In the past six months, we have been working on a new static analysis tool for the .NET ecosystem called Roslyn Security Guard. It is a Visual Studio extension that analyzes C# code. It was first released at Black Hat USA this year. This article will cover the latest milestone reached which brings a new taint analysis mechanism and the introduction of automated code fixes.
Roslyn does provide a small subset of security checks. This small subset will not satisfy security analysts or developers doing in-depth security code reviews. The goal of the project is to complement the built-in Microsoft rules.
Taint analysis is the capability to track variables in the code flow and trace variable coming from user input (considered tainted). If a variable can be controlled by an external user, it will cause problems if it is passed to a dangerous API such as a method accepting SQL queries. This helps reduce false positives reported by identifying correct usage of risky APIs.
Here is a simple example of an SQL query that is not vulnerable to SQL injection but, it requires context analysis to determine that it is safe to use.
On the other hand, the following sample will be marked as vulnerable because the parameter
PostalCode is concatenated to the query string. Any potentially unsafe value will trigger a vulnerability.
The taint analysis engine is reused in a similar fashion to find an hard-coded password. Constant variables are tracked to see if they are assigned to a password parameter or field. Analyzers were created to find obvious password fields in standard well-known APIs. Additionally, heuristics are used to look for password fields in proprietary APIs.
Automated Code Fixes
Code fixes are refactoring hints to fix diagnostics found by Roslyn analyzers. In the context of security, it means that developers get an immediate course of action to fix a vulnerability at the moment it was created. Security vulnerabilities can often be abstract and dubious. This will help developers get the code right during implementation and patch vulnerabilities quicker.
Open for contributions
The project is open to contributions. You can suggest or contribute new analyzer idea. The project is designed to make signature addition easy. The dangerours APIs are configured in a YAML file. If you need the support of a library, you can add an entry as follows:
Conclusion & Future plans
Both components presented - Taint analysis and Automated Code Fix - are still under active development. The features presented today are a small subset of the project's roadmap. You can expect major improvements in the upcoming months.
Roslyn Security Guard : Official website
Roslyn Security Guard's Github project : Place to contribute to the project
Icons Designed by Kreativkolors - Freepik.com : Thumbs icons used in the article