{"id":417172,"date":"2024-06-30T01:23:37","date_gmt":"2024-06-30T01:23:37","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=417172"},"modified":"-0001-11-30T00:00:00","modified_gmt":"2024-06-30T01:23:37","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=417172","title":{"rendered":"Creating Roslyn API-based static analyzer for C#<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n

After you read this article, you’ll have the knowledge to create your own static analyzer for C#. With the help of the analyzer, you can find potential errors and vulnerabilities in the source code of your own and other projects. Are you intrigued? Well, let’s get started.<\/p>\n

<\/figcaption><\/figure>\n

First, we will make your own static analyzer from the Visual Studio templates, without going deeper into the Roslyn API. This allows you to quickly get a working application and at least roughly see what analyzers can do.<\/p>\n

And after that, we’ll take a closer look at Roslyn API, as well as various tools that allow you to perform deeper and more complex analysis.<\/p>\n

Static analyzers: what are they and why do we need them?<\/h2>\n

I’m sure that many developers have some mistakes that they or their friends often make when writing code. Most likely you would like to have a tool that detects such errors without your participation. This tool is called a static analyzer. <\/p>\n

A static analyzer is an automatic tool that searches for potential errors and vulnerabilities in a program’s source code without launching the app directly.<\/p>\n

However, what if the existing analyzers can’t find what you want? The answer is simple \u2014 you create your own utility or even an entire analyzer. C# developers are very lucky. Thanks to Roslyn they can create their own static analyzer. This is exactly what this article is about.<\/p>\n

Creating an analyzer based on Visual Studio templates<\/h2>\n

All our further static analyzer development will be based on the .NET Compiler Platform<\/a> aka Roslyn. Thanks to the capabilities this platform provides, we can use C# to create our own static analysis tools. Here, the word ‘static’ means that the analyzed code doesn’t need to be executed.<\/p>\n

Since our analyzer is based on Roslyn, we should install the .NET Compiler Platform SDK for Visual Studio. One of the ways to do so is to open the Visual Studio Installer and select ‘Visual Studio extension development’ in the ‘Workloads’ tab.<\/p>\n

<\/figcaption><\/figure>\n

After we install the necessary toolset, we can start creating the analyzer. <\/p>\n

Open Visual Studio, click on ‘Create a new project’, select C#. Specify Windows as the platform and select Roslyn as the project type. After this we should see three projects templates. We are interested in two: ‘Analyzer with Code Fix (.NET Standard)’ and ‘Standalone Code Analysis Tool’.<\/p>\n

<\/figcaption><\/figure>\n

Let’s study each of the templates.<\/p>\n

Description of the «Analyzer with Code Fix (.NET Standard)» project and an example of its use<\/h3>\n

After we create a new project with the ‘Analyzer with Code Fix (.NET Standard)’ template, we get a solution with five projects inside.<\/p>\n

<\/figcaption><\/figure>\n

Now we pay our full attention to the first project called TestAnalyzer<\/em>. The main work on the analyzer is performed in this exact project. Open the TestAnalyzerAnalyzer.cs<\/em> file. It already contains an example of a simple rule for a static analyzer. The rule searches through all type(class) names in source code. If a type’s name has lowercase characters, the rule underlines it with a green wavy line. Besides, if you hover the cursor on the type name marked with a wavy line, you see a familiar light bulb symbol. It offers to automatically correct the type name and bring all the characters to uppercase:<\/p>\n

<\/figcaption><\/figure>\n

The easiest way to see it is to launch a new VS instance, which already has our sample diagnostic rule. You can use the same approach for debugging. To do this, mark TestAnalyzer.vsix<\/em> as a startup project and launch the application. After that, a so-called experimental Visual Studio instance window will open. A new diagnostic rule is already added in this VS instance. It is integrated with the installed VSIX extension that has the name of our test analyzer.<\/p>\n

<\/figcaption><\/figure>\n

Next, we create a new console project in the running VS instance. In this project, we see that the Program<\/em> class name is underlined with a green wavy line. This is the work of our diagnostic rule, as the class name contains lowercase characters.<\/p>\n

Create an analyzer based on the «Standalone Code Analysis Tool» project template<\/h3>\n

Now, let’s create a new project of the ‘Standalone Code Analysis Tool’ type. In fact, it’s a project of an ordinary console application with links to the necessary DLLs for analysis:<\/p>\n