6

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to carry out similar assignments.

So far I have come across the O2 Platform but the documentation is all over the place. Microsoft's FxCop is another tool I found but their reports are horrible and I'd like something that would give me a report which I could use to further carry out a manual inspection without having to pull out my hair trying to read output.

What recommendations do you have for carrying out a code review in terms of a quality scan, free / relatively low pricing for an independent contractor and good reporting?

closed as off-topic by S.L. Barth - Reinstate Monica, schroeder Mar 23 '17 at 11:46

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    This question might end up as a 'list', which tends not to do well on IS.SE. I will point you to en.wikipedia.org/wiki/… – schroeder Dec 10 '12 at 16:57
  • The challenge is finding a SAST tool. In terms of general code review, I saw the Wikipedia list. One article I found was at: securityninja.co.uk/application-security/… but haven't found anything similar for C#. If there's a comparison between different SAST tools in terms of costs and quality especially for a small business or independent consultant, that would be great. – Epoch Win Dec 10 '12 at 19:12
  • I know it is an outdated question, but can you tell me if Static Application Security Testing(SAST) is same as Source Code analysis tool? Like the ones I am seeing here owasp.org/index.php/Source_Code_Analysis_Tools Are they just same thing but different names? – DoodleKana Aug 12 '14 at 22:24
5

SAST tools in general tend to be pretty expensive for on-site hosted solutions and for c# I'm not aware of many good free tools

One option you could look at is the on-demand style scanning that several of the tool vendors do, which is likely to be cheaper if you're doing a smaller number of scans and also is something you might be able to factor into the cost of your assessments.

Some options

  • Have a look to sonarqube. – Alkampfer Sep 16 '18 at 6:39
5

Roslyn Security Guard is now available and is free. https://dotnet-security-guard.github.io/

Update: This project is no longer maintained and has been forked here and improved here: https://github.com/security-code-scan/security-code-scan.

By the way, be sure to enable it for the full codebase by choosing Tools > Options -> Text Editor -> C# -> Advanced -> "Enable full solution analysis".

  • I've tried this myself and it looks promising. – setzamora Oct 3 '17 at 4:27
2

Take a look at CAT.NET from Microsoft.

http://www.microsoft.com/en-us/download/details.aspx?id=19968

Its a snapin for visual studio that does static analysis on a number of different languages.

  • 2
    CAT.NET is interesting, but unfortunately it's not (AFAIK) maintained and there haven't been any updates in the last couple of years. – Rоry McCune Apr 19 '13 at 15:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.