Programmatically inspect .NET code

Question

I am looking for a way to programmatically inspect a .NET (C#, VB.NET,..) source code to perform static code analysis.

I'd like to perform queries on the code such as: - list classes whose name begin by x - list all the subclasses of x - list methods which instanciate an object of class x - determine if method x contains a variable named y - list methods calling the method y - ...

What I am looking for is an API or something else allowing me to write programs able to examine a source code.

Answer 1

You can use System.Reflection, that should do the trick nicely for some of the things you want. As far as getting into the IL itself, check out Mono's Cecil.

Answer 2

Why not use FxCop for static code analysis?

Answer 3

NDepend gives a SQL-like query language for querying .NET code structure.

Answer 4

See the DMS Software Reengineering Toolkit.

DMS provides parsers that automatically build ASTs for many languages (C, C++, Java, C# [1.2, 2.0, 3.0 and 4.0], COBOL, ECMAScript, PHP, Verilog, ..) as well as symbol tables and control and data flow analysis for several of these.

DMS's pattern language can be used to match surface-syntax patterns, and combined with procedural analysis to ties code elements together with symbol table entries and various data flow relations. It has been used to implement a wide variety of program analysis tools, and is designed to be a foundation for you to build you own tool, without wasting a vast amount of time building basic program analysis infrastructure.

Answer 5

What about using the code model in Reflector? With the code model view add-in you should be able to get the idea of how to interrogate the structure of the code.

Answer 6

What about StyleCop? http://code.msdn.microsoft.com/sourceanalysis. But it doesn't support APIs.

Answer 7

To complete the stusmith's answer, NDepend comes with Code Query language (CQL). CQL is dedicated to write code quality rules that can be verified live in Visual Studio, or that can be verified during build process and reported in a HTML report. Here are a few samples of CQL rules (designed to be highly customizable):

Code refactored recently should be 100% covered by test:

WARN IF Count > 0 IN SELECT METHODS WHERE CodeWasChanged AND PercentageCoverage < 100

Complex methods should be commented:

WARN IF Count > 0 IN SELECT METHODS WHERE CyclomaticComplexity > 15 AND PercentageComment < 10

I don’t want that my User Interface layer to depend directly on the DataBase layer:

WARN IF Count > 0 IN SELECT NAMESPACES WHERE IsDirectlyUsing "DataLayer" AND NameIs "UILayer"

Static fields should not be named m_XXX (Custom naming conventions):

WARN IF Count > 0 IN SELECT FIELDS WHERE NameLike "^m_" AND IsStatic

Methods out of MyAssembly and MyAssembly2 should not have more than 30 lines of code:

WARN IF Count > 0 IN SELECT METHODS OUT OF ASSEMBLIES "MyAssembly1", "MyAssembly2" WHERE NbLinesOfCode > 30

Public methods should not be removed to avoid API breaking changes:

WARN IF Count > 0 IN SELECT METHODS WHERE IsPublic AND IsInOlderBuild AND WasRemoved

Types tagged with the attribute MyNamespace.FullCoveredAttribute must be thoroughly covered by tests:

WARN IF Count > 0 IN SELECT TYPES WHERE HasAttribute "MyNamespace.FullCoveredAttribute" AND PercentageCoverage < 100