PerformanceSharp.Analyzers 3.38.0

<br> <a href="https://github.com/glennawatson/RoslynCommonAnalyzers"> <img width="160" height="160" src="https://raw.githubusercontent.com/glennawatson/RoslynCommonAnalyzers/main/icons/icon.png" alt="StyleSharp.Analyzers"> </a> <br>

RoslynCommonAnalyzers

Three fast Roslyn analyzer and code-fix packages for .NET codebases, built from one repository:

• StyleSharp.Analyzers (SST####) — style and consistency: spacing, readability, ordering, layout, naming, maintainability, documentation, extension blocks, records, lock-target safety, modernization, collection expressions, and modern C# syntax.
• PerformanceSharp.Analyzers (PSH####) — runtime performance of your code: avoidable allocations, collection and LINQ enumeration costs, string handling, concurrency and async patterns, and cheaper API selection.
• SecuritySharp.Analyzers (SES####) — runtime security of your code: cryptography (algorithm, key, and nonce/IV misuse), transport protection, secret handling, injection sinks, unsafe deserialization, web hardening, and AI input trust boundaries.

All three packages are analyzer-only, target netstandard2.0, ship as a DevelopmentDependency, and pack analyzer/code-fix assemblies for multiple Roslyn slots under one NuGet package each. The analyzers themselves are engineered for build-time speed: allocation-free no-diagnostic paths, syntax-first candidate filtering, and per-rule benchmarks. Security rules never suggest an API without resolving it in the analyzed compilation first, and they report only local shapes — no interprocedural taint tracking.

Installation

dotnet add package StyleSharp.Analyzers
dotnet add package PerformanceSharp.Analyzers
dotnet add package SecuritySharp.Analyzers

Each package adds no runtime assemblies to your output and is not transitive to consumers of your library. They are independent — install any combination.

Documentation

• Full rule catalog (all three packages): docs/README.md
• Configuration: docs/CONFIGURATION.md
• Performance guidance: docs/PERFORMANCE.md
• Ready-to-use presets: recommended.editorconfig (StyleSharp), recommended-performancesharp.editorconfig (PerformanceSharp), and recommended-securitysharp.editorconfig (SecuritySharp)

The rule catalog is intentionally split out of this README so the GitHub landing page stays readable while the detailed rule index can grow with the project.

Rule Categories

StyleSharp (SST####)

• Spacing for token and whitespace conventions
• Readability for query layout, unique-line lists, tuple/null/style conventions, expression simplification, redundant-code removal, and similar readability rules
• Ordering for using ordering, modifier ordering, accessor ordering, and member ordering
• Layout for brace placement, blank-line rules, and block consistency
• Naming for .NET naming conventions, async-method suffixes, and override parameter names
• Maintainability for access modifiers, precedence, auto-properties, nameof, trailing commas, redundant modifiers, exception handling, type design, and related rules
• Documentation for XML docs, file headers, and documentation quality rules
• Extensions for C# 14 extension-block conventions
• Records for record and record-struct conventions
• Concurrency for lock-target safety rules
• Modernization for runtime throw-helper adoption and pattern-matching forms
• CollectionExpressions for collection-expression usage
• ModernSyntax for new language features such as the C# 14 field keyword

PerformanceSharp (PSH####)

• Allocations (PSH10xx) for closure/delegate allocations, throwaway empty arrays, and empty finalizers
• Collections (PSH11xx) for LINQ on hot paths, redundant iterator layers, O(1) count/indexer alternatives, and repeated dictionary/set lookups
• Strings (PSH12xx) for case-conversion comparison allocations, char overloads, and StringBuilder patterns
• Concurrency (PSH13xx) for System.Threading.Lock adoption and async/concurrency perf patterns
• ApiSelection (PSH14xx) for cheaper framework APIs such as one-shot HashData

SecuritySharp (SES####)

• Cryptography (SES10xx) for AEAD nonce/IV reuse, KDF salts, PBKDF2 iteration floors, non-CSPRNG secrets, and constant-time secret comparison
• Transport (SES11xx) for certificate-validation callbacks, chain-policy weakening, and cleartext transport
• Secrets (SES12xx) for hard-coded credentials, keys, and tokens
• Injection (SES13xx) for command, regex, upload-path, archive-extraction, and dynamic-script injection sinks
• Serialization (SES14xx) for unsafe type activation, assembly loading, and deserialization depth limits
• WebHardening (SES15xx) for CORS, authentication cookies, JWT validation, request-size limits, and error-page exposure
• Ai (SES16xx) for LLM prompt construction and model-input trust boundaries

Rules whose primary motivation is runtime performance live in PerformanceSharp, rules about runtime security live in SecuritySharp, and rules about style and consistency live in StyleSharp. Unless a rule is marked opt-in, it is enabled by default at Warning severity (a few advisory rules default to suggestion).

Configuration

All three packages are configured entirely through .editorconfig. Severity uses the standard dotnet_diagnostic.<RuleId>.severity keys, and rule options use the compiler-provided analyzer config system with a per-package prefix (stylesharp. / performancesharp. / securitysharp.).

[*.cs]
dotnet_diagnostic.SST1309.severity = warning
stylesharp.tuple_element_naming = pascal_case

dotnet_diagnostic.PSH1100.severity = warning
performancesharp.avoid_linq_on_hot_path = true

dotnet_diagnostic.SES1003.severity = warning
securitysharp.SES1003.iterations = 100000

See docs/CONFIGURATION.md for the full option list and the recommended configuration approach.

Repository Layout

Building And Testing

Run these commands from src/:

dotnet build RoslynCommonAnalyzers.slnx -c Release
dotnet test --project tests/StyleSharp.Analyzers.Tests/StyleSharp.Analyzers.Tests.csproj -c Release
dotnet test --project tests/PerformanceSharp.Analyzers.Tests/PerformanceSharp.Analyzers.Tests.csproj -c Release
dotnet test --project tests/SecuritySharp.Analyzers.Tests/SecuritySharp.Analyzers.Tests.csproj -c Release

To pack every Roslyn slot into the published NuGet packages:

dotnet pack StyleSharp.Analyzers.Package/StyleSharp.Analyzers.Packages.csproj -c Release
dotnet pack PerformanceSharp.Analyzers.Package/PerformanceSharp.Analyzers.Packages.csproj -c Release
dotnet pack SecuritySharp.Analyzers.Package/SecuritySharp.Analyzers.Packages.csproj -c Release

Contributing

Issues and pull requests are welcome.

When adding a rule, update all of the following (in whichever package the rule belongs to):

• analyzer implementation
• code-fix implementation if the rule is fixable
• tests
• docs/rules/SST####.md, docs/rules/PSH####.md, or docs/rules/SES####.md
• that package's AnalyzerReleases.Unshipped.md
• the matching preset (recommended.editorconfig / recommended-performancesharp.editorconfig / recommended-securitysharp.editorconfig) if the rule should appear there

Performance is a first-class requirement. Read docs/PERFORMANCE.md before changing analyzer hot paths, and benchmark changes rather than guessing.

License

MIT — see LICENSE.

Acknowledgements

The analyzers and code fixes here are written from scratch. No source code was copied from the projects below. License references are included in LICENSE where applicable.

• StyleCop.Analyzers, licensed under the MIT License, inspired the original shape of the project. Thanks to Sam Harwell and the StyleCop.Analyzers contributors.
• Roslynator, licensed under the Apache License 2.0, inspired some diagnostic design choices. Thanks to Josef Pihrt and the Roslynator contributors.
• The .NET SDK analyzer guidance and dotnet/roslyn, licensed under the MIT License, inspired parts of the style-rule coverage. Thanks to the .NET and Roslyn teams.