security-code-scan v5.6.7 releases: Static code analyzer for .NET
Security Code Scan – static code analyzer for .NET
security-code-scan is a vulnerability Patterns Detector for C# and VB.NET.
Facts
- Detects various security vulnerability patterns: SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), XML eXternal Entity Injection (XXE), etc.
- Taint analysis to track user input data.
- One-click refactoring for some vulnerabilities.
- Analyzes .NET and .NET Core projects in a background (IntelliSense) or during a build.
- Continuous Integration (CI) through MSBuild.
- Works with Visual Studio 2015 or higher. Visual Studio Community, Professional, and Enterprise editions are supported.
Changelog v5.6.7
- sln were not analyzed by standalone tool fix by @matteo-tosi in #262
- added –sdk-path parameter
Installation
Security Code Scan (SCS) can be installed as:
- Visual Studio extension. Use the link or open “Tools > Extensions and Updates…” Select “Online” in the tree on the left and search for SecurityCodeScan in the right upper field. Click “Download” and install.
- NuGet package.
- Right-click on the root item in your solution. Select “Manage NuGet Packages for Solution…”. Select “Browse” on the top and search for Security Code Scan. Select the project you want to install into and click “Install”.
- Another option is to install the package into all projects in a solution: use “Tools > NuGet Package Manager > Package Manager Console”. Run the command Get-Project -All | Install-Package SecurityCodeScan.
Installing it as a NuGet package gives the advantage to choose projects in a solution that should be analyzed. It is a good idea to exclude test projects because they do not make it into a final product. However, it requires discipline to install SCS into every solution a developer works with. Installing it as a Visual Studio extension is a single install action.
Source: https://github.com/security-code-scan/
