"CA5390: Do Not Hard Code Encryption Key" does not work with initialized fields

[avivanoff]

Analyzer package

Microsoft.CodeAnalysis.FxCopAnalyzers

Package Version

v2.9.5 (Latest)

Diagnostic ID

CA5390

Repro steps

1. Create a simple console app.
2. Add FxCop analyzers and make sure CA5390 is enabled.
3. Add the following code:

using System;
using System.Security.Cryptography;

internal static class Program
{
    private static readonly Byte[] _key = { 1, 2, 3 };

    private static void Main()
    {
        using (var aes = Aes.Create())
        {
            aes.Key = Program._key;
        }
    }
}

Expected behavior

CA5390 warning/error should be triggered.

Actual behavior

CA5390 warning/error is not triggered.

[dotpaul]

Hi @avivanoff, the example code should trigger CA5390, and it seems to trigger for me.

[avivanoff]

Strange. When I did a full rebuild, it started to work.

[mavasani]

@avivanoff I think that is likely because lot of security analyzers are build-only by default analyzers (compilation end based). They only run in IDE live analysis when you enable full solution analysis.

[avivanoff]

Actually, I believe the rule does have a problem. The following code is not marked:

internal static class Program
{
    private static readonly Byte[] _key = { 1, 2, 3 };

    private static void Main()
    {
        using (var aes = Aes.Create())
        {
            aes.Key = Program._key;
        }
    }
}

[dotpaul]

Thanks for reporting, @avivanoff ! We currently don't analyze field initializers, which is why that example doesn't produce a warning. For this rule, I think we'll have to investigate how we can take field initializers into account, since I'm guessing initializing byte arrays is common enough to be worth analyzing.