7

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to carry out similar assignments.

So far I have come across the O2 Platform but the documentation is all over the place. Microsoft's FxCop is another tool I found but their reports are horrible and I'd like something that would give me a report which I could use to further carry out a manual inspection without having to pull out my hair trying to read output.

What recommendations do you have for carrying out a code review in terms of a quality scan, free / relatively low pricing for an independent contractor and good reporting?

3
  • 1
    This question might end up as a 'list', which tends not to do well on IS.SE. I will point you to en.wikipedia.org/wiki/…
    – schroeder
    Dec 10, 2012 at 16:57
  • The challenge is finding a SAST tool. In terms of general code review, I saw the Wikipedia list. One article I found was at: securityninja.co.uk/application-security/… but haven't found anything similar for C#. If there's a comparison between different SAST tools in terms of costs and quality especially for a small business or independent consultant, that would be great.
    – Epoch Win
    Dec 10, 2012 at 19:12
  • I know it is an outdated question, but can you tell me if Static Application Security Testing(SAST) is same as Source Code analysis tool? Like the ones I am seeing here owasp.org/index.php/Source_Code_Analysis_Tools Are they just same thing but different names?
    – DoodleKana
    Aug 12, 2014 at 22:24

3 Answers 3

7

Roslyn Security Guard is now available and is free. https://dotnet-security-guard.github.io/

Update: This project is no longer maintained and has been forked here and improved here: https://github.com/security-code-scan/security-code-scan.

By the way, be sure to enable it for the full codebase by choosing Tools > Options -> Text Editor -> C# -> Advanced -> "Enable full solution analysis".

1
  • I've tried this myself and it looks promising.
    – setzamora
    Oct 3, 2017 at 4:27
5

SAST tools in general tend to be pretty expensive for on-site hosted solutions and for c# I'm not aware of many good free tools

One option you could look at is the on-demand style scanning that several of the tool vendors do, which is likely to be cheaper if you're doing a smaller number of scans and also is something you might be able to factor into the cost of your assessments.

Some options

1
  • Have a look to sonarqube.
    – Alkampfer
    Sep 16, 2018 at 6:39
2

Take a look at CAT.NET from Microsoft.

http://www.microsoft.com/en-us/download/details.aspx?id=19968

Its a snapin for visual studio that does static analysis on a number of different languages.

2
  • 2
    CAT.NET is interesting, but unfortunately it's not (AFAIK) maintained and there haven't been any updates in the last couple of years. Apr 19, 2013 at 15:28
  • That link is now dead
    – Wai Ha Lee
    Feb 6, 2023 at 12:56

Not the answer you're looking for? Browse other questions tagged .