none # A target-typed `new()` is written where an explicit type reads more clearly; the code fix restores `new TypeName(...)`. Opt-in — the counterpart to SST2202's target-typed direction, so a team enables at most one. -dotnet_diagnostic.SST2255.severity = error # A hand-written null-or-empty string test. Code fix uses `string.IsNullOrEmpty`. -dotnet_diagnostic.SST2256.severity = error # An extension method called in static form. Code fix rewrites to instance form. Info. -dotnet_diagnostic.SST2257.severity = error # A lambda block body that is a single `return`. Code fix uses an expression body. Info. -dotnet_diagnostic.SST2258.severity = error # A redundant explicit delegate wrapper (`new EventHandler(M)`). Code fix drops it. Info. -dotnet_diagnostic.SST2259.severity = error # A stray `;` after a type declaration. Code fix removes it. Info. -dotnet_diagnostic.SST2260.severity = error # An `as` cast to a type the operand already has. Code fix removes it. Info. -dotnet_diagnostic.SST2261.severity = error # `(x && !y) -dotnet_diagnostic.SST2262.severity = error # A raw string literal whose content needs no raw syntax. Code fix demotes it. Info. -dotnet_diagnostic.SST2263.severity = error # An infinite loop whose body re-derives its stop condition. Code fix hoists the condition into the header. Info. -dotnet_diagnostic.SST2264.severity = error # A numeric literal cast to an enum. Code fix names the member. -dotnet_diagnostic.SST2265.severity = none # Consecutive fluent calls on one receiver can fold into a chain. Opt-in. -dotnet_diagnostic.SST2266.severity = none # A local read exactly once can be inlined into that use. Opt-in. -dotnet_diagnostic.SST2267.severity = none # Infinite loops written in mixed `while(true)`/`for(;;)` styles. Configurable. Opt-in. -dotnet_diagnostic.SST2268.severity = none # Inconsistent `()` on object creation with an initializer. Configurable. Opt-in. -dotnet_diagnostic.SST2269.severity = none # Inconsistent parentheses around a conditional's condition. Configurable. Opt-in. -dotnet_diagnostic.SST2270.severity = none # Inconsistent explicit-vs-implicit array-creation type. Configurable. Opt-in. -dotnet_diagnostic.SST2271.severity = none # `var`-vs-explicit local type per the configured preference. Configurable. Opt-in. -dotnet_diagnostic.SST2272.severity = none # `[Flags]` member values written as mixed decimals and shifts. Configurable. Opt-in. -dotnet_diagnostic.SST2273.severity = none # A function or loop body wraps its work in a trailing `if` that could be an early-exit guard clause. Code fix inverts it. Configurable threshold. Opt-in. -dotnet_diagnostic.SST2274.severity = error # A value assigned with `as` and then null-checked is an `is` declaration pattern in one step. Code fix rewrites it. -dotnet_diagnostic.SST2275.severity = error # A method whose block body is a single statement can use an expression body `=> expr`. Code fix rewrites it. -dotnet_diagnostic.SST2276.severity = none # A constructor whose block body is a single statement can use an expression body. Code fix rewrites it. Opt-in. -dotnet_diagnostic.SST2277.severity = none # An operator whose block body is a single `return` can use an expression body. Code fix rewrites it. Opt-in. -dotnet_diagnostic.SST2278.severity = none # A conversion operator whose block body is a single `return` can use an expression body. Code fix rewrites it. Opt-in. -dotnet_diagnostic.SST2279.severity = error # A get-only property whose getter is a single `return` can use a whole-member expression body. Code fix rewrites it. -dotnet_diagnostic.SST2280.severity = error # A get-only indexer whose getter is a single `return` can use a whole-member expression body. Code fix rewrites it. -dotnet_diagnostic.SST2281.severity = error # A local function whose block body is a single statement can use an expression body. Code fix rewrites it. -dotnet_diagnostic.SST2282.severity = error # A reference-type `ReferenceEquals` check against `null` reads as an `is null` / `is not null` pattern. Code fix rewrites it. -dotnet_diagnostic.SST2283.severity = error # A null guard that throws right before assigning the guarded value can fold into the assignment as `?? throw`. Code fix rewrites it. -dotnet_diagnostic.SST2315.severity = error # A type creates and keeps a disposable but is not `IDisposable` - a static factory field, an auto-property `new`, or a collection of disposables. Code fix implements it. -dotnet_diagnostic.SST2316.severity = error # A type declares a public `Dispose`/`DisposeAsync` but not the matching interface, so owners that dispose through the interface never call it. `ref struct` exempt. Code fix adds the interface. -dotnet_diagnostic.SST2317.severity = error # A disposable owns a raw native handle with no finalizer, so it leaks when `Dispose` is not called. The message promotes a `SafeHandle`. -dotnet_diagnostic.SST2318.severity = none # Two methods in one type have token-identical, non-trivial bodies, usually a copy-paste that was meant to differ. Off by default. -dotnet_diagnostic.SST2319.severity = error # An optional parameter's default can never bind because a same-named overload already takes exactly its required prefix. -dotnet_diagnostic.SST2320.severity = error # An interface inherits the same member from two unrelated base interfaces, so every consumer that accesses it gets an ambiguity error. -dotnet_diagnostic.SST2321.severity = error # A class library calls `Environment.Exit` or `Environment.FailFast`, ending the whole host process instead of throwing. -dotnet_diagnostic.SST2322.severity = error # A non-private instance `readonly` field holds a mutable collection, so any caller can still add, remove, or clear its items; `readonly` freezes the reference, not the contents. -dotnet_diagnostic.SST2323.severity = error # A non-static abstract class that extends only `object` and declares nothing but public abstract members is a stateless contract better written as an interface. -dotnet_diagnostic.SST2324.severity = error # A member is declared more accessible than its containing type, so the wider modifier is dead — the container caps its reach. -dotnet_diagnostic.SST2325.severity = error # An async method checks an argument after its first await, so the guard does not throw at the call site but later, when the returned task is awaited. -dotnet_diagnostic.SST2326.severity = error # An interface-typed value is narrowed to a concrete class that implements it — via a cast, `as`, or `is` test — coupling the code to one implementation. Info. -dotnet_diagnostic.SST2327.severity = error # A type inspects its own runtime type against a specific class (`this is Derived`, `this as Derived`, or `this.GetType() == typeof(Derived)`) instead of dispatching through a virtual member. -dotnet_diagnostic.SST2328.severity = error # A visible instance field or property hands out a raw native pointer (`IntPtr`/`UIntPtr`/`nint`/`nuint`), letting callers read, write, free, or corrupt the native memory the type owns. Keep it private behind a `SafeHandle`. -dotnet_diagnostic.SST2329.severity = error # A `[Flags]` enum declares no zero-valued member. Code fix adds `None = 0`. -dotnet_diagnostic.SST2330.severity = error # A `[Flags]` member is a numeric literal equal to a combination of others (`All = 7`). Code fix writes `A -dotnet_diagnostic.SST2331.severity = none # An enum leaves member values implicit, so their numbers depend on declaration order. Opt-in. -dotnet_diagnostic.SST2332.severity = error # An auto-property's `private set` is only written during construction; make it get-only. -dotnet_diagnostic.SST2333.severity = none # A generic comparison/equality contract is implemented without its non-generic counterpart. Opt-in. -dotnet_diagnostic.SST2334.severity = none # A publicly visible type has no `[DebuggerDisplay]`. Opt-in. -dotnet_diagnostic.SST2335.severity = none # Parts of a partial type disagree on the `static` modifier. Opt-in. -dotnet_diagnostic.SST2411.severity = error # A `for` loop declares and tests a counter it never advances, so the loop runs forever or not at all. -dotnet_diagnostic.SST2412.severity = error # A `for` loop steps its counter away from the side of its bound. Code fix flips the comparison. -dotnet_diagnostic.SST2413.severity = error # A `for` loop's condition is already false at the counter's constant starting value, so its body never runs. -dotnet_diagnostic.SST2414.severity = error # Two branches of one conditional share an implementation, so one was probably meant to differ. Code fix merges duplicated switch sections. -dotnet_diagnostic.SST2415.severity = error # A non-short-circuiting `&`/` -dotnet_diagnostic.SST2416.severity = error # A remainder test against a non-zero value misses every negative on a signed type. Code fix promotes `IsOddInteger`, or `% 2 != 0`. -dotnet_diagnostic.SST2417.severity = error # An assignment is spaced like a transposed operator (`x =+ 1`). Code fix offers `x += 1` or `x = +1`. -dotnet_diagnostic.SST2418.severity = error # The result of an immutable value's method is discarded, so the call does nothing. -dotnet_diagnostic.SST2419.severity = error # A set or list operation is applied to the collection itself. -dotnet_diagnostic.SST2420.severity = error # An index-of result tested with `> 0` treats a match at the first position as not found. Code fix uses `Contains`, or `>= 0`. -dotnet_diagnostic.SST2421.severity = error # A write through a `readonly` field of an unconstrained type parameter lands on a copy and is lost. -dotnet_diagnostic.SST2422.severity = error # A property's getter reads a different field than its setter writes. Code fix points the getter at the setter's field. -dotnet_diagnostic.SST2423.severity = error # A value owned by a `using` is returned out of the `using` scope, so the caller receives an already-disposed object. Code fix transfers ownership. -dotnet_diagnostic.SST2424.severity = error # An override declares a different parameter default than the base, so the same call means different things through the base and derived types. -dotnet_diagnostic.SST2425.severity = error # An override forwards to the base but drops one of its own optional arguments, so the base substitutes its default and the caller's value is lost. -dotnet_diagnostic.SST2426.severity = error # An override's `params` modifier disagrees with the base and is ignored, so it only misleads readers. Code fix matches the base. -dotnet_diagnostic.SST2427.severity = error # A derived overload takes a base type of a same-named base overload's parameter, so calls through the derived type never reach the base overload. -dotnet_diagnostic.SST2428.severity = error # A static field initializer reads a static field declared later, so it sees that field's default and keeps it. -dotnet_diagnostic.SST2429.severity = error # A `set`, `init`, `add`, or `remove` accessor never reads `value`, so the assignment or subscription is discarded. -dotnet_diagnostic.SST2430.severity = error # A serialization callback's signature does not match the shape the serializer invokes, so it never runs. -dotnet_diagnostic.SST2431.severity = error # An overridden `ToString` can return null, which breaks interpolation, concatenation, and debugger display. Code fix returns `string.Empty`. -dotnet_diagnostic.SST2432.severity = error # `GetType()` is called on a value that is already a `Type`, returning the reflection object's runtime type. Code fix removes the call. -dotnet_diagnostic.SST2433.severity = error # A caller-info parameter is followed by an ordinary parameter, so a positional argument lands in the wrong one, or it has no default. -dotnet_diagnostic.SST2434.severity = error # A reference-type array is widened to an array of its base type, making every element write a runtime-checked store that can throw. -dotnet_diagnostic.SST2435.severity = error # A base class's value-equality `Equals` is used as an early-out fast path, so a derived override skips comparing its own fields. -dotnet_diagnostic.SST2436.severity = error # An instance event is raised with a null sender or null args, so every subscriber that reads them throws. Code fix passes `this` or `EventArgs.Empty`. -dotnet_diagnostic.SST2437.severity = error # A generic type is nested inside its own base's type arguments, which expands without end and throws `TypeLoadException` at load. -dotnet_diagnostic.SST2438.severity = error # A catch logs at error or critical level but never passes the caught exception, so the stack trace is lost. Code fix passes it. Level floor configurable. -dotnet_diagnostic.SST2439.severity = error # An exception is passed as a log message value instead of the exception argument. Code fix hoists it into the exception argument. -dotnet_diagnostic.SST2440.severity = error # Two log values named after the template placeholders sit in each other's slots. Code fix swaps them back. -dotnet_diagnostic.SST2441.severity = error # A message-template placeholder is empty, whitespace, or not a property name, so its value is dropped from the payload. -dotnet_diagnostic.SST2442.severity = error # A message template names the same placeholder twice, so one value silently overwrites the other in a structured sink. -dotnet_diagnostic.SST2443.severity = error # A typed logger's category is a type other than the one that logs, so its level filters and sink routes do nothing. Code fix rewrites the category. -dotnet_diagnostic.SST2444.severity = error # A constant regular-expression pattern does not parse, so it throws on first use. Refactoring converts a valid literal to a source-generated `[GeneratedRegex]` method. -dotnet_diagnostic.SST2445.severity = error # A custom date/time format uses an unquoted `/` or `:` with a culture-sensitive provider, so the separators change with the culture. Code fixes quote the separators or switch to the invariant culture. -dotnet_diagnostic.SST2446.severity = error # A stream read's returned byte count is awaited and discarded through a configured awaiter or a local, so a short read passes unnoticed. Code fix rewrites to `ReadExactlyAsync` where it exists. -dotnet_diagnostic.SST2448.severity = error # A combined or opaque delegate is removed with `-`/`-=`, which strips handlers only as one contiguous run, so the order they were combined in silently decides the result. -dotnet_diagnostic.SST2449.severity = error # An event or delegate handler added as a lambda or anonymous method is removed with `-=`, which never matches it, so the subscription is never removed. -dotnet_diagnostic.SST2450.severity = error # A `Debug.Assert` condition performs a side effect, so a release build compiles the call out and the work never runs. -dotnet_diagnostic.SST2451.severity = error # Every constructor of a non-static, non-abstract class is private, yet no member ever creates an instance, so the type can never exist. -dotnet_diagnostic.SST2452.severity = error # A method marked `[Pure]` returns `void`, a bare `Task`, or a bare `ValueTask`, so it has no observable result — the attribute is wrong or the method is dead. Code fix removes the attribute. -dotnet_diagnostic.SST2456.severity = error # A field-like event declared `override`, or `new` hiding an inherited event, gets its own backing delegate field, so handlers added through one type are invisible to raises through the other. -dotnet_diagnostic.SST2457.severity = error # An integer sequence `Sum` is wrapped in `unchecked`, which does not stop it throwing on overflow. -dotnet_diagnostic.SST2458.severity = error # A bitwise operator is applied to an enum not declared `[Flags]`, producing a value with no defined meaning. -dotnet_diagnostic.SST2459.severity = error # `[Optional]` on a `ref` or `out` parameter advertises an optionality no C# caller can use, while reflection reads `IsOptional` as true. Code fix removes the attribute. -dotnet_diagnostic.SST2460.severity = error # `[DefaultValue]` on a method or record parameter is inert: it does not make the parameter optional and no call site reads it. Code fix swaps it for the interop `[DefaultParameterValue]`. -dotnet_diagnostic.SST2462.severity = error # A member declared with `new` is less accessible than the inherited member it hides, so a base-typed reference still binds to the more accessible member and the reduced accessibility has no effect. -dotnet_diagnostic.SST2463.severity = error # A derived type's instance field differs from an inherited accessible field only by case, so an unqualified reference to either name compiles and silently uses the wrong storage. -dotnet_diagnostic.SST2464.severity = error # A mutable class (a settable field or property) declares a value-equality `operator ==`, so a mutated instance's hash no longer matches the bucket it was stored in and it is lost as a dictionary or hash-set key. -dotnet_diagnostic.SST2465.severity = error # A for loop's body reassigns the counter or the local its condition tests, so the loop runs a different number of times than its header states. -dotnet_diagnostic.SST2467.severity = error # A type declares a `params` overload and a same-arity overload whose last parameter is more specific than the array's element type, so a single argument of that type silently binds to the specific overload instead of the params one. -dotnet_diagnostic.SST2468.severity = error # A classic partial method is declared but never implemented, so the compiler silently removes the declaration and every call to it. -dotnet_diagnostic.SST2470.severity = error # Two string literals concatenate with no space between them, fusing a SQL keyword into the adjacent token so the query changes at runtime. Code fix adds a space to a regular right literal. -dotnet_diagnostic.SST2472.severity = error # A type is exported for a contract (`[Export(typeof(IFoo))]`) it neither implements nor inherits, so the container cannot supply it for that contract. -dotnet_diagnostic.SST2473.severity = error # A `new` expression constructs a type that is itself a shared export part, bypassing the container and its single-instance guarantee. -dotnet_diagnostic.SST2474.severity = error # A part-creation-policy attribute is applied to a type with no `[Export]`, so it governs nothing. -dotnet_diagnostic.SST2475.severity = error # An entity's primary key is typed `DateTime` or `DateTimeOffset`, so keys collide within a tick, are not stable identifiers, cluster the table by insertion time, and round-trip imprecisely across providers. -dotnet_diagnostic.SST2479.severity = error # A for/while/do loop variable captured by a lambda, anonymous method, or local function that is stored beyond the iteration reads its final value on every deferred call. -dotnet_diagnostic.SST2481.severity = error # A `GetHashCode` override folds the base object identity hash into a value hash, so two value-equal instances hash differently and are lost in any hash-based collection. -dotnet_diagnostic.SST2484.severity = error # A raw handle read through `SafeHandle.DangerousGetHandle()` is not reference-counted, so a concurrent dispose or finalize can recycle the value and it is used after free. -dotnet_diagnostic.SST2485.severity = error # A member throws `new NotImplementedException`, a stub that compiles but crashes at runtime on any path that reaches it. `NotSupportedException` is left alone. -dotnet_diagnostic.SST2486.severity = error # An assembly is loaded through `Assembly.LoadFrom`, `LoadFile`, or `LoadWithPartialName` instead of `Assembly.Load` with a full display name; a code fix swaps `LoadWithPartialName` to `Assembly.Load`. -dotnet_diagnostic.SST2487.severity = error # A `[ConstructorArgument]` names no parameter of any constructor of its declaring type, so a markup extension cannot round-trip the property back to a constructor argument. -dotnet_diagnostic.SST2488.severity = error # A catch logs the caught exception and then rethrows it with a bare `throw;`, so the same failure is recorded here and again where it is finally handled. -dotnet_diagnostic.SST2489.severity = error # A relational comparison an integer operand's type already decides — an unsigned value `>= 0` (always true) or `< 0` (always false), or a value at its type's min/max edge such as `b <= 255` for a `byte`. -dotnet_diagnostic.SST2490.severity = error # Two adjacent `try` statements in the same block repeat the same catch/finally handling, so the pair can collapse into one `try` wrapping both bodies. -dotnet_diagnostic.SST2491.severity = error # A non-`async` method returns an awaitable from inside `using`/`try-finally`/`lock`, so the resource is torn down before the task completes. Code fix makes it `async`. -dotnet_diagnostic.SST2492.severity = error # A null-guard throws on a parameter the signature declares may be null. -dotnet_diagnostic.SST2493.severity = error # `== null`/`!= null` on an unconstrained generic `T`. Code fix uses `is null`/`is not null`. -dotnet_diagnostic.SST2494.severity = error # A `??` whose left operand is a constant null, so the right is always taken. Code fix folds it. -dotnet_diagnostic.SST2495.severity = error # A `[Flags]` combination includes an operand whose bits another already covers. Code fix removes it. -dotnet_diagnostic.SST2496.severity = error # An explicit `Dispose`/`Close` on a resource an enclosing `using` already disposes. Code fix removes it. Info. -dotnet_diagnostic.SST2500.severity = error # A test method carrying a test attribute contains no assertion and no expected-exception check, so it always passes without verifying anything. Reported only when every call in the body resolves to a non-verifying platform (BCL) API (or there are none); any user or third-party call keeps it silent. -dotnet_diagnostic.SST2501.severity = error # An equality or identity assertion compares an expression with itself, so a positive assertion always passes and a negated one always fails, verifying nothing. Covers xUnit, NUnit (classic and `Assert.That`), and MSTest. -dotnet_diagnostic.SST2502.severity = error # An equality assertion is passed a constant as its actual argument and a computed value as its expected, so a failure reports them the wrong way round. Code fix swaps the two arguments. -dotnet_diagnostic.SST2503.severity = error # An equality assertion compares a value against a boolean literal (`Assert.Equal(true, x)` / `Assert.AreEqual(true, x)`), obscuring intent and giving a worse failure message. Code fix rewrites it to the framework's boolean assertion. -dotnet_diagnostic.SST2504.severity = error # A concrete class marked as a test fixture (MSTest test-class or NUnit test-fixture) declares no test method of its own and inherits none, so the runner loads it but never runs anything. -dotnet_diagnostic.SST2505.severity = error # A test method declares parameters but no data source, so the runner cannot supply arguments and the test silently never runs. -dotnet_diagnostic.SST2506.severity = error # A test method calls `Thread.Sleep`, spending a fixed real-time delay on every run that slows the suite and races the wall clock, a classic flaky-test source. -dotnet_diagnostic.SST2507.severity = error # A test method declares its expected failure with an expected-exception attribute instead of asserting the specific operation, so any statement in the whole method throwing that type passes the test. -dotnet_diagnostic.SST2508.severity = error # A fluent assertion names its subject with a bare `Should()` statement but chains no check, so it compiles, runs, and passes while verifying nothing. Gated on FluentAssertions/AwesomeAssertions. -dotnet_diagnostic.SST2509.severity = error # A method carrying a test attribute has a signature the runner cannot execute — non-public, a parameterless generic, or a return type other than `void`/`Task`/`ValueTask` — so it is discovered and then silently skipped. -dotnet_diagnostic.SST2600.severity = error # Application output is written through `Trace.Write`/`WriteLine`/`WriteIf`/`WriteLineIf` when a structured logger (`ILogger`) is available, so the message loses its level, category, and named state. Reported only when `ILogger` resolves; `Debug.*` is excluded. -dotnet_diagnostic.SST2601.severity = error # An `ILogger`/`ILogger` field or property is named against the logger convention (`_logger`/`_log` for a private instance one, `Logger` otherwise). Configurable via `stylesharp.SST2601.fieldname`. -dotnet_diagnostic.SST2700.severity = error # An MVC route template contains a backslash; route segments are separated by `/`, so the route is unreachable. Code fix replaces `\` with `/`. -dotnet_diagnostic.SST2701.severity = error # A `[JSInvokable]` method is not public, so JavaScript interop cannot call it. Code fix makes it public. -dotnet_diagnostic.SST2702.severity = error # A `[SupplyParameterFromQuery]` property has a type the framework cannot bind from the query string, which throws at runtime. -dotnet_diagnostic.SST2703.severity = error # A routable component's route constraint (`{id:int}`) disagrees with the matching `[Parameter]` CLR type, so the route silently fails to match. -dotnet_diagnostic.SST2704.severity = error # A public action on an `[ApiController]` declares no HTTP-verb attribute, so it answers every verb and can make routing ambiguous. -dotnet_diagnostic.SST2705.severity = none # A bound model member is a non-nullable value type with no required marker, so a request that omits it binds the default with no error. Opt-in. -dotnet_diagnostic.SST2706.severity = error # A Windows Forms entry point carries neither `[STAThread]` nor `[MTAThread]`; without STA, clipboard, drag-and-drop, and common dialogs misbehave. Code fix adds `[STAThread]`. -dotnet_diagnostic.SST2707.severity = none # A fire-and-forget `Task.Run` in a controller captures the request's `HttpContext`, which is disposed when the request ends, so the background work throws `ObjectDisposedException`. Opt-in. -dotnet_diagnostic.SST2708.severity = error # A component subscribes to an event in a lifecycle method but never unsubscribes, so the event source keeps the component alive — a per-session leak on a Server circuit. -dotnet_diagnostic.SST2709.severity = error # `StateHasChanged` is called while the component is being disposed, which the renderer no longer supports and throws. -dotnet_diagnostic.SST2710.severity = error # `StateHasChanged` is called directly from a timer callback, off the renderer's dispatcher; marshal it with `InvokeAsync(StateHasChanged)`. -dotnet_diagnostic.SST2711.severity = error # A synchronous component lifecycle method is overridden as `async void`, which the framework never awaits; override the `…Async` twin returning `Task`. Code fix rewrites the signature. -dotnet_diagnostic.SST2712.severity = error # An `[Inject]`/`[CascadingParameter]` property has no setter, so the framework's reflection-based binding leaves it null. Code fix adds a setter. -dotnet_diagnostic.SST2713.severity = error # A `DotNetObjectReference.Create(this)` is passed inline and never stored, so nothing can dispose it and it leaks on the JavaScript side. - -# In-box IDE code-style rules disabled where a StyleSharp rule covers the same shape (avoids double-reporting under EnforceCodeStyleInBuild) -dotnet_diagnostic.IDE0001.severity = none # covered by SST1116 -dotnet_diagnostic.IDE0003.severity = none # covered by SST1117 -dotnet_diagnostic.IDE0005.severity = none # covered by SST1445 -dotnet_diagnostic.IDE0010.severity = none # covered by SST2205 -dotnet_diagnostic.IDE0011.severity = none # covered by SST1503 -dotnet_diagnostic.IDE0017.severity = none # covered by SST1193 -dotnet_diagnostic.IDE0018.severity = none # covered by SST2208 -dotnet_diagnostic.IDE0020.severity = none # covered by SST2007 -dotnet_diagnostic.IDE0027.severity = none # covered by SST2219 -dotnet_diagnostic.IDE0029.severity = none # covered by SST1195 -dotnet_diagnostic.IDE0030.severity = none # covered by SST1195 -dotnet_diagnostic.IDE0032.severity = none # covered by SST1420 -dotnet_diagnostic.IDE0033.severity = none # covered by SST1142 -dotnet_diagnostic.IDE0034.severity = none # covered by SST1188 -dotnet_diagnostic.IDE0036.severity = none # covered by SST1206 -dotnet_diagnostic.IDE0037.severity = none # covered by SST2216 -dotnet_diagnostic.IDE0039.severity = none # covered by SST2228 -dotnet_diagnostic.IDE0040.severity = none # covered by SST1400 -dotnet_diagnostic.IDE0045.severity = none # covered by SST1198 -dotnet_diagnostic.IDE0046.severity = none # covered by SST1197 -dotnet_diagnostic.IDE0051.severity = none # covered by SST1440 -dotnet_diagnostic.IDE0053.severity = none # covered by SST2257 -dotnet_diagnostic.IDE0054.severity = none # covered by SST1185 -dotnet_diagnostic.IDE0056.severity = none # covered by SST2203 -dotnet_diagnostic.IDE0062.severity = none # covered by SST2235 -dotnet_diagnostic.IDE0063.severity = none # covered by SST2236 -dotnet_diagnostic.IDE0065.severity = none # covered by SST1200 -dotnet_diagnostic.IDE0070.severity = none # covered by SST2217 -dotnet_diagnostic.IDE0071.severity = none # covered by SST2220 -dotnet_diagnostic.IDE0072.severity = none # covered by SST2206 -dotnet_diagnostic.IDE0073.severity = none # covered by SST1633 -dotnet_diagnostic.IDE0074.severity = none # covered by SST2223 -dotnet_diagnostic.IDE0076.severity = none # covered by SST1457 -dotnet_diagnostic.IDE0077.severity = none # covered by SST1458 -dotnet_diagnostic.IDE0080.severity = none # covered by SST2209 -dotnet_diagnostic.IDE0082.severity = none # covered by SST1199 -dotnet_diagnostic.IDE0083.severity = none # covered by SST2006 -dotnet_diagnostic.IDE0090.severity = none # covered by SST2202 -dotnet_diagnostic.IDE0100.severity = none # covered by SST1143 -dotnet_diagnostic.IDE0110.severity = none # covered by SST2213 -dotnet_diagnostic.IDE0150.severity = none # covered by SST2231 -dotnet_diagnostic.IDE0161.severity = none # covered by SST2237 -dotnet_diagnostic.IDE0170.severity = none # covered by SST2238 -dotnet_diagnostic.IDE0180.severity = none # covered by SST2215 -dotnet_diagnostic.IDE0200.severity = none # covered by SST2239 -dotnet_diagnostic.IDE0220.severity = none # covered by SST2225 -dotnet_diagnostic.IDE0230.severity = none # covered by SST2212 -dotnet_diagnostic.IDE0240.severity = none # covered by SST2210 -dotnet_diagnostic.IDE0241.severity = none # covered by SST2211 -dotnet_diagnostic.IDE0251.severity = none # covered by SST1460 -dotnet_diagnostic.IDE0270.severity = none # covered by SST1195 -dotnet_diagnostic.IDE0280.severity = none # covered by SST1463 -dotnet_diagnostic.IDE0290.severity = none # covered by SST2241 -dotnet_diagnostic.IDE0301.severity = none # covered by SST2100 -dotnet_diagnostic.IDE0302.severity = none # covered by SST2102 -dotnet_diagnostic.IDE0303.severity = none # covered by SST2103 -dotnet_diagnostic.IDE0304.severity = none # covered by SST2104 -dotnet_diagnostic.IDE0305.severity = none # covered by SST2105 -dotnet_diagnostic.IDE0340.severity = none # covered by SST2232 -dotnet_diagnostic.IDE0350.severity = none # covered by SST2218 -dotnet_diagnostic.IDE0380.severity = none # covered by SST1455 -dotnet_diagnostic.IDE1005.severity = none # covered by SST2240 dotnet_diagnostic.S3059.severity = none # Types should not have members with visibility set higher than the type's visibility dotnet_diagnostic.S3063.severity = none # "StringBuilder" data should be used — covered by SST2408 dotnet_diagnostic.S3169.severity = none # Multiple "OrderBy" calls should not be used — covered by PSH1108 @@ -2503,9 +2520,7 @@ dotnet_diagnostic.S6968.severity = none # Actions that return a value should be dotnet_diagnostic.S881.severity = none # Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression — covered by SST2015 dotnet_diagnostic.S907.severity = none # "goto" statement should not be used — covered by SST2014 -################### -# SonarAnalyzer (Sxxxx) - Minor Code Smell -################### +# Minor code smells dotnet_diagnostic.S100.severity = none # Methods and properties should be named in PascalCase — covered by SST1300 dotnet_diagnostic.S101.severity = none # Types should be named in PascalCase — covered by SST1300 dotnet_diagnostic.S105.severity = none # Tabulation characters should not be used — covered by SST1027 @@ -2611,6 +2626,7 @@ dotnet_diagnostic.S4663.severity = none # Covered by SST1120 (canonical) dotnet_diagnostic.S6513.severity = none # "ExcludeFromCodeCoverage" attributes should include a justification - not available on net462 and older TFMs dotnet_diagnostic.S6585.severity = none # Don't hardcode the format when turning dates and times to strings — covered by SST2445 dotnet_diagnostic.S6588.severity = none # Use the "UnixEpoch" field instead of creating "DateTime" instances that point to the beginning of the Unix epoch — covered by PSH1413 +dotnet_diagnostic.S6594.severity = none # Covered by PSH1406 (canonical) dotnet_diagnostic.S6602.severity = none # Covered by PSH1110 (canonical) dotnet_diagnostic.S6603.severity = none # Covered by PSH1110 (canonical) dotnet_diagnostic.S6605.severity = none # Covered by PSH1110 (canonical) @@ -2632,16 +2648,12 @@ dotnet_diagnostic.S6675.severity = none # "Trace.WriteLineIf" should not be used dotnet_diagnostic.S6678.severity = none # Use PascalCase for named placeholders -> replaced by CA1727 dotnet_diagnostic.S818.severity = none # Literal suffixes should be upper case — covered by SST2244 -################### -# SonarAnalyzer (Sxxxx) - Info Code Smell -################### +# Informational code smells dotnet_diagnostic.S1133.severity = none # Deprecated code should be removed — covered by SST2310 dotnet_diagnostic.S1135.severity = none # Track uses of "TODO" tags -> off: FIXME comment tracker; not enforced here dotnet_diagnostic.S1309.severity = none # Track uses of in-source issue suppressions -################### -# SonarAnalyzer (Sxxxx) - Uncategorized -################### +# Uncategorized dotnet_diagnostic.S9999-cpd.severity = error # Copy-paste token calculator dotnet_diagnostic.S9999-log.severity = error # Log generator dotnet_diagnostic.S9999-metadata.severity = error # File metadata generator @@ -2652,9 +2664,7 @@ dotnet_diagnostic.S9999-testMethodDeclaration.severity = error # Test method dec dotnet_diagnostic.S9999-token-type.severity = error # Token type calculator dotnet_diagnostic.S9999-warning.severity = error # Analysis Warning generator -################### -# SonarAnalyzer (Sxxxx) - Critical Security Hotspot -################### +# Critical security hotspots dotnet_diagnostic.S2245.severity = none # Using pseudorandom number generators (PRNGs) is security-sensitive - DUPLICATE CA5394 dotnet_diagnostic.S2257.severity = none # Using non-standard cryptographic algorithms is security-sensitive -> replaced by SES1007 dotnet_diagnostic.S4502.severity = none # Disabling CSRF protections is security-sensitive -> replaced by in-box ASP.NET antiforgery analyzer @@ -2664,9 +2674,7 @@ dotnet_diagnostic.S5042.severity = none # Expanding archive files without contro dotnet_diagnostic.S5332.severity = none # Using clear-text protocols is security-sensitive -> replaced by SES1106 dotnet_diagnostic.S5443.severity = none # Using publicly writable directories is security-sensitive -> replaced by SES1308 -################### -# SonarAnalyzer (Sxxxx) - Major Security Hotspot -################### +# Major security hotspots dotnet_diagnostic.S1313.severity = none # Using hardcoded IP addresses is security-sensitive -> off: hardcoded-IP heuristic; too noisy to enforce dotnet_diagnostic.S2077.severity = none # Formatting SQL queries is security-sensitive -> replaced by CA2100 dotnet_diagnostic.S5693.severity = none # Allowing requests with excessive content length is security-sensitive -> replaced by SES1505 @@ -2675,9 +2683,7 @@ dotnet_diagnostic.S5766.severity = none # Creating Serializable objects without dotnet_diagnostic.S6444.severity = none # Not specifying a timeout for regular expressions is security-sensitive -> replaced by SES1509 dotnet_diagnostic.S6640.severity = none # Using unsafe code blocks is security-sensitive -> off: unsafe-code audit; not enforced here -################### -# SonarAnalyzer (Sxxxx) - Minor Security Hotspot -################### +# Minor security hotspots dotnet_diagnostic.S2092.severity = none # Creating cookies without the "secure" flag is security-sensitive -> replaced by CA5382 dotnet_diagnostic.S3330.severity = none # Creating cookies without the "HttpOnly" flag is security-sensitive -> replaced by CA5383 dotnet_diagnostic.S4507.severity = none # Delivering code in production with debug features activated is security-sensitive -> off: debug features in production; partly covered by SES1506, rest not enforced @@ -2864,4 +2870,4 @@ indent_size = 2 end_of_line = lf [*.{cmd, bat}] -end_of_line = crlf +end_of_line = lf diff --git a/.gitattributes b/.gitattributes index 01c527ecb..a5d963a4f 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,19 +1,65 @@ -# Auto detect text files and perform LF normalization -* text=auto +# Auto-detect text files and force LF in the repository AND the working tree, on every +# platform. eol=lf is set explicitly on each pattern: a more specific line only overrides +# the attributes it names, and a bare `text` would otherwise fall back to core.autocrlf +# and check out CRLF on Windows. +* text=auto eol=lf -# Custom for Visual Studio -*.cs diff=csharp +# Source code +*.cs text eol=lf diff=csharp +*.xaml text eol=lf +*.slnx text eol=lf +*.sln text eol=lf +*.csproj text eol=lf +*.props text eol=lf +*.targets text eol=lf +*.json text eol=lf +*.xml text eol=lf +*.yml text eol=lf +*.yaml text eol=lf +*.md text eol=lf +*.txt text eol=lf +*.sh text eol=lf +*.ps1 text eol=lf +*.cmd text eol=lf +*.bat text eol=lf +*.config text eol=lf +*.editorconfig text eol=lf -# Standard to msysgit -*.doc diff=astextplain -*.DOC diff=astextplain -*.docx diff=astextplain -*.DOCX diff=astextplain -*.dot diff=astextplain -*.DOT diff=astextplain -*.pdf diff=astextplain -*.PDF diff=astextplain -*.rtf diff=astextplain -*.RTF diff=astextplain +# Binary files (do not normalise or diff). `binary` expands to `-text -diff`, which +# overrides the `* text=auto eol=lf` above. Every extension here previously carried +# `-text` only by virtue of its Git LFS line, so all of them must be listed explicitly +# now that LFS is gone, or `text=auto` would be left guessing. -.idea/ +# Images +*.png binary +*.jpg binary +*.gif binary +*.ico binary +*.bmp binary +*.webp binary +*.psd binary + +# Fonts +*.ttf binary +*.otf binary +*.woff binary +*.woff2 binary + +# Archives +*.zip binary +*.gz binary +*.7z binary +*.tar binary + +# Compiled output and signing material +*.dll binary +*.exe binary +*.pdb binary +*.lib binary +*.so binary +*.winmd binary +*.pfx binary +*.snk binary + +# Documents +*.pdf binary diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props index 73f980c97..014136fa3 100644 --- a/src/Directory.Packages.props +++ b/src/Directory.Packages.props @@ -9,7 +9,7 @@ 1.61.38 - 3.38.1 + 3.41.14 @@ -50,7 +50,7 @@ - +