.NET projects additional rules

The SASHA leverages Microsoft.CodeAnalysis.NetAnalyzers (Roslyn Analyzers) to perform Static Application Security Testing (SAST) and code analysis on .NET projects.

Security analyzer are enabled internally by default (AnalysisModeSecurity=All). Their associated rules run automatically during scans without requiring extra cofiguration.

Other code analysis categories and/or their individual rules must be explicitly enabled to using an .editorconfig configuration file within the project repository.

To activate other rules place an .editorconfig file in your project folder. SASHA reads this configuration and applies the designated severity levels to category rules and individual diagnostic rules during analysis

Below is a sample .editorconfig setup to enable broad code quality diagnostics:

# Category Rules
dotnet_analyzer_diagnostic.category-Design.severity          = warning
dotnet_analyzer_diagnostic.category-Maintainability.severity = warning
dotnet_analyzer_diagnostic.category-Naming.severity           = warning
dotnet_diagnostic.category-Style.severity             = warning

# Individual Rules
dotnet_diagnostic.CA1062.severity = warning
dotnet_diagnostic.CA1502.severity = warning
dotnet_diagnostic.CA1505.severity = warning
dotnet_diagnostic.CA1508.severity = warning
dotnet_diagnostic.CA1707.severity = warning
dotnet_diagnostic.IDE0060.severity = warning
dotnet_diagnostic.IDE0059.severity = warning

Meterian code quality rules

On top of the .NET analyzers, Meterian adds a few analyzers to provide additional rules.

Avoid magic numbers

MSQ001

Flags numeric literals used directly in code instead of a named constant, making their purpose unclear.

Configuration: meterian.msq001.allowed_values (default -1,0,1) — values that are never flagged.

Avoid duplicate methods

MSQ002

Flags a method whose implementation duplicates another method in the same type.

Avoid duplicate branches

MSQ003

Flags an if/else if/else branch or switch case whose implementation duplicates an earlier one in the same chain.

Limit class coupling

MSQ004

Flags a class that depends on too many other types, suggesting it should be split into smaller, more focused classes.

Configuration: meterian.msq004.max_coupled_types (default 30) — the maximum number of types allowed.

---

These rules are disabled by default. Activate one by setting dotnet_diagnostic.<ID>.severity (e.g. warning) in your .editorconfig.