Enabling CAT.Net to work with Visual Studio 2010

Microsoft recommends using their CAT.Net Security Code Analysis tool as part of the SDL (Software Development Process). Unfortunately, latest released version is CAT.Net v1 CTP. There was CAT.Net 2.0 Beta but it disappeared even from Microsoft's sites due to some incompatibility or missing libraries (where??).

What is left of CAT.Net 2.0 for the community is this video on Channel 9.

CAT.Net 1.0 doesn't work with Visual Studio 2010 unless you manually alter (hack) its config file a little. See below.

1. Close Visual Studio 2010 IDE
2. Find this file: %APPDATA%\Microsoft\MSEnvShared\Addins\Microsoft.ACESec.CATNet.AddIn
3. Edit it in your preferred text editor, adding the line <Version>10.0</Version> right after <Version>9.0</Version>
4. Open IDE again. Go to Tools->CAT.Net Code Analysis

Hope it helps.

P.S.: there is some information on how to use CAT.Net and OWASP O2 Platform along with Roslyn compiler outside of the IDE. It is all on Dinis Cruz blog.

Update 1: Found a blog post from April 2011 which says this:

At this point in time we are accepting recommendations, suggestions and new features.  However, we do not have any planned updates for the remainder of the fiscal year.  We are going through our FY12 planning and CAT.NET is on the list of requests for next year.  We will know by the end of June if funding has be approved.  At that time we’ll notify people of the budgetary decisions. 

Visual Studio, increase maximum number of code analysis warnings in IDE

When running Visual Studio Code Analysis on a project, you may encounter the following error:

   CA0503: Additional warnings cannot be displayed.

By default, a maximum of 200 warnings are displayed in the Error List.

This can be increased by modifying the following registry value(s):

HKEY_CURRENT_USER\Software\Microsoft\VisualStudio\10.0_Config\Setup\EDev\CodeAnalysisErrorListViolationLimit

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\10.0\Setup\EDev\CodeAnalysisErrorListViolationLimit
HKEY_USERS\.DEFAULT\Software\Microsoft\VisualStudio\10.0_Config\Setup\EDev\CodeAnalysisErrorListViolationLimit

for older versions it may be here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\8.0\Setup\EDev\CodeAnalysisErrorListViolationLimit

Microsoft says that 200 is the magic number based on minimum recommended system configuration.

Alternative way is to do it in IDE: 

http://msdn.microsoft.com/en-us/library/aa980440(v=VS.100).aspx

You can configure the maximum number of errors and warnings that appear for your database project. By default, the maximum number is 200 errors and warnings.

To configure the maximum number of errors and warnings

1. On the Tools menu, click Options.
2. In the tree, expand the Database Tools node, and click Database Errors and Warnings.
3. In Maximum errors and warnings to display, type the maximum number of errors and warnings that you want to appear for your database projects.
4. Click OK.

Direct log4net output to Visual Studio IDE output window

You can tell log4net to write its messages not only to files or DB but also to an Output window in Visual Studio. Very handy for debugging when you didn't want to switch between windows or query your database.
It appears that you need to tell log4net to use the Trace appender, which, according to the documentation, writes the events using the System.Diagnostics.Trace.Write(string,string) method.

Here is how to change the log4net section in app.config or web.config (if you keep yor log4net configuration in this file) - note this (LOGGER) in the pattern, it is there to distinguish the output from log4net from any other messages in Output window:

<log4net>
 
	<root>
		<level value="DEBUG" />
		<appender-ref ref="MyTraceAppender"/>
	</root>
	<appender name="MyTraceAppender" type="log4net.Appender.TraceAppender">
		<layout type="log4net.Layout.PatternLayout">
			<conversionPattern value="(LOGGER) %-5p %d [%t] %c %m%n"/>
		</layout>
	</appender>
 
</log4net>