CWE IDs mapped to Klocwork C# checkers

ID	Checker name and description
20	CS.SQL.INJECT.LOCAL SQL injection CS.SV.TAINTED.ALLOC_SIZE Use of unvalidated integer in memory allocation CS.SV.TAINTED.CALL.GLOBAL Use of unvalidated integer in an assignment operation CS.SV.TAINTED.CALL.INDEX_ACCESS Use of unvalidated integer as array index by function call CS.SV.TAINTED.CALL.LOOP_BOUND Use of unvalidated integer in loop condition through a function call CS.SV.TAINTED.CALL.LOOP_BOUND.RESOURCE Resource allocation in a loop is controlled by tainted data CS.SV.TAINTED.DESERIALIZATION Use of unvalidated integer during deserialization in object creation CS.SV.TAINTED.FMTSTR Use of unvalidated data in a format string CS.SV.TAINTED.GLOBAL Use of Unvalidated Integer in an Assignment Operation CS.SV.TAINTED.INDEX_ACCESS Use of unvalidated integer as array index CS.SV.TAINTED.INJECTION C# command injection CS.SV.TAINTED.LOOP_BOUND Use of unvalidated integer in loop condition CS.SV.TAINTED.LOOP_BOUND.RESOURCE Resource allocation in a loop controlled by tainted data CS.SV.TAINTED.PATH_TRAVERSAL Use of unvalidated data in a path traversal
22	CS.SV.TAINTED.PATH_TRAVERSAL Use of unvalidated data in a path traversal
78	CS.SV.TAINTED.INJECTION C# command injection
79	CS.XSS.PERSIST Cross-site Scripting Persisting Vulnerability CS.XSS.REFLECT Cross-site Scripting Reflecting Vulnerability
89	CS.SQL.INJECT.LOCAL SQL injection
94	CS.SQL.INJECT.LOCAL SQL injection CS.SV.TAINTED.FMTSTR Use of unvalidated data in a format string
119	CS.SV.TAINTED.CALL.INDEX_ACCESS Use of unvalidated integer as array index by function call CS.SV.TAINTED.INDEX_ACCESS Use of unvalidated integer as array index
125	CS.ABV.EXCEPT IndexOutOfRange exception while accessing array element
190	CS.SV.TAINTED.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.BINOP Use of unvalidated integer in binary operation
192	CS.FRACTION.LOSS Possible loss of fraction
200	CS.INFORMATION_EXPOSURE.ALL Potential information exposure CS.INFORMATION_EXPOSURE.ATTR Potential security information exposure
269	CS.SV.USAGERULES.PERMISSIONS Use of Privilege Elevation
295	CS.X509.REVOCATION Certificate revocation list check is disabled. CS.X509.VALIDATION Validation of input is not done using AntiForgery.Validate
327	CS.RCA Risky cryptographic algorithm used
352	CS.CSRF.ATTR.NOATTR AntiForgery attribute should be added to class or method. CS.CSRF.ATTR.POST AntiForgery attribute should be added to class or method. CS.CSRF.VALIDATE Validation of 'POST request data access' is not done. CS.CSRF.VSUK.CONSTASSIGN A const string is assigned to property 'ViewStateUserKey'. CS.CSRF.VSUK.NOASSIGN Property 'ViewStateUserKey' is not set.
369	CS.DBZ.CONST Division by a zero constant occurs CS.DBZ.CONST.CALL The value '0' is passed to function that can use this value as divisor CS.DBZ.GENERAL Division by zero might occur CS.DBZ.ITERATOR Division by zero might occur in a loop iterator
398	CS.ASSIGN.SELF Assignment of expression to itself CS.CTOR.VIRTUAL Virtual member call in constructor CS.HIDDEN.MEMBER.LOCAL.CLASS Member is hidden by a local variable CS.HIDDEN.MEMBER.LOCAL.STRUCT Member is hidden by a local variable CS.HIDDEN.MEMBER.PARAM.CLASS Member is hidden by a parameter CS.HIDDEN.MEMBER.PARAM.STRUCT Member is hidden by a parameter CS.IFACE.EMPTY Empty interface CS.LOOP.STR.CONCAT String concatenation in a loop
400	CS.RESOURCE.AUTOBOXING Autoboxing during operation inside a loop CS.RESOURCE.LOOP Object Allocation inside a loop CS.RESOURCE.UNBOXING Unboxing during operation inside a loop CS.SV.TAINTED.CALL.LOOP_BOUND.RESOURCE Resource allocation in a loop is controlled by tainted data CS.SV.TAINTED.LOOP_BOUND.RESOURCE Resource allocation in a loop controlled by tainted data
404	CS.RLK Resource leak
416	CS.LOCRET.ARG Function returns address of local variable CS.LOCRET.GLOB Function returns address of local variable CS.LOCRET.RET Function returns address of local variable CS.UFR Using freed resource
426	CS.SV.TAINTED.DLLPRELOAD Use of unvalidated string to load a DLL CS.SV.TAINTED.PATH_TRAVERSAL Use of unvalidated data in a path traversal CS.UNSAFE.DLLPRELOAD Use of Attribute to Load a DLL CS.UNSAFE.SEARCH_PATH Use of search path to resolve absolute Path
476	CS.NRE.CHECK.CALL.MIGHT Reference may be passed to function that can dereference it after it was positively checked for null CS.NRE.CHECK.CALL.MUST Reference will be passed to function that may dereference it after it was positively checked for null CS.NRE.CHECK.MIGHT Reference may be dereferenced after it was positively checked for null CS.NRE.CHECK.MUST Reference will be dereferenced after it was positively checked for null CS.NRE.CONST.CALL Constant null is passed to function that can dereference it CS.NRE.CONST.DEREF Constant null is dereferenced CS.NRE.FUNC.CALL.MIGHT Result of function that may return null may be passed to another function that may dereference it CS.NRE.FUNC.CALL.MUST Result of function that may return null will be passed to another function that may dereference it CS.NRE.FUNC.MIGHT Result of function that can return null may be dereferenced CS.NRE.FUNC.MUST Result of function that may return null will be dereferenced CS.NRE.GEN.CALL.MIGHT Null reference may be passed to function that may dereference it CS.NRE.GEN.CALL.MUST Null reference will be passed to function that may dereference it CS.NRE.GEN.MIGHT Null reference may be dereferenced CS.NRE.GEN.MUST Null reference will be dereferenced CS.RNRE Suspicious dereference before null check
502	CS.SV.TAINTED.DESERIALIZATION Use of unvalidated integer during deserialization in object creation
562	CS.LOCRET.ARG Function returns address of local variable CS.LOCRET.GLOB Function returns address of local variable CS.LOCRET.RET Function returns address of local variable
570	CS.CMP.VAL.NULL Possible comparing value type expression with 'null' CS.CONSTCOND.DO 'do' controlling expression is always true or always false CS.CONSTCOND.IF 'if' controlling expression is always true or always false CS.CONSTCOND.SWITCH 'switch' selector expression is constant CS.CONSTCOND.TERNARY Controlling condition in conditional expression is always true or always false CS.CONSTCOND.WHILE 'while' controlling expression is always true or always false
596	CS.WRONGUSE.REFEQ Improper usage of Object.ReferenceEquals
611	CS.XXE.DOCUMENT Possible XML External Entity (XXE) Attack CS.XXE.READER Possible XML External Entity (XXE) Attack CS.XXE.TEXT_READER Possible XML External Entity (XXE) Attack
672	CS.LOCRET.ARG Function returns address of local variable CS.LOCRET.GLOB Function returns address of local variable CS.LOCRET.RET Function returns address of local variable
704	CS.UNCHECKED.CAST Object with type 'Object' is incorrectly cast to another object CS.UNCHECKED.LOOPITER.CAST Object with type 'Object' is incorrectly cast to another object in a loop CS.WRONG.CAST Object is incorrectly cast to another object CS.WRONG.CAST.MIGHT Object may be incorrectly cast to another object
732	CS.NPS No permissions set for resource before accessing it
772	CS.RLK Resource leak
787	CS.ABV.EXCEPT IndexOutOfRange exception while accessing array element
862	CS.AUTH.NOATTR Possible missing authorization check
896	CS.SV.TAINTED.ALLOC_SIZE Use of unvalidated integer in memory allocation CS.SV.TAINTED.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.GLOBAL Use of unvalidated integer in an assignment operation CS.SV.TAINTED.CALL.INDEX_ACCESS Use of unvalidated integer as array index by function call CS.SV.TAINTED.CALL.LOOP_BOUND Use of unvalidated integer in loop condition through a function call CS.SV.TAINTED.CALL.LOOP_BOUND.RESOURCE Resource allocation in a loop is controlled by tainted data CS.SV.TAINTED.DESERIALIZATION Use of unvalidated integer during deserialization in object creation CS.SV.TAINTED.DLLPRELOAD Use of unvalidated string to load a DLL CS.SV.TAINTED.FMTSTR Use of unvalidated data in a format string CS.SV.TAINTED.GLOBAL Use of Unvalidated Integer in an Assignment Operation CS.SV.TAINTED.INDEX_ACCESS Use of unvalidated integer as array index CS.SV.TAINTED.INJECTION C# command injection CS.SV.TAINTED.LOOP_BOUND Use of unvalidated integer in loop condition CS.SV.TAINTED.LOOP_BOUND.RESOURCE Resource allocation in a loop controlled by tainted data CS.SV.TAINTED.PATH_TRAVERSAL Use of unvalidated data in a path traversal
1235	CS.RESOURCE.AUTOBOXING Autoboxing during operation inside a loop CS.RESOURCE.UNBOXING Unboxing during operation inside a loop

Support Summary:

32 rules