MSDN Magazine - December 2008 - (Page 11)

ScoTT MiTchEll Toolbox Static Analysis Tools For .NET, Matt Berseth’s Blog Improve Software Quality with Static Code Analysis Tools Many software teams use code reviews to ensure that developers are writing correct, secure code that adheres to the company’s design guidelines. These guidelines might outline naming conventions, patterns to use for accessing data or other external resources, and so on. Many aspects of the code review process are rather mechanical and can be automated. Static code analysis tools scan through source code or intermediate code and search for violations of defined design guideline rules. One such static analysis tool for applications within the Microsoft .NET Framework is FxCop (version 1.36), a free tool created by Microsoft. FxCop analyzes the intermediate code of a compiled .NET assembly and provides suggestions for design, security, and performance improvements. By default, FxCop analyzes an assembly based on the rules set forth by Design Guidelines for Developing Class Libraries (msdn.microsoft.com/ library/ms229042). The design guideline rules are divided into nine categories, including design, globalization, performance, and security, among others. An example of a naming rule is, “Events should not have ‘before’ or ‘after’ prefix.” If FxCop identifies an event named BeforeUpdate, it will recommend replacing BeforeUpdate with a present-tense version of the event name (namely, Update). You can also plug in a custom rules class that reflects your company’s internal design guidelines. To analyze an assembly, launch FxCop, create a new project, and add the assembly to the project. FxCop shows the 200+ rules that are used when analyzing the assembly; you may turn off existing rules or add your own. Click the Analyze button to begin Microsoft is StyleCop (version 4.3). Whereas FxCop evaluates design guidelines against intermediate code, StyleCop evaluates the style of C# source code. Style guidelines are rules that specify how source code should be formatted. They dictate whether spaces or tabs should be used for indentation and the format of for loops, if statements, and other constructs. Example StyleCop rules include: the body of for statements should be wrapped in opening and closing curly brackets; there should be white space on both sides of the = and != operators; and calls to member variables within a class must begin with “this.”. StyleCop is not integrated into Visual Studio Team System—you must install it yourself. Executing StyleCop from within Visual Studio analyzes the source code in the currently opened solution, displaying the results as warnings in the error list window. StyleCop can also be integrated with MSBuild. While FxCop and StyleCop pinpoint rule violations, the developer is still responsible for implementing these tools’ suggestions. CodeIt.Right (version 1.1) from SubMain takes static code analysis to the next level by enabling rule violations to be automatically refactored into conforming code. Like FxCop, CodeIt.Right ships with an extensive set of predefined rules, based on the design guidelines document mentioned earlier, with the ability to add custom rules. But CodeIt.Right makes it much easier to create and use custom rules. Using custom rules in FxCop requires FxCop Analyzes an Assembly Based on Rules Set by .NET Design Guidelines the analysis. After enumerating the types, classes, methods, and members of your assembly, FxCop displays the analysis results, which list the offending code and the rule that was violated. Select a result for a more detailed description and solution. FxCop is available as a standalone app; it also includes a command-line implementation that makes it easy to plug into an automated build process. (Code Analysis, a tool much like FxCop, ships with Visual Studio Team System and is integrated into the Visual Studio shell.) For more on how to use FxCop, see the Bugslayer columns by John Robbins: “Bad Code? FxCop to the Rescue” at msdn.microsoft.com/magazine/ cc188721 and ”Three Vital FXCop Rules” at msdn.microsoft.com/magazine/cc163930. Another static code analysis tool from Send your questions and comments for Scott to toolsmm@microsoft.com. All prices confirmed October 30, 2008, and are subject to change. The opinions expressed in this column are solely those of the author and do not necessarily reflect the opinions of Microsoft. December 2008 11 http://msdn.microsoft.com/library/ms229042 http://msdn.microsoft.com/library/ms229042 http://msdn.microsoft.com/magazine/cc188721 http://msdn.microsoft.com/magazine/cc188721 http://msdn.microsoft.com/magazine/cc163930

Table of Contents Feed for the Digital Edition of MSDN Magazine - December 2008

MSDN Magazine - December 2008 Contents Toolbox CLR Inside Out Advanced Basics Cutting Edge Patterns In Practice Team System Real-World WF Visual Studio OBA Tools SOA Data Access Geneva Framework Test Run Foundations Windows With C++ Going Places End Bracket

MSDN Magazine - December 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.