PVS-Studio 7.14.50440

PVS-Studio C# analyzer can now analyze projects for .NET 5 platform. You can read about this in more detail in our blog.
A new diagnostic rule for OWASP ASVS standard, that was added in this release to PVS-Studio C# analyzer, can find SQL Injection tainted data patterns (the rule V5608). The tainted data category of potential security vulnerabilities holds an important position in OWASP Top 10 rating. In future releases we plan to expand PVS-Studio capabilities to include the detection of more tainted data patterns.
The Blame Notifier automatic analysis report generation and notification tool now supports sorting analyzer messages by commit numbers and dates based on blame information retrieved from version control system. This allows you to identify analyzer warnings that appeared on a particular day. You can read about this new mode in more detail in our blog.
Continuing on the topic of automatic publication of analyzer reports - it is now possible to accomplish this without using our Blame Notifier tool. One of our users created a lightweight alternative (which does not depend upon .NET) which you can find on GitHub.
Support for analyzing Ninja projects under Windows though JSON Compilation Database (compile_commands.json) was improved for PVS-Studio C++ analyzer.
By using clang to build PVS-Studio C++ analyzer we've achieved an overall improvement in analyzer's performance up to 10% when analyzing source files on Windows operating system.
PVS-Studio JetBrains Rider plug-in now supports Rider 2021.1.
File with suppressed analyzer messages can now be specified directly through command line for PVS-Studio_Cmd.exe, a tool for analyzing C++ and C# Visual Studio projects. Previous analyzer versions could only read suppression files through project or solution.
V832. It's better to use '= default;' syntax instead of empty body.
V1070. Signed value is converted to an unsigned one with subsequent expansion to a larger type in ternary operator.
V1071. Consider inspecting the 'foo' function. The return value is not always used.
V1072. The buffer is securely cleared not on all execution paths.
V1073. Consider checking for misprints. Check the following code block after the 'if' statement.
V2577. MISRA. The function argument corresponding to a parameter declared to have an array type should have an appropriate number of elements.
V2578. MISRA. An identifier with array type passed as a function argument should not decay to a pointer.
V2579. MISRA. Macro should not be defined with the same name as a keyword.
V2580. MISRA. The 'restrict' specifier should not be used.
V2581. MISRA. Single-line comments should not end with a continuation token.
V2582. MISRA. Block of memory should only be freed if it was allocated by a Standard Library function.
V3170. Both operands of the '??' operator are identical.
V3171. Potentially negative value is used as the size of an array.
V3551. AUTOSAR. An identifier with array type passed as a function argument should not decay to a pointer.
V5013. OWASP. Storing credentials inside source code can lead to security issues.
V5608. OWASP. Possible SQL injection. Potentially tainted data is used to create SQL command.

Есть расширение на visual studio, с ним удобно

PVS-Studio capabilities as a SAST (Static Application Security Testing) solution are increasing as we are launching the effort to support OWASP ASVS and AUTOSAR C++14 Coding Guidelines standards. Mapping tables between existing PVS-Studio rules and those two standards are now available. In future versions, PVS-Studio will increase its coverage for MISRA and AUTOSAR coding standards, as well as implement new rules based on OWASP Top 10 list for the most common and critical vulnerabilities.
PVS-Studio plug-in for JetBrains Rider IDE can now be used for checking Unreal Engine projects (JetBrains Rider for Unreal Engine is currently available in early access)
PVS-Studio SonarQube plug-in now supports classification of analyzer warnings that have a CWE (Common Weakness Enumeration) identifier as security defects in the Security Category tab.
PVS-Studio analysis log conversion tools (PlogConverter.exe for Windows and plog-converter for Linux\macOS) now support converting analysis results to SARIF (Static Analysis Results Interchange Format). SARIF is a universal and open format for presenting result output from tools that are dedicated to finding software errors, security and safety flaws and vulnerabilities. This format is supported by a large number of static analyzer tools, and facilitates collaborative use of different code quality assurance tools in common infrastructures.
V830. Decreased performance. Consider replacing the use of 'std::optional::value()' with either the '*' or '->' operator.
V831. Decreased performance. Consider replacing the call to the 'at()' method with the 'operator[]'.
V1064. The left operand of integer division is less than the right one. The result will always be zero.
V1065. Expression can be simplified: check similar operands.
V1066. The 'SysFreeString' function should be called only for objects of the 'BSTR' type.
V1067. Throwing from exception constructor may lead to unexpected behavior.
V3156. The argument of the method is not expected to be null.
V3157. Suspicious division. Absolute value of the left operand is less than the right operand.
V3158. Suspicious division. Absolute values of both operands are equal.
V3159. Modified value of the operand is not used after the increment/decrement operation.
V3160. Argument of incorrect type is passed to the 'Enum.HasFlag' method.
V3161. Comparing value type variables with 'ReferenceEquals' is incorrect because compared values will be boxed.
V3162. Suspicious return of an always empty collection.
V3163. An exception handling block does not contain any code.
V3164. Exception classes should be publicly accessible.
V6093. Automatic unboxing of a variable may cause NullPointerException.
V6094. The expression was implicitly cast from integer type to real type. Consider utilizing an explicit type cast to avoid the loss of a fractional part.
V6095. Thread.sleep() inside synchronized block/method may cause decreased performance.
V6096. An odd precise comparison. Consider using a comparison with defined precision: Math.abs(A - B) < Epsilon or Math.abs(A - B) > Epsilon.
V6097. Lowercase 'L' at the end of a long literal can be mistaken for '1'.
V6098. A method does not override another method from the base class.
V6099. The initial value of the index in the nested loop equals 'i'. Consider using 'i + 1' instead.

PVS-Studio is included in the Forrester Research report "Now Tech: Static Application Security Testing, Q3 2020" as a SAST specialist. Adopting Static Application Security Testing (SAST) methodology improves application security and helps to reduce the impact of security flaws in application lifecycle. Forrester Research is a leading emerging-technology research firm providing data and analysis that defines the impact of technology change on business. The report is available by purchase or with a subscription with Forrester Research.
Navigation for interprocedural analyzer messages was improved in PVS-Studio C# analyzer, for Visual Studio and Rider PVS-Studio extensions. It is now possible to navigate to potentially dangerous code fragments inside a method when the analyzer produces a warning at this method's invocation.
It is now possible to redefine default severity levels for PVS-Studio C# analyzer rules in rule configuration files (.pvsconfig).
V012. Some warnings could have been disabled. PVS-Studio C++ analyzer's report can now include the exclusion rules that are defined in the rule configuration files (.pvsconfig).
V826. Consider replacing standard container with a different one.
V827. Maximum size of a vector is known at compile time. Consider pre-allocating it by calling reserve(N).
V828. Decreased performance. Moving an object in a return statement prevents copy elision.
V829. Lifetime of the heap-allocated variable is limited to the current function's scope. Consider allocating it on the stack instead.
V1059. Macro name overrides a keyword/reserved name. This may lead to undefined behavior.
V1060. Passing 'BSTR ' to the 'SysAllocString' function may lead to incorrect object creation.
V1061. Extending 'std' or 'posix' namespace may result in undefined behavior.
V1062. Class defines a custom new or delete operator. The opposite operator must also be defined.
V1063. The modulo by 1 operation is meaningless. The result will always be zero.
V3154. The 'a % b' expression always evaluates to 0.
V3155. The expression is incorrect or it can be simplified.
V6082. Unsafe double-checked locking.
V6083. Serialization order of fields should be preserved during deserialization.
V6084. Suspicious return of an always empty collection.
V6085. An abnormality within similar comparisons. It is possible that a typo is present inside the expression.
V6086. Suspicious code formatting. 'else' keyword is probably missing.
V6087. InvalidClassException may occur during deserialization.
V6088. Result of this expression will be implicitly cast to 'Type'. Check if program logic handles it correctly.
V6089. It's possible that the line was commented out improperly, thus altering the program's operation logics.
V6090. Field 'A' is being used before it was initialized.
V6091. Suspicious getter/setter implementation. The 'A' field should probably be returned/assigned instead.
V6092. A resource is returned from try-with-resources statement. It will be closed before the method exits.