Avoid redundant dataflow in security analyzers by tannergooding · Pull Request #56415 · dotnet/sdk

tannergooding · 2026-09-27T13:28:35Z

Note

This PR description was drafted with AI assistance.

The crypto rules were running whole-method dataflow for each literal byte-array source, even in generated methods that never call a relevant cryptographic API. With thousands of call sites, that repeats expensive work without a possible diagnostic. This change first checks whether a sink is reachable (including through helpers), skips sink-free methods, and runs taint analysis once per method instead of once per source. Value-content analysis is omitted when neither source recognition nor control-flow decisions need it; ambiguous cases still use the original full analysis. The reachability checks conservatively account for implicit calls, initializers, branches, and recursive helpers rather than assuming a simple source-operation walk covers the CFG.

The same approach avoids value-content flow in property-set rules unless a mapped constructor, property write, or relevant control-flow path requires it. Value-independent constructor overloads can be mapped directly, while value-dependent ones retain flow. Direct constant checks for AppContext.SetSwitch and Azure SharedAccessProtocol avoid building dataflow for already-known arguments.

Targeted local reproductions (not general speedup guarantees) measured the 2,048-call CA5390/CA5403 case at about 128s before vs. 2.3-2.5s after, a sink-free SQL CA3001 case at 1.209s vs. 0.014s, and a CA2329/CA2330 property-set case at 40.787s vs. 1.313s. The analyzer-free build of the crypto reproduction was 0.4-0.5s, so this reduces rather than eliminates analyzer overhead.

Skip whole-method flow when no relevant sink is reachable and omit value-content flow when it cannot affect mapped operations. Preserve diagnostic behavior for implicit calls, initializers, conditional branches, and helper methods. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

azure-pipelines · 2026-09-27T13:28:50Z

Azure Pipelines: Successfully started running 1 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Copilot review overview

🟡 Changes recommended

One or more issues must be addressed before approval.

Review effort: Lite
Findings: 2

Open (2)

Only the first operation-block CFG is analyzed · New
Constructor initializers are omitted from reachability analysis · New

What changed in this PR

Optimizes security analyzers by avoiding unnecessary dataflow and adding broader C#/VB regression coverage.

Changes:

Adds sink-reachability and value-content prepasses.
Adds direct constant handling and constructor mappings.
Expands analyzer tests for helpers, initializers, branches, and VB.

File	Description
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/UseSharedAccessProtocolHttpsOnlyTests.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/TaintedDataAnalyzerTestBase.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/ReviewCodeForXssVulnerabilitiesTests.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/ReviewCodeForSqlInjectionVulnerabilitiesTests.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotUseWeakKDFInsufficientIterationCountTests.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotUseInsecureDeserializerJsonNetWithoutBinderTests.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotInstallRootCertTests.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeEncryptionKeyTests.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeCertificateTests.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotDisableSchUseStrongCryptoTests.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/FlowAnalysis/FlowAnalysis/Analysis/TaintedDataAnalysis/TaintedDataAnalysis.TaintedDataOperationVisitor.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/FlowAnalysis/FlowAnalysis/Analysis/TaintedDataAnalysis/TaintedDataAnalysis.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/FlowAnalysis/FlowAnalysis/Analysis/PropertySetAnalysis/PropertySetAnalysis.PropertySetDataFlowOperationVisitor.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/FlowAnalysis/FlowAnalysis/Analysis/PropertySetAnalysis/PropertySetAnalysis.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Utilities/FlowAnalysis/FlowAnalysis/Analysis/PropertySetAnalysis/ConstructorMapper.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Security/UseSharedAccessProtocolHttpsOnly.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Security/SourceTriggeredTaintedDataAnalyzerBase.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Security/DoNotUseWeakKDFInsufficientIterationCount.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Security/DoNotSetSwitch.cs	Updated as part of this pull request.
src/Microsoft.CodeAnalysis.NetAnalyzers/src/Microsoft.CodeAnalysis.NetAnalyzers/Microsoft.NetCore.Analyzers/Security/DoNotInstallRootCert.cs	Updated as part of this pull request.

Evangelink

Note

Drafted with AI assistance.

Found one performance regression-coverage gap.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Evangelink

Note

Drafted with AI assistance.

Found three remaining performance regression-coverage gaps.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Evangelink · 2026-09-29T13:45:58Z

/azp run

azure-pipelines · 2026-09-29T13:46:21Z

Azure Pipelines: Successfully started running 2 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions.

tannergooding · 2026-09-29T19:40:28Z

@Evangelink anything else on this one?

jeffhandley · 2026-10-09T20:12:40Z

I will support backporting this into 11.0 servicing (post-GA)

tannergooding · 2026-10-10T12:51:56Z

/backport to release/11.0.2xx

github-actions · 2026-10-10T12:52:05Z

Started backporting to release/11.0.2xx (link to workflow run)

github-actions · 2026-10-10T12:52:45Z

@tannergooding backporting to release/11.0.2xx failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git cherry-pick 4d9bbbe02a27d3e522c8801694f0341e707d4711

Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotDisableSchUseStrongCryptoTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeCertificateTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeEncryptionKeyTests.cs
CONFLICT (content): Merge conflict in src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeEncryptionKeyTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotInstallRootCertTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotUseInsecureDeserializerJsonNetWithoutBinderTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotUseWeakKDFInsufficientIterationCountTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/ReviewCodeForSqlInjectionVulnerabilitiesTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/ReviewCodeForXssVulnerabilitiesTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/UseSharedAccessProtocolHttpsOnlyTests.cs
CONFLICT (content): Merge conflict in src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/UseSharedAccessProtocolHttpsOnlyTests.cs
error: could not apply 4d9bbbe02a... Avoid redundant dataflow in security analyzers (#56415)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"


$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Avoid redundant security analyzer dataflow
Using index info to reconstruct a base tree...
M	src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotDisableSchUseStrongCryptoTests.cs
M	src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeCertificateTests.cs
M	src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeEncryptionKeyTests.cs
M	src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotInstallRootCertTests.cs
M	src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotUseInsecureDeserializerJsonNetWithoutBinderTests.cs
M	src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotUseWeakKDFInsufficientIterationCountTests.cs
M	src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/ReviewCodeForSqlInjectionVulnerabilitiesTests.cs
M	src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/ReviewCodeForXssVulnerabilitiesTests.cs
M	src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/UseSharedAccessProtocolHttpsOnlyTests.cs
Falling back to patching base and 3-way merge...
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotDisableSchUseStrongCryptoTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeCertificateTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeEncryptionKeyTests.cs
CONFLICT (content): Merge conflict in src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotHardCodeEncryptionKeyTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotInstallRootCertTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotUseInsecureDeserializerJsonNetWithoutBinderTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/DoNotUseWeakKDFInsufficientIterationCountTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/ReviewCodeForSqlInjectionVulnerabilitiesTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/ReviewCodeForXssVulnerabilitiesTests.cs
Auto-merging src/Microsoft.CodeAnalysis.NetAnalyzers/tests/Microsoft.CodeAnalysis.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/UseSharedAccessProtocolHttpsOnlyTests.cs
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Avoid redundant security analyzer dataflow
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output

Copilot AI lite review requested due to automatic review settings September 27, 2026 13:28

tannergooding requested a review from a team as a code owner September 27, 2026 13:28

Copilot started reviewing on behalf of tannergooding September 27, 2026 13:29

View session

Copilot AI reviewed Sep 27, 2026

View reviewed changes

Comment thread ....NetAnalyzers/Microsoft.NetCore.Analyzers/Security/SourceTriggeredTaintedDataAnalyzerBase.cs Resolved

Comment thread ....NetAnalyzers/Microsoft.NetCore.Analyzers/Security/SourceTriggeredTaintedDataAnalyzerBase.cs Resolved

Evangelink reviewed Sep 29, 2026

View reviewed changes

Comment thread ...s.NetAnalyzers.UnitTests/Microsoft.NetCore.Analyzers/Security/TaintedDataAnalyzerTestBase.cs Resolved

Assert security analyzer dataflow skip paths

7d020c1

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Evangelink reviewed Sep 29, 2026

View reviewed changes

Prove security analyzer fast paths with scoped counters

57a73a7

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

tannergooding mentioned this pull request Sep 29, 2026

Reduce CA1508 analysis cost for local-function calls #56414

Merged

Evangelink approved these changes Sep 30, 2026

View reviewed changes

Evangelink merged commit 4d9bbbe into dotnet:main Sep 30, 2026
41 checks passed

Evangelink had a problem deploying to copilot-pat-pool September 30, 2026 09:40 — with GitHub Actions Failure

dotnet-maestro Bot mentioned this pull request Oct 1, 2026

[main] Source code updates from dotnet/sdk dotnet/dotnet#9869

Merged

dotnet-milestone-bot Bot added this to the 12.0-preview1 milestone Oct 1, 2026

tannergooding mentioned this pull request Oct 10, 2026

[release/11.0.2xx] Avoid redundant dataflow in security analyzers #56581

Merged

2 of 4 tasks

Conversation

tannergooding commented Sep 27, 2026

Uh oh!

azure-pipelines Bot commented Sep 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Evangelink left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Evangelink left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Evangelink commented Sep 29, 2026

Uh oh!

azure-pipelines Bot commented Sep 29, 2026

Uh oh!

tannergooding commented Sep 29, 2026

Uh oh!

Uh oh!

jeffhandley commented Oct 9, 2026

Uh oh!

tannergooding commented Oct 10, 2026

Uh oh!

github-actions Bot commented Oct 10, 2026

Uh oh!

github-actions Bot commented Oct 10, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants