Continuous Integration: Static Analysis with Visual Studio & Roslyn

  • Friday, 24 Feb 2017 3:00PM EST (24 Feb 2017 20:00 UTC)
  • Speaker: Eric Johnson

For over 10 years, Visual Studio has provided basic source code analysis through FxCop and StyleCop. While these code analyzers focus mainly on design conformance, code consistency, and best practices, there is very little support for enforcing secure coding techniques. To address this gap, Microsoft started a project back in 2011 called CAT.NET to help identify secure coding bugs such as XSS, SQL Injection, and XPath Injection. Unfortunately, CAT.NET failed and never made it past the first version. Aside from purchasing expensive commercial static analysis tools, .NET development teams have been left without an easy way to integrate secure code scanning rules into Visual Studio. At least until now...

With the release of Visual Studio 2015, the open-source .NET Compiler Platform (aka \Roslyn") exposes a set of code analysis APIs capable of querying source code, identifying security issues, and reporting vulnerabilities. In this talk, we will explore the code analysis APIs and introduce you to Puma Scan: an open-source static analysis rules engine. Live demonstrations will show Puma Scan identifying vulnerabilities inside Visual Studio as code is written!

To learn more about .NET security from Eric Johnson, register for DEV544: Secure Coding in .NET at SANS 2017 in Orlando from April 9th - April 12th. Can't travel? DEV544 is also available online from the SANS OnDemand team.