# NOTE: Requires **VS2019 16.7** or later

# 'Security' Rules from '9.0' release with 'All' analysis mode escalated to 'error' severity
# Description: 'Security' Rules with enabled-by-default state from '9.0' release with 'All' analysis mode. Rules that are first released in a version later than '9.0' are disabled. Enabled rules with 'warning' severity are escalated to 'error' severity to respect 'CodeAnalysisTreatWarningsAsErrors' MSBuild property.

is_global = true

global_level = -99


# CA2100: Review SQL queries for security vulnerabilities
dotnet_diagnostic.CA2100.severity = error

# CA2119: Seal methods that satisfy private interfaces
dotnet_diagnostic.CA2119.severity = error

# CA2153: Do Not Catch Corrupted State Exceptions
dotnet_diagnostic.CA2153.severity = error

# CA2300: Do not use insecure deserializer BinaryFormatter
dotnet_diagnostic.CA2300.severity = error

# CA2301: Do not call BinaryFormatter.Deserialize without first setting BinaryFormatter.Binder
dotnet_diagnostic.CA2301.severity = error

# CA2302: Ensure BinaryFormatter.Binder is set before calling BinaryFormatter.Deserialize
dotnet_diagnostic.CA2302.severity = error

# CA2305: Do not use insecure deserializer LosFormatter
dotnet_diagnostic.CA2305.severity = error

# CA2310: Do not use insecure deserializer NetDataContractSerializer
dotnet_diagnostic.CA2310.severity = error

# CA2311: Do not deserialize without first setting NetDataContractSerializer.Binder
dotnet_diagnostic.CA2311.severity = error

# CA2312: Ensure NetDataContractSerializer.Binder is set before deserializing
dotnet_diagnostic.CA2312.severity = error

# CA2315: Do not use insecure deserializer ObjectStateFormatter
dotnet_diagnostic.CA2315.severity = error

# CA2321: Do not deserialize with JavaScriptSerializer using a SimpleTypeResolver
dotnet_diagnostic.CA2321.severity = error

# CA2322: Ensure JavaScriptSerializer is not initialized with SimpleTypeResolver before deserializing
dotnet_diagnostic.CA2322.severity = error

# CA2326: Do not use TypeNameHandling values other than None
dotnet_diagnostic.CA2326.severity = error

# CA2327: Do not use insecure JsonSerializerSettings
dotnet_diagnostic.CA2327.severity = error

# CA2328: Ensure that JsonSerializerSettings are secure
dotnet_diagnostic.CA2328.severity = error

# CA2329: Do not deserialize with JsonSerializer using an insecure configuration
dotnet_diagnostic.CA2329.severity = error

# CA2330: Ensure that JsonSerializer has a secure configuration when deserializing
dotnet_diagnostic.CA2330.severity = error

# CA2350: Do not use DataTable.ReadXml() with untrusted data
dotnet_diagnostic.CA2350.severity = error

# CA2351: Do not use DataSet.ReadXml() with untrusted data
dotnet_diagnostic.CA2351.severity = error

# CA2352: Unsafe DataSet or DataTable in serializable type can be vulnerable to remote code execution attacks
dotnet_diagnostic.CA2352.severity = error

# CA2353: Unsafe DataSet or DataTable in serializable type
dotnet_diagnostic.CA2353.severity = error

# CA2354: Unsafe DataSet or DataTable in deserialized object graph can be vulnerable to remote code execution attacks
dotnet_diagnostic.CA2354.severity = error

# CA2355: Unsafe DataSet or DataTable type found in deserializable object graph
dotnet_diagnostic.CA2355.severity = error

# CA2356: Unsafe DataSet or DataTable type in web deserializable object graph
dotnet_diagnostic.CA2356.severity = error

# CA2361: Ensure auto-generated class containing DataSet.ReadXml() is not used with untrusted data
dotnet_diagnostic.CA2361.severity = error

# CA2362: Unsafe DataSet or DataTable in auto-generated serializable type can be vulnerable to remote code execution attacks
dotnet_diagnostic.CA2362.severity = error

# CA3001: Review code for SQL injection vulnerabilities
dotnet_diagnostic.CA3001.severity = error

# CA3002: Review code for XSS vulnerabilities
dotnet_diagnostic.CA3002.severity = error

# CA3003: Review code for file path injection vulnerabilities
dotnet_diagnostic.CA3003.severity = error

# CA3004: Review code for information disclosure vulnerabilities
dotnet_diagnostic.CA3004.severity = error

# CA3005: Review code for LDAP injection vulnerabilities
dotnet_diagnostic.CA3005.severity = error

# CA3006: Review code for process command injection vulnerabilities
dotnet_diagnostic.CA3006.severity = error

# CA3007: Review code for open redirect vulnerabilities
dotnet_diagnostic.CA3007.severity = error

# CA3008: Review code for XPath injection vulnerabilities
dotnet_diagnostic.CA3008.severity = error

# CA3009: Review code for XML injection vulnerabilities
dotnet_diagnostic.CA3009.severity = error

# CA3010: Review code for XAML injection vulnerabilities
dotnet_diagnostic.CA3010.severity = error

# CA3011: Review code for DLL injection vulnerabilities
dotnet_diagnostic.CA3011.severity = error

# CA3012: Review code for regex injection vulnerabilities
dotnet_diagnostic.CA3012.severity = error

# CA3061: Do Not Add Schema By URL
dotnet_diagnostic.CA3061.severity = error

# CA3075: Insecure DTD processing in XML
dotnet_diagnostic.CA3075.severity = error

# CA3076: Insecure XSLT script processing
dotnet_diagnostic.CA3076.severity = error

# CA3077: Insecure Processing in API Design, XmlDocument and XmlTextReader
dotnet_diagnostic.CA3077.severity = error

# CA3147: Mark Verb Handlers With Validate Antiforgery Token
dotnet_diagnostic.CA3147.severity = error

# CA5350: Do Not Use Weak Cryptographic Algorithms
dotnet_diagnostic.CA5350.severity = error

# CA5351: Do Not Use Broken Cryptographic Algorithms
dotnet_diagnostic.CA5351.severity = error

# CA5358: Review cipher mode usage with cryptography experts
dotnet_diagnostic.CA5358.severity = error

# CA5359: Do Not Disable Certificate Validation
dotnet_diagnostic.CA5359.severity = error

# CA5360: Do Not Call Dangerous Methods In Deserialization
dotnet_diagnostic.CA5360.severity = error

# CA5361: Do Not Disable SChannel Use of Strong Crypto
dotnet_diagnostic.CA5361.severity = error

# CA5362: Potential reference cycle in deserialized object graph
dotnet_diagnostic.CA5362.severity = error

# CA5363: Do Not Disable Request Validation
dotnet_diagnostic.CA5363.severity = error

# CA5364: Do Not Use Deprecated Security Protocols
dotnet_diagnostic.CA5364.severity = error

# CA5365: Do Not Disable HTTP Header Checking
dotnet_diagnostic.CA5365.severity = error

# CA5366: Use XmlReader for 'DataSet.ReadXml()'
dotnet_diagnostic.CA5366.severity = error

# CA5367: Do Not Serialize Types With Pointer Fields
dotnet_diagnostic.CA5367.severity = error

# CA5368: Set ViewStateUserKey For Classes Derived From Page
dotnet_diagnostic.CA5368.severity = error

# CA5369: Use XmlReader for 'XmlSerializer.Deserialize()'
dotnet_diagnostic.CA5369.severity = error

# CA5370: Use XmlReader for XmlValidatingReader constructor
dotnet_diagnostic.CA5370.severity = error

# CA5371: Use XmlReader for 'XmlSchema.Read()'
dotnet_diagnostic.CA5371.severity = error

# CA5372: Use XmlReader for XPathDocument constructor
dotnet_diagnostic.CA5372.severity = error

# CA5373: Do not use obsolete key derivation function
dotnet_diagnostic.CA5373.severity = error

# CA5374: Do Not Use XslTransform
dotnet_diagnostic.CA5374.severity = error

# CA5375: Do Not Use Account Shared Access Signature
dotnet_diagnostic.CA5375.severity = error

# CA5376: Use SharedAccessProtocol HttpsOnly
dotnet_diagnostic.CA5376.severity = error

# CA5377: Use Container Level Access Policy
dotnet_diagnostic.CA5377.severity = error

# CA5378: Do not disable ServicePointManagerSecurityProtocols
dotnet_diagnostic.CA5378.severity = error

# CA5379: Ensure Key Derivation Function algorithm is sufficiently strong
dotnet_diagnostic.CA5379.severity = error

# CA5380: Do Not Add Certificates To Root Store
dotnet_diagnostic.CA5380.severity = error

# CA5381: Ensure Certificates Are Not Added To Root Store
dotnet_diagnostic.CA5381.severity = error

# CA5382: Use Secure Cookies In ASP.NET Core
dotnet_diagnostic.CA5382.severity = error

# CA5383: Ensure Use Secure Cookies In ASP.NET Core
dotnet_diagnostic.CA5383.severity = error

# CA5384: Do Not Use Digital Signature Algorithm (DSA)
dotnet_diagnostic.CA5384.severity = error

# CA5385: Use Rivest-Shamir-Adleman (RSA) Algorithm With Sufficient Key Size
dotnet_diagnostic.CA5385.severity = error

# CA5386: Avoid hardcoding SecurityProtocolType value
dotnet_diagnostic.CA5386.severity = error

# CA5387: Do Not Use Weak Key Derivation Function With Insufficient Iteration Count
dotnet_diagnostic.CA5387.severity = error

# CA5388: Ensure Sufficient Iteration Count When Using Weak Key Derivation Function
dotnet_diagnostic.CA5388.severity = error

# CA5389: Do Not Add Archive Item's Path To The Target File System Path
dotnet_diagnostic.CA5389.severity = error

# CA5390: Do not hard-code encryption key
dotnet_diagnostic.CA5390.severity = error

# CA5391: Use antiforgery tokens in ASP.NET Core MVC controllers
dotnet_diagnostic.CA5391.severity = error

# CA5392: Use DefaultDllImportSearchPaths attribute for P/Invokes
dotnet_diagnostic.CA5392.severity = error

# CA5393: Do not use unsafe DllImportSearchPath value
dotnet_diagnostic.CA5393.severity = error

# CA5394: Do not use insecure randomness
dotnet_diagnostic.CA5394.severity = error

# CA5395: Miss HttpVerb attribute for action methods
dotnet_diagnostic.CA5395.severity = error

# CA5396: Set HttpOnly to true for HttpCookie
dotnet_diagnostic.CA5396.severity = error

# CA5397: Do not use deprecated SslProtocols values
dotnet_diagnostic.CA5397.severity = error

# CA5398: Avoid hardcoded SslProtocols values
dotnet_diagnostic.CA5398.severity = error

# CA5399: HttpClients should enable certificate revocation list checks
dotnet_diagnostic.CA5399.severity = error

# CA5400: Ensure HttpClient certificate revocation list check is not disabled
dotnet_diagnostic.CA5400.severity = error

# CA5401: Do not use CreateEncryptor with non-default IV
dotnet_diagnostic.CA5401.severity = error

# CA5402: Use CreateEncryptor with the default IV
dotnet_diagnostic.CA5402.severity = error

# CA5403: Do not hard-code certificate
dotnet_diagnostic.CA5403.severity = error

# CA5404: Do not disable token validation checks
dotnet_diagnostic.CA5404.severity = error

# CA5405: Do not always skip token validation in delegates
dotnet_diagnostic.CA5405.severity = error
