In the past six months, we have been working on a new static analysis tool for the .NET ecosystem called Roslyn Security Guard. It is a Visual Studio extension that analyzes C# code. It was first released at Black Hat USA this year. This article will cover the latest milestone reached which brings a new taint analysis mechanism and the introduction of automated code fixes.

Roslyn does provide a small subset of security checks. This small subset will not satisfy security analysts or developers doing in-depth security code reviews. The goal of the project is to complement the built-in Microsoft rules.


Taint Analysis

Taint analysis is the capability to track variables in the code flow and trace variable coming from user input (considered tainted). If a variable can be controlled by an external user, it will cause problems if it is passed to a dangerous API such as a method accepting SQL queries. This helps reduce false positives reported by identifying correct usage of risky APIs.

Here is a simple example of an SQL query that is not vulnerable to SQL injection but, it requires context analysis to determine that it is safe to use.

Safe SQL Query (No issue is reported)


On the other hand, the following sample will be marked as vulnerable because the parameter PostalCode is concatenated to the query string. Any potentially unsafe value will trigger a vulnerability.

Unsafe SQL Query (Issue is reported)


The taint analysis engine is reused in a similar fashion to find an hard-coded password. Constant variables are tracked to see if they are assigned to a password parameter or field. Analyzers were created to find obvious password fields in standard well-known APIs. Additionally, heuristics are used to look for password fields in proprietary APIs.

Hard-Coded Password


Automated Code Fixes

Code fixes are refactoring hints to fix diagnostics found by Roslyn analyzers. In the context of security, it means that developers get an immediate course of action to fix a vulnerability at the moment it was created. Security vulnerabilities can often be abstract and dubious. This will help developers get the code right during implementation and patch vulnerabilities quicker.

Code Fix proposing the addition of Secure and HttpOnly flag to browser cookies.

Open for contributions

The project is open to contributions. You can suggest or contribute new analyzer idea. The project is designed to make signature addition easy. The dangerours APIs are configured in a YAML file. If you need the support of a library, you can add an entry as follows:

Excerpt from the dangerous API configuration

Conclusion & Future plans

You can download the extension from Visual Studio Gallery. If you encounter any problem, you can report them on the Github project.

Both components presented – Taint analysis and Automated Code Fix – are still under active development. The features presented today are a small subset of the project’s roadmap. You can expect major improvements in the upcoming months.



Roslyn Security Guard : Official website

Roslyn Security Guard’s Github project : Place to contribute to the project

Icons Designed by Kreativkolors – : Thumbs icons used in the article

Détection et réponse gérées Titan
Antivirus de nouvelle génération
Détection et réponse sur les terminaux
Détection et réponse sur le réseau
Détection et réponse sur les boîtes de messagerie
Détection et réponse face aux menaces internes
Gestion des pare-feu
Gestion des SIEM
La gestion des vulnérabilités en tant que service
GoSecure Titan
Logiciel Titan
Sécurité de la messagerie
Sécurité Web
Boîte à outils «Responder PRO Forensics»
Services professionnels
Services de préparation aux brèches
Les services-conseils personnalisés en cybersécurité
Évaluation de la cybersécurité
Services de réponse aux incidents
Services des équipes « Red & Purple »
Services de tests d'intrusion
Services de conformité et d'audit
Évaluation de la compromission de la sécurité
Technologies tierces

Pin It on Pinterest

Share This