Vulnerability-REsearch | Binarly Vulnerability Research Advisories | Code Analyzer library

I've got a Roslyn based Code Analyzer and Codefix. When directly creating the ReportDiagnostic from an AnalyzerCodeBlock, they would show up in live analysis (Problems in Jetbrains Rider).

However, it needs to parse additional data from the solution to build a dependency tree to make the decision. So now it works like this:

I'm trying to do code analyzer app and i have a txt file that contains a python code and my goal now is to save all functions in this txt file in dictionary in the class, but i don't have any idea how can i do it

at first i create class that name is class CodeAnalyzer:

I'm sure that question has been asked numerous times but I can't seem to find a good/satisfying answer so please bear with me.

Using PHP 7.4+, I tend to type everything I can. But I have some problems with Doctrine entities properties.

If I type everything correctly, I usually get a lot of errors like this one.

Typed property App\Entity\User::$createdAt must not be accessed before initialization

A code sample for that type of error would look something like this

In developing a Microsoft Word Online add-in, my team needs to detect focus being gained/regained by the document (ETA: to trigger other functionality which depends on this knowledge). It appears that Microsoft has tightly locked down scriptability in this context--all window.on* functions are replaced by null, all error-handling code is deeply obfuscated, etc. Our efforts so far have been frustrated.

Simply setting window.onfocus to a new function causes the add-in to not load correctly, likely because it's triggering a code analyzer as unsafe, but hard to tell.

There is also nothing in the Microsoft Word Online JavaScript API which directly provides this functionality. Scripts can detect when the document selection has changed easily with a provided method, but that seems to be about it for documented functionality in this area. (Obviously simply sensing document changes will not work.)

What's the best approach to sensing document and/or window focus in this situation? Thank you.

Newbie question, I've just switched from Visual Studio to Rider, so I'm still trying to get my bearings.

Trying to use the code analyzers and see the suggestions for the entire solution.
The errors/warnings I can see in the 'Errors In Solution' window but the suggestions are not listed there. Can I add them to that list somehow?, or is there a different window?

Edit: It's not just the Roslyn analyzers, for example a spelling mistake shows up highlighted in the source as as 'suggestion'.
When opening the 'Errors in Solution' I would have expected those to also be there but they aren't.

I'm writing a code analyzer. My analyzer uses Webpack's JavaScriptParser hooks. I need to output an error message, but the line number from node.loc is off because a loader has transformed the source code. So I want to feed the error message through a source map before logging it.

In the Bismon static source code analyzer (GPLv3+ licensed, git commit 49dd1bd232854a) for embedded C and C++ code (using a plugin for GCC 10 straight compiler on Debian bookworm for x86-64) I have a test Bash script Hello-World-Analyze which uses a GNU array variable bismon_hello_args.

That variable is declared (at line 56) using:

I have a C# roslyn code analyzer that needs to analyze the usage scenarios of generic method invocations of a given class. I am gathering all the references to the method, the generic type parameters and so forth and then want to invoke the methods (via reflection) to analyze the output to report potential diagnostics in the analyzer. Is there a way from a Roslyn-Compilation.Assembly to a System.Reflection.Assembly? If not, is there any other way?

The Analyzer project and the solution to be analyzed are under my control.

Thanks!

I need to parse URI-like string. This URI is specific to the project and corresponds to "scheme://path/to/file", where path should be a syntactically correct path to file from filesystem point of view. For this purpose std::regex was used with pattern R"(^(r[o|w])\:\/\/(((?!\$|\~|\.{2,}|\/$).)+)$)".

It works fine but code analyzer complies that it is not compliant as $ character is not belong to the C++ Language Standard basic source character set:

AUTOSAR C++14 A2-3-1 (Required) Only those characters specified in the C++ Language Standard basic source character set shall be used in the source code.

Exception to this rule (according to Autosar Guidelines):

It is permitted to use other characters inside the text of a wide string and a UTF-8 encoded string literal.

wchar_t is prohibited by other rule, although it works with UTF-8 string (but it looks ugly and unreadable in the code, also I'm afraid it is not safe).

Could someone help me with workaround or std::regex here is not the best solution, then what would be better?

Are any other drawbacks of using UTF-8 string literal?

P.S. I need $ to be sure (on parsing phase) that path is not a directory and that it is not contain none of /../, ~, $ , so I can't just skip it.