In this chapter, we will cover two very important and popular category of Roslyn analyzers: security and performance analyzers.
- Security: Given the extremely large domain of .NET applications, each of them with very domain-specific security vulnerabilities, it is critical that we have a domain-specific tools/extensions to catch these vulnerabilities. Roslyn-based security analyzers, such as PUMA scan analyzers, catch these vulnerabilities at compile time and report diagnostics. PUMA scan analyzer rules are classified into the following broad categories:
- Configuration (https://www.pumascan.com/rules.html#overview): Rules to catch vulnerabilities in ASP.NET Web configuration files
- Cross-site Scripting (https://www.pumascan.com/rules.html#cross-site-scripting): Rules to catch cross-site scripting (XSS) vulnerabilities
- Injection (https://www.pumascan.com/rules.html...
