{"id":28068,"date":"2021-05-13T19:40:53","date_gmt":"2021-05-13T19:40:53","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/cppblog\/?p=28068"},"modified":"2021-05-13T19:40:53","modified_gmt":"2021-05-13T19:40:53","slug":"microsoft-c-code-analysis-supports-sarif-2-1","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/cppblog\/microsoft-c-code-analysis-supports-sarif-2-1\/","title":{"rendered":"Microsoft C++ Code Analysis supports SARIF 2.1"},"content":{"rendered":"<p><span data-contrast=\"none\">Starting with Visual Studio 16.8, MSVC Code Analysis officially supports SARIF 2.1.0 standard. SARIF is an industry standard for representing\u00a0static analysis logs\u00a0and we&#8217;ve been one of the earliest collaborators with the SARIF Technical Committee.<\/span><span data-contrast=\"auto\">\u00a0Behind the scenes,\u00a0analysis\u00a0log files in the\u00a0SARIF\u00a0format\u00a0powers\u00a0Visual Studio\u00a0IDE\u00a0to provide\u00a0a\u00a0richer experience that was not possible with\u00a0the\u00a0legacy\u00a0XML\u00a0logs. In this blog post we will present one of those enhanced experiences\u00a0\u2013\u00a0<\/span><span data-contrast=\"auto\">code analysis defects with different severity levels\u00a0<\/span><span data-contrast=\"auto\">in Error\u00a0List\u00a0and\u00a0<\/span><span data-contrast=\"auto\">color-coded\u00a0squiggles\u00a0<\/span><span data-contrast=\"auto\">for offending code segments.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<h1 aria-level=\"1\"><span data-contrast=\"none\">What is\u00a0SARIF?<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">SARIF\u00a0is an acronym for the\u00a0Static Analysis Results Interchange Format,\u00a0which\u00a0is a standard, JSON-based format for the output of\u00a0static analysis tools.\u00a0SARIF\u00a0provides\u00a0a rich format intended to meet the needs of\u00a0a\u00a0wide\u00a0range of\u00a0analysis\u00a0tools, both sophisticated and\u00a0simple\u00a0ones.\u00a0It\u00a0also\u00a0provides\u00a0an extensibility mechanism to allow tool authors to store custom data that the SARIF format doesn&#8217;t directly\u00a0support.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">You can find more\u00a0information on SARIF\u00a0at\u00a0<\/span><a href=\"https:\/\/sarifweb.azurewebsites.net\/#:~:text=The%20Static%20Analysis%20Results%20Interchange,approved%20as%20an%20OASIS%20standard\"><span data-contrast=\"none\">this<\/span><\/a><span data-contrast=\"auto\">\u00a0introductory\u00a0page.\u00a0The latest SARIF standard\u00a0is available at\u00a0<\/span><a href=\"https:\/\/www.oasis-open.org\/committees\/tc_home.php?wg_abbrev=sarif\"><span data-contrast=\"none\">this<\/span><\/a><span data-contrast=\"auto\">\u00a0page.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<h1 aria-level=\"1\"><span data-contrast=\"none\">C++\u00a0Code Analysis\u00a0and SARIF<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">MSVC Code Analysis\u00a0has been using a custom XML\u00a0log\u00a0format to report defects it finds during\u00a0code\u00a0analysis.\u00a0While this\u00a0has\u00a0served customers well\u00a0for\u00a0the last\u00a0decade,\u00a0we\u00a0decided to support\u00a0SARIF\u00a0for richer capability\u00a0such as\u00a0logging\u00a0list of\u00a0files analyzed, configuration overrides for analysis, location where defects are suppressed\u00a0if logging suppressed warnings, etc.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">We have been supporting SARIF in VS for quite some time, even the earliest drafts of the specification. 16.8 is the release that MSVC Code Analysis supports SARIF 2.1 standard.<\/span><span data-contrast=\"auto\">\u00a0With this update, MSVC Code Analysis\u00a0provided\u00a0some enhanced experience that many readers\u00a0may\u00a0already know, including but not limited to:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" aria-setsize=\"-1\" data-aria-posinset=\"16\" data-aria-level=\"1\"><span data-contrast=\"auto\">Background code analysis<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" aria-setsize=\"-1\" data-aria-posinset=\"16\" data-aria-level=\"1\"><span data-contrast=\"auto\">Green squiggles for code analysis defects<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" aria-setsize=\"-1\" data-aria-posinset=\"16\" data-aria-level=\"1\"><span data-contrast=\"auto\">Fix-it\u00a0for automatic recommendations to fix\u00a0defects<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">To\u00a0add more\u00a0improvements\u00a0to code analysis, we have updated\u00a0MSVC\u00a0Code Analysis\u00a0to support the latest SARIF 2.1.0 standard.\u00a0At the same time,\u00a0it\u00a0has been updated to\u00a0provide options to\u00a0record\u00a0more information\u00a0to the\u00a0SARIF\u00a0log file:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" aria-setsize=\"-1\" data-aria-posinset=\"16\" data-aria-level=\"1\"><span data-contrast=\"auto\">List of files\u00a0analyzed\u00a0<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" aria-setsize=\"-1\" data-aria-posinset=\"16\" data-aria-level=\"1\"><span data-contrast=\"auto\">Configurations used for code analysis, including command-line\u00a0options<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" aria-setsize=\"-1\" data-aria-posinset=\"16\" data-aria-level=\"1\"><span data-contrast=\"auto\">Rule actions for each of the active rules for which defects are\u00a0reported<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">While we were\u00a0updating\u00a0MSVC\u00a0Code Analysis\u00a0to add more information to\u00a0SARIF\u00a0log files,\u00a0we\u00a0also\u00a0added\u00a0new\u00a0capabilities\u00a0to it:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" aria-setsize=\"-1\" data-aria-posinset=\"17\" data-aria-level=\"1\"><span data-contrast=\"auto\">Ability to log compiler warnings in addition to code analysis\u00a0warnings<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Ability to log suppressed warnings\u00a0with location of\u00a0suppression<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:720,&quot;335559737&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259,&quot;335559991&quot;:360}\">\u00a0<\/span><\/li>\n<\/ul>\n<h1 aria-level=\"1\"><span data-contrast=\"none\">Rule Actions in Visual Studio<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">As we update\u00a0MSVC\u00a0Code Analysis\u00a0with support of the latest SARIF standard and additional information on analysis and defects, we also updated Visual Studio to enhance the code analysis experience.\u00a0<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">In the following sections, let\u2019s look\u00a0at an\u00a0enhanced code analysis experience in Visual Studio IDE.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<h2 aria-level=\"1\"><span data-contrast=\"none\">Ruleset and\u00a0Rule Actions<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">MSVC\u00a0Code Analysis\u00a0can be used with\u00a0one or more\u00a0ruleset files that can enable or disable selected rules.\u00a0Rules that are enabled in the ruleset\u00a0are\u00a0checked and reported by\u00a0the analysis tools. Rules that are disabled in a ruleset will be ignored by\u00a0MSVC\u00a0Code Analysis\u00a0and will not be checked or reported.\u00a0More information on rulesets can be\u00a0found\u00a0<\/span><a href=\"https:\/\/docs.microsoft.com\/en-us\/visualstudio\/code-quality\/using-rule-sets-to-group-code-analysis-rules\"><span data-contrast=\"none\">here<\/span><\/a><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Each of the rules in the ruleset file can be assigned with one of the following \u201cRule Action\u201d values:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<table data-tablestyle=\"MsoTableGrid\" data-tablelook=\"1184\" aria-rowcount=\"7\">\n<tbody>\n<tr aria-rowindex=\"1\">\n<td data-celllook=\"65536\"><b><span data-contrast=\"auto\">Rule Action<\/span><\/b><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"65536\"><b><span data-contrast=\"auto\">Description<\/span><\/b><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"2\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">None<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Do not check or\u00a0report<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"3\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Hidden<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">May check, but do not\u00a0report<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"4\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Default<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Inherit default action from &lt;Include&gt; or &lt;IncludeAll&gt;<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"5\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Info<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Report as Informational<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"6\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Warning<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Report\u00a0as\u00a0Warning<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"7\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Error<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Report as Error<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Until we added support for SARIF,\u00a0MSVC\u00a0Code Analysis\u00a0could only map\u00a0these\u00a0rule\u00a0actions\u00a0simply\u00a0to \u201cenabled\u201d or \u201cdisabled\u201d\u00a0states, and either reported or ignored\u00a0until it was added with the support for SARIF.\u00a0Visual Studio build\u00a0used ruleset files directly and could\u00a0differentiate\u00a0rules with\u00a0\u201cError\u201d\u00a0Rule Action\u00a0from the reset of\u00a0the\u00a0enabled rules, which were considered as \u201cWarning\u201d regardless of their Rule Action values.\u00a0Visual Studio IDE did not honor the Rule Action\u00a0values, and\u00a0treated everything as \u201cWarning\u201d.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">With the support of SARIF,\u00a0MSVC\u00a0Code Analysis\u00a0now\u00a0maps\u00a0these rule actions\u00a0to the SARIF\u2019s level property\u00a0in the log file\u00a0as follows:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<table data-tablestyle=\"MsoTableGrid\" data-tablelook=\"1184\" aria-rowcount=\"6\">\n<tbody>\n<tr aria-rowindex=\"1\">\n<td data-celllook=\"65536\"><b><span data-contrast=\"auto\">Rule Action<\/span><\/b><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"65536\"><b><span data-contrast=\"auto\">SARIF level property<\/span><\/b><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"2\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">None<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">none<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"3\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Hidden<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">none<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"4\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Info<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">note<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"5\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Warning<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">warning<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"6\">\n<td data-celllook=\"0\"><span data-contrast=\"auto\">Error<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"auto\">error<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">A rule with\u00a0Rule Action\u00a0value\u00a0of \u201cdefault\u201d will be assigned with one of the other Rule Action values before mapped to the SARIF\u2019s level.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<h2 aria-level=\"1\"><span data-contrast=\"none\">Rule Actions in Action<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">Let\u2019s look at how Visual Studio now uses the Rule Action values in the ruleset to improve the code analysis experience.\u00a0As an example,\u00a0let\u2019s consider\u00a0a custom ruleset with the following content:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<pre class=\"prettyprint\">&lt;?xml version=\"1.0\" encoding=\"utf-8\"?&gt;\u00a0\r\n&lt;RuleSet Name=\"Copy of Microsoft Native Recommended Rules\" Description=\"My custom rules\" ToolsVersion=\"16.0\"&gt;\u00a0\r\n\u00a0 &lt;Rules AnalyzerId=\"Microsoft.Analyzers.NativeCodeAnalysis\" RuleNamespace=\"Microsoft.Rules.Native\"&gt;\u00a0\r\n\u00a0\u00a0\u00a0 &lt;Rule Id=\"C6001\" Action=\"Warning\" \/&gt;\u00a0\r\n\u00a0\u00a0\u00a0 &lt;Rule Id=\"C6011\" Action=\"Error\" \/&gt;\u00a0\r\n\u00a0\u00a0\u00a0 &lt;Rule Id=\"C6201\" Action=\"None\" \/&gt;\u00a0\r\n\u00a0\u00a0\u00a0 &lt;Rule Id=\"C6385\" Action=\"Info\" \/&gt;\u00a0\r\n\u00a0\u00a0\u00a0 &lt;Rule Id=\"C6386\" Action=\"Info\" \/&gt;\u00a0\r\n\u00a0 &lt;\/Rules&gt;\u00a0\r\n&lt;\/RuleSet&gt;<\/pre>\n<p><span data-contrast=\"auto\">And a *.cpp file with following test code:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<pre class=\"prettyprint\">#pragma warning(disable:4700)\r\n  \r\nvoid foo()\r\n{\u00a0\r\n\u00a0\u00a0\u00a0\u00a0int arr[4]{};\u00a0\r\n\u00a0\u00a0\u00a0\u00a0int v = arr[4]; \/\/ C6201, C6385\u00a0\r\n\u00a0\u00a0\u00a0\u00a0arr[4] = 2;\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ C6201, C6386\u00a0\r\n\r\n\u00a0\u00a0\u00a0\u00a0int x;\u00a0\r\n\u00a0\u00a0\u00a0\u00a0int* py = nullptr;\u00a0\r\n\u00a0\u00a0\u00a0\u00a0int y = *py;\u00a0\u00a0\u00a0\u00a0\/\/ C6011\u00a0\r\n\u00a0\u00a0\u00a0 y += x;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ C6001\u00a0\r\n}<\/pre>\n<p><span data-contrast=\"auto\">When\u00a0configured to use the above custom ruleset for analysis,\u00a0analyzing\u00a0the\u00a0test code\u00a0in Visual Studio produces\u00a0results\u00a0as shown\u00a0in below screenshot:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/cppblog\/wp-content\/uploads\/sites\/9\/2021\/05\/Untitled-1.png\"><img decoding=\"async\" class=\"alignnone wp-image-28070\" src=\"https:\/\/devblogs.microsoft.com\/cppblog\/wp-content\/uploads\/sites\/9\/2021\/05\/Untitled-1-300x173.png\" alt=\"Image Untitled\" width=\"791\" height=\"456\" srcset=\"https:\/\/devblogs.microsoft.com\/cppblog\/wp-content\/uploads\/sites\/9\/2021\/05\/Untitled-1-300x173.png 300w, https:\/\/devblogs.microsoft.com\/cppblog\/wp-content\/uploads\/sites\/9\/2021\/05\/Untitled-1-1024x592.png 1024w, https:\/\/devblogs.microsoft.com\/cppblog\/wp-content\/uploads\/sites\/9\/2021\/05\/Untitled-1-768x444.png 768w, https:\/\/devblogs.microsoft.com\/cppblog\/wp-content\/uploads\/sites\/9\/2021\/05\/Untitled-1.png 1293w\" sizes=\"(max-width: 791px) 100vw, 791px\" \/><\/a><\/p>\n<p><span data-contrast=\"auto\">Please note how the\u00a0defects are listed in the\u00a0Error List window, and\u00a0how\u00a0their corresponding code segments are\u00a0highlighted in the text editor window:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">In the\u00a0Error List\u00a0window, C6011 is\u00a0listed as\u00a0an Error, C6001\u00a0as\u00a0a\u00a0Warning,\u00a0 and\u00a0C6385 and C6386\u00a0as\u00a0Messages.<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">In the text editor window, code\u00a0segment\u00a0for C6011 is highlighted with red squiggle, C6001 with green squiggle, and C6385 and C6386 with gray squiggles (dots)<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">As you can see in the above example, rule actions\u00a0in the ruleset\u00a0maps to\u00a0Visual Studio\u00a0build output, Error List,\u00a0and\u00a0text editor\u00a0display\u00a0through the\u00a0level property of SARIF\u00a0as follows:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<table data-tablestyle=\"MsoNormalTable\" data-tablelook=\"1184\" aria-rowcount=\"7\">\n<tbody>\n<tr aria-rowindex=\"1\">\n<td data-celllook=\"69905\"><b><span data-contrast=\"auto\">Rule Action<\/span><\/b><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335551550&quot;:2,&quot;335551620&quot;:2,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"69905\"><b><span data-contrast=\"auto\">SARIF level<\/span><\/b><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335551550&quot;:2,&quot;335551620&quot;:2,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"69905\"><b><span data-contrast=\"auto\">Build\u00a0Output<\/span><\/b><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335551550&quot;:2,&quot;335551620&quot;:2,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"69905\"><b><span data-contrast=\"auto\">Error List<\/span><\/b><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335551550&quot;:2,&quot;335551620&quot;:2,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"69905\"><b><span data-contrast=\"auto\">Editor\u00a0Display<\/span><\/b><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335551550&quot;:2,&quot;335551620&quot;:2,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"2\">\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Error<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">error<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Appear as\u202f<\/span><i><span data-contrast=\"auto\">Errors<\/span><\/i><span data-contrast=\"auto\">\u202fin\u00a0the\u00a0output\u00a0window.\u00a0These\u00a0cause\u00a0the\u00a0build\u00a0to fail.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Appear as\u202f<\/span><i><span data-contrast=\"auto\">Errors<\/span><\/i><span data-contrast=\"auto\">\u202fin the Error List.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Offending code is underlined with a red squiggle and marked by a small red box in the scroll bar.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"3\">\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Warning<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">warning<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Appear as\u202f<\/span><i><span data-contrast=\"auto\">Warnings<\/span><\/i><span data-contrast=\"auto\">\u202fin the output\u00a0window. These\u00a0do not cause\u00a0the\u00a0build\u00a0to fail.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Appear as\u202f<\/span><i><span data-contrast=\"auto\">Warnings<\/span><\/i><span data-contrast=\"auto\">\u202fin the Error List.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Offending code is underlined with a green squiggle and marked by a small green box in the scroll bar.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"4\">\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Info<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">note<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Appear as\u202f<\/span><i><span data-contrast=\"auto\">Warnings<\/span><\/i><span data-contrast=\"auto\">\u00a0in\u00a0the\u00a0build output.\u00a0These do not\u00a0cause\u00a0the\u00a0build\u00a0to fail.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Appear as\u202f<\/span><i><span data-contrast=\"auto\">Messages<\/span><\/i><span data-contrast=\"auto\">\u202fin the Error List.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Offending code is underlined with a gray squiggle and marked by a small gray box in the scroll bar.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"5\">\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Hidden<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">none<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Not reported<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Not reported<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Not reported<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"6\">\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">None<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">none<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Not reported<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Not reported<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Not reported<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"7\">\n<td data-celllook=\"4369\"><span data-contrast=\"auto\">Default<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"4369\"><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<td colspan=\"3\" data-celllook=\"4369\"><span data-contrast=\"auto\">Corresponds to the default\u00a0action\u00a0of the rule.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Please note that rules with Rule Action value of \u201cInfo\u201d is also reported as \u201cWarning\u201d in the Visual Studio build output window. This has been the behavior before the adoption of SARIF log format.\u00a0Following our guiding principle\u00a0of keeping minimal friction for our customers during Visual Studio upgrades, we kept this behavior as is to not change the build behavior\u00a0of existing projects. Please share your feedback on this for future improvements \u2013 whether it should be updated to honor the Rule Action value of \u201cInfo\u201d and reported as \u201cNote\u201d or something like that.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<h1 aria-level=\"1\"><span data-contrast=\"none\">Send Us Feedback<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"none\">Please download\u00a0<\/span><a href=\"https:\/\/visualstudio.microsoft.com\/vs\/preview\/\"><span data-contrast=\"none\">the latest Visual Studio 2019<\/span><\/a><span data-contrast=\"none\">\u00a0and give it a try! Any feedback is welcome. We can be reached via the comments below,\u00a0<\/span><a href=\"https:\/\/developercommunity.visualstudio.com\/spaces\/8\/index.html\"><span data-contrast=\"none\">Developer Community<\/span><\/a><span data-contrast=\"none\">, email (<\/span><a href=\"mailto:visualcpp@microsoft.com\"><span data-contrast=\"none\">visualcpp@microsoft.com<\/span><\/a><span data-contrast=\"none\">), and Twitter (<\/span><a href=\"https:\/\/twitter.com\/visualc\"><span data-contrast=\"none\">@VisualC<\/span><\/a><span data-contrast=\"none\">).<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Starting with Visual Studio 16.8, MSVC Code Analysis officially supports SARIF 2.1.0 standard. SARIF is an industry standard for representing\u00a0static analysis logs\u00a0and we&#8217;ve been one of the earliest collaborators with the SARIF Technical Committee.\u00a0Behind the scenes,\u00a0analysis\u00a0log files in the\u00a0SARIF\u00a0format\u00a0powers\u00a0Visual Studio\u00a0IDE\u00a0to provide\u00a0a\u00a0richer experience that was not possible with\u00a0the\u00a0legacy\u00a0XML\u00a0logs. In this blog post we will present one [&hellip;]<\/p>\n","protected":false},"author":39446,"featured_media":35994,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,239],"tags":[119,3891,3890,3892],"class_list":["post-28068","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cplusplus","category-diagnostics","tag-code-analysis","tag-rule-action","tag-ruleset","tag-sarif"],"acf":[],"blog_post_summary":"<p>Starting with Visual Studio 16.8, MSVC Code Analysis officially supports SARIF 2.1.0 standard. SARIF is an industry standard for representing\u00a0static analysis logs\u00a0and we&#8217;ve been one of the earliest collaborators with the SARIF Technical Committee.\u00a0Behind the scenes,\u00a0analysis\u00a0log files in the\u00a0SARIF\u00a0format\u00a0powers\u00a0Visual Studio\u00a0IDE\u00a0to provide\u00a0a\u00a0richer experience that was not possible with\u00a0the\u00a0legacy\u00a0XML\u00a0logs. In this blog post we will present one [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts\/28068","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/users\/39446"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/comments?post=28068"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts\/28068\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/media\/35994"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/media?parent=28068"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/categories?post=28068"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/tags?post=28068"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}