Repository navigation
Reference Guide.md
The CLI is a .NET tool NuGet package.
To display a usage guide use analyzer help.
NOTE: This reference guide assumes the .NET tool is installed as a global tool (and will be available as "analyzer").
The basic usage is analyzer [command] [options].
analyzer analyze will analyze the current directory, optionally a directory can be specified like analyzer analyze "C:/Path/To/Project"to analyze a specific directory.
For running in headless environments like a CI/CD pipeline, the flag --output-console can be used to analyze the repository and display the results in the console output. The issue locations are colored using ANSI colors which should display correctly in most terminals (but may not work everywhere).
Analyzing a project will also launch the web interface when finished (unless running in headless mode).
While the web interface will launch automatically when an analysis finishes. It will also keep the current terminal active. To prevent this, you can open a separate terminal and run the analyzer launch command there instead.
All data is stored locally in an SQLite database. The database file can be found at %localappdata%/StaticCodeAnalyzer/data.db.
Since all source files containing issues need to be stored for each report the file may grow big over time. Deleting projects/reports can help keep the size down but keep in mind that the actual disk usage won't directly decrease (but new content that doesn't go over the current file size will overwrite old deleted content instead).
Any analysis started with the --output-console flag will not use the database at all.
The web application is a visual and interactive frontend that can display all of the projects, reports, and issues. It can also perform common actions like starting an analysis and creating a default config file.
If you already have a repository and want to add it to the static code analyzer to analyze it you can create a new project. Adding a project will add an existing repository as a project, it will not create any new files
To add a project
- Navigate to the main projects page
- Click the "New project" button, this will open a modal
- Fill out a project name and path to the existing repository
- Click "Save" to create the new project.
- Navigate to an existing project or create a new one
- Press the "Analyze" button
- Navigate to an existing project or create a new one
- Press the "Create config" button
- (Optionally) Press the "Edit config" button to open the config file in your default text editor
The web API is intended to be used by the web application but can also be used for potential integrations. It's started when the web interface is launched and will run on port 5000 serving the web application as well. The following APIs are available:
GET /api/projects
Returns a list of projects.
POST /api/project
Creates a new project. Takes in a JSON body with "Name" and "Path" string fields.
{
"Name": "Static Code Analyzer",
"Path": "C:/Code/StaticCodeAnalyzer"
}GET /api/project/{id}
Gets a project by id (will include the list of reports for that project).
DELETE /api/project/{id}
Deletes a project by id.
POST /api/project/{id}/analyze
Analyzes a project by id.
GET /api/project/{projectId}/report/{reportId}
Gets the content of a report by id. This will include all of the problematic code in the project and a list of files&issues
POST /api/project/{projectId}/config
Creates a new config file with default options.
POST /api/project/{projectId}/config/open
Opens the config file in the default text editor.
GET /api/online
Checks if the API is running.
When a analyzer-config.json file is created, it includes all of the options at default settings. Here is a list of them and what they're for.
The enabled and severity fields are available on all analyzers.
severity can have the following values: suggestion, warning, error
Each issue will increase the "Severity Score", the amount it increases by is based on the number specified in the severities section of the configuration. When running using --output-console and the Severity Score exceeds the specified threshold in code_guard max_allowed_severity_score and fail_on_reach_severity_score is set to true then the analyzer will terminate with exit code 1 to indicate failure.
To exclude any directory you can use a relative path or glob pattern in the directories excluded section.
For example "/**/Migrations/*.cs" can be used to prevent analyzing migration files.
Looks for classes with too many parents.
max_parents: The maximum amount of parents a class may have (does not count interfaces)
Looks for large methods
max_statements: The maximum amount of (nested) statements that may be present in the body of a class method or local function declaration.
Looks for if statements with too many else clauses
max_elses: The maximum amount of else clauses may be present (i.e. an embedded if statement in an else clause will count towards this number).
Looks for large types (classes/structs/...)
max_members: The maximum amount of members that a type declaration may contain. A member can be a field, property, constructor or method.
Looks for any method invocation directly using numeric literals without a parameter name.
Looks for methods/local function declarations (but not constructors) with too many parameters
max_parameters: The maximum amount of parameters that a method or local function declaration may have (constructors are not included).
Looks for nested ternary expressions
Looks for variable declarations where only a part of the variables are assigned, for example
int a, b = 0; // only b is assigned to hereLooks for switch statements (but not switch expressions) with too many cases
max_cases: The maximum amount of switch cases in switch statements (note: switch expressions are excluded)
Looks for test methods that don't contain any assertions
any_name_including_assert: Look for any method invocation containing "Assert" in its name (including member access like AssertUtils.Validate())
check_called_methods: Looks recursively if any called methods contains assertions (note: this will be an expensive operation)
use_custom_assertion_methods: Whether to use the list of custom defined assertion methods
assertion_methods: A list of assertion method names (it's a contains check)
Looks for methods with parameters that aren't used anywhere
ignore_when_implementing_types: If a method is present that inherits from these types it won't be checked for unused parameters