security-scan /your/solution.sln throws up error.

[misterraj7]

PS C:\Users\jvraj\Downloads\New folder> dotnet tool install --global security-scan --version 5.6.7
Tool 'security-scan' is already installed.
PS C:\Users\jvraj\Downloads\New folder> security-scan webgoat.net.sln

╔═╗┌─┐┌─┐┬ ┬┬─┐┬┌┬┐┬ ┬ ╔═╗┌─┐┌┬┐┌─┐ ╔═╗┌─┐┌─┐┌┐┌
╚═╗├┤ │ │ │├┬┘│ │ └┬┘ ║ │ │ ││├┤ ╚═╗│ ├─┤│││
╚═╝└─┘└─┘└─┘┴└─┴ ┴ ┴ ╚═╝└─┘─┴┘└─┘ ╚═╝└─┘┴ ┴┘└┘

.NET tool by Jaroslav Lobačevski v5.6.7

Loading solution 'webgoat.net.sln'
Msbuild failed when processing the file 'C:\Users\jvraj\Downloads\New folder\WebGoat\WebGoat.NET.csproj' with message: The imported project "C:\Program Files\dotnet\sdk\6.0.302\Microsoft\VisualStudio\v17.0\WebApplications\Microsoft.WebApplication.targets" was not found. Confirm that the expression in the Import declaration "C:\Program Files\dotnet\sdk\6.0.302\Microsoft\VisualStudio\v17.0\WebApplications\Microsoft.WebApplication.targets" is correct, and that the file exists on disk. C:\Users\jvraj\Downloads\New folder\WebGoat\WebGoat.NET.csproj
Finished loading solution 'webgoat.net.sln'
PS C:\Users\jvraj\Downloads\New folder>

I am using visual studio 17.2.6

[kevinneumann]

I am having a similar issue. I can use the --ignore-msbuild-errors flag but that seems to just skip the project from being scanned. Looking for a better solution.

[ThomasFrey]

I ran into this as well. Seems like any item the solution/project that uses $(VSToolsPath) will try to go to "C:\Program Files\dotnet\sdk\6.0.302\Microsoft\VisualStudio\v17.0" instead of the correct location.

[nbelley]

Any other ideas for this?

[BenMakesGames]

I'm also unable to run the tool, getting a similar error:

Msbuild failed when processing the file 'C:\progs\laser\src\API\API.csproj' with message: C:\Program Files\dotnet\sdk\6.0.408\Sdks\Microsoft.NET.Sdk\targets\Microsoft.NET.TargetFrameworkInference.targets: (144, 5): The current .NET SDK does not support targeting .NET 7.0. Either target .NET 6.0 or lower, or use a version of the .NET SDK that supports .NET 7.0.

I'm not sure why .NET 6 is being referenced at all; this is a .NET 7 project; we even have a global.json which requires 7.0.304 for our project. (and I have the 7.0.304 SDK installed, of course. I do also have a version of 6 installed; haven't tried uninstalling it, as it's needed for another project I work on.)

other info:

• we are not using $(VSToolsPath)
• I tried deleting the global.json, just in case that was doing something?? doing so had no apparent effect; the issue remained

[camsilver]

Causing issue with Azure Pipeline as well
Ran into simular issue