> For the complete documentation index, see [llms.txt](https://docs.meterian.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.meterian.io/sast-scanner/.net-projects-additional-rules.md).

# .NET projects additional rules

The SASHA leverages `Microsoft.CodeAnalysis.NetAnalyzers` (Roslyn Analyzers) to perform Static Application Security Testing (SAST) and code analysis on .NET projects.

Security analyzer are enabled internally by default (`AnalysisModeSecurity=All`). Their associated rules run automatically during scans without requiring extra cofiguration.

Other [code analysis categories](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/categories) and/or their individual rules must be explicitly enabled to using an [`.editorconfig`](https://learn.microsoft.com/en-us/visualstudio/ide/create-portable-custom-editor-options?view=visualstudio) configuration file within the project repository.

To activate other rules place an `.editorconfig` file in your project folder. SASHA reads this configuration and applies the designated severity levels to category rules and individual diagnostic rules during analysis

Below is a sample `.editorconfig` setup to enable broad code quality diagnostics:

```
# Category Rules
dotnet_analyzer_diagnostic.category-Design.severity          = warning
dotnet_analyzer_diagnostic.category-Maintainability.severity = warning
dotnet_analyzer_diagnostic.category-Naming.severity           = warning
dotnet_diagnostic.category-Style.severity             = warning

# Individual Rules
dotnet_diagnostic.CA1062.severity = warning
dotnet_diagnostic.CA1502.severity = warning
dotnet_diagnostic.CA1505.severity = warning
dotnet_diagnostic.CA1508.severity = warning
dotnet_diagnostic.CA1707.severity = warning
dotnet_diagnostic.IDE0060.severity = warning
dotnet_diagnostic.IDE0059.severity = warning
```

## Meterian code quality rules

On top of the .NET analyzers, Meterian adds a few analyzers to provide additional rules.

### Avoid magic numbers

`MSQ001`

Flags numeric literals used directly in code instead of a named constant, making their purpose unclear.

**Configuration:** `meterian.msq001.allowed_values` (default `-1,0,1`) — values that are never flagged.

### Avoid duplicate methods

`MSQ002`

Flags a method whose implementation duplicates another method in the same type.

### Avoid duplicate branches

`MSQ003`

Flags an `if`/`else if`/`else` branch or `switch` case whose implementation duplicates an earlier one in the same chain.

### Limit class coupling

`MSQ004`

Flags a class that depends on too many other types, suggesting it should be split into smaller, more focused classes.

**Configuration:** `meterian.msq004.max_coupled_types` (default `30`) — the maximum number of types allowed.

***

These rules are **disabled by default**. Activate one by setting `dotnet_diagnostic.<ID>.severity` (e.g. `warning`) in your `.editorconfig`.