> ## Documentation Index > Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt > Use this file to discover all available pages before exploring further. # Vbnet

A cast is an explicit conversion, which is a way to tell the compiler the intent to convert from one type to another.

In Visual Basic, there are two explicit conversion operators:

```vbnet Bad theme={null} Public Sub Method(Value As Object) Dim i As Integer i = DirectCast(Value, Integer) ' Direct casting from object holding an integer type to Integer i = CType(Value, Integer) ' Conversion from the underlying type to Integer End Sub ``` ```vbnet Fix theme={null} Public Interface IMyInterface End Interface Public Class Implementer Implements IMyInterface End Class Public Class AnotherClass End Class Module Program Sub Main() Dim Another As New AnotherClass Dim x As IMyInterface = DirectCast(Another, IMyInterface) ' Noncompliant: InvalidCastException is being thrown End Sub End Module ```

Functions can return values using two different syntaxes. The modern, and correct, way to do it is to use a \`Return statement. The VB6 way, i.e. old way, is to assign a return value to the function’s name .

The VB6 syntax is obsolete as it was introduced to simplify migration from VB6 projects. The compiler will create a local variable which is implicitly returned when execution exits the function’s scope.

Return\` statement should be used instead as they are easier to read and understand.

```vbnet Bad theme={null} Public Function FunctionName() As Integer FunctionName = 42 ' Noncompliant End Function Public Function FunctionNameFromVariable() As Integer Dim Value As Integer = 42 FunctionNameFromVariable = Value ' Noncompliant End Function ``` ```vbnet Fix theme={null} Public Function FunctionName() As Integer Return 42 End Function Public Function FunctionNameFromVariable() As Integer Dim Value As Integer = 42 Return Value End Function ```

There’s no point in creating an array solely for the purpose of passing it to a ParamArray parameter. Simply pass the elements directly. They will be consolidated into an array automatically.

```vbnet Bad theme={null} Class SurroundingClass Public Sub Base() Method(New String() { "s1", "s2" }) ' Noncompliant: unnecessary Method(New String(12) {}) ' Compliant End Sub Public Sub Method(ParamArray args As String()) ' Do something End Sub End Class ``` ```vbnet Fix theme={null} Class SurroundingClass Public Sub Base() Method("s1", "s2") Method(New String(12) {}) End Sub Public Sub Method(ParamArray args As String()) ' Do something End Sub End Class ```

Short-circuit evaluation is an evaluation strategy for Boolean operators, that doesn’t evaluate the second argument of the operator if it is not needed to determine the result of the operation.

VB.NET provides logical operators that implement short-circuiting evaluations AndAlso and OrElse, as well as the non-short-circuiting versions And and Or. Unlike short-circuiting operators, the non-short-circuiting operators evaluate both operands and afterward perform the logical operation.

For example False AndAlso FunctionCall always results in False even when the FunctionCall invocation would raise an exception. In contrast, False And FunctionCall also evaluates FunctionCall, and results in an exception if FunctionCall raises an exception.

Similarly, True OrElse FunctionCall always results in True, no matter what the return value of FunctionCall would be.

The use of non-short-circuit logic in a boolean context is likely a mistake, one that could cause serious program errors as conditions are evaluated under the wrong circumstances.

```vbnet Bad theme={null} If GetTrue() Or GetFalse() Then ' Noncompliant: both sides evaluated End If ``` ```vbnet Fix theme={null} If GetTrue() OrElse GetFalse() Then ' Compliant: short-circuit logic used End If ```

Complex boolean expressions are hard to read and so to maintain.

```vbnet Bad theme={null} If ((condition1 AndAlso condition2) OrElse (condition3 AndAlso condition4)) AndAlso condition5) Then 'Noncompliant ... End If ``` ```vbnet Fix theme={null} If ((MyFirstCondition() OrElse MySecondCondition()) AndAlso MyLastCondition()) Then ... End If ```

In most cases, indexed properties should be named Item for consistency. Exceptions are when there exists a name which is obviously better, for example System.String.Chars(System.Int32).

```vbnet Bad theme={null} Module Module1 Dim array = {"apple", "banana", "orange", "strawberry"} ReadOnly Property Foo(ByVal index As Integer) ' Noncompliant Get Return array(index) End Get End Property End Module ``` ```vbnet Fix theme={null} Module Module1 Dim array = {"apple", "banana", "orange", "strawberry"} ReadOnly Property Item(ByVal index As Integer) Get Return array(index) End Get End Property End Module ```

A loop statement with at most one iteration is equivalent to an If statement; the following block is executed only once.

If the initial intention was to conditionally execute the block only once, an If statement should be used instead. If that was not the initial intention, the block of the loop should be fixed so the block is executed multiple times.

A loop statement with at most one iteration can happen when a statement unconditionally transfers control, such as a jump statement or a throw statement, is misplaced inside the loop block.

This rule raises when the following statements are misplaced:

```vbnet Bad theme={null} Public Function Method(items As IEnumerable(Of Object)) As Object For i As Integer = 0 To 9 Console.WriteLine(i) Exit For ' Noncompliant: loop only executes once Next For Each item As Object In items Return item ' Noncompliant: loop only executes once Next Return Nothing End Function ``` ```vbnet Fix theme={null} Public Function Method(items As IEnumerable(Of Object)) As Object For i As Integer = 0 To 9 Console.WriteLine(i) Next Dim item = items.FirstOrDefault() If item IsNot Nothing Then Return item End If Return Nothing End Function ```

Using the With statement for a series of calls to the same object makes the code more readable.

```vbnet Bad theme={null} Module Module1 Dim product = New With {.Name = "paperclips", .RetailPrice = 1.2, .WholesalePrice = 0.6, .A = 0, .B = 0, .C = 0} Sub Main() product.Name = "" ' Noncompliant product.RetailPrice = 0 product.WholesalePrice = 0 product.A = 0 product.B = 0 product.C = 0 End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Dim product = New With {.Name = "paperclips", .RetailPrice = 1.2, .WholesalePrice = 0.6, .A = 0, .B = 0, .C = 0} Sub Main() With product .Name = "" .RetailPrice = 0 .WholesalePrice = 0 .A = 0 .B = 0 .C = 0 End With End Sub End Module ```

When an assembly uses Windows Forms (classes and interfaces from the \`System.Windows.Forms namespace) its entry point should be marked with the STAThreadAttribute to indicate that the threading model should be "Single-Threaded Apartment" (STA) which is the only one supported by Windows Forms.

This rule raises an issue when the entry point (Shared Sub Main\` method) of an assembly using Windows Forms is not marked as STA.

```vbnet Bad theme={null} Imports System.Windows.Forms Public Class Foo Shared Sub Main() Dim winForm As Form = New Form Application.Run(winForm) End Sub End Class ``` ```vbnet Fix theme={null} Imports System.Windows.Forms Public Class Foo Shared Sub Main() Dim winForm As Form = New Form Application.Run(winForm) End Sub End Class ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that all non-private Const field names comply with the provided regular expression.

The default configuration is the one recommended by Microsoft:

  • Pascal casing, starting with an upper case character, e.g. BackColor

  • Short abbreviations of 2 letters can be capitalized, e.g. GetID

  • Longer abbreviations need to be lower cased, e.g. GetHtml

```vbnet Bad theme={null} Module Module1 Public Const foo = 0 ' Noncompliant End Module ``` ```vbnet Fix theme={null} Module Module1 Public Const Foo = 0 ' Compliant End Module ```

The DebuggerDisplayAttribute is used to determine how an object is displayed in the debugger window.

The DebuggerDisplayAttribute constructor takes a single mandatory argument: the string to be displayed in the value column for instances of the type. Any text within curly braces is evaluated as the name of a field or property, or any complex expression containing method calls and operators.

Naming a non-existent member between curly braces will result in a BC30451 error in the debug window when debugging objects. Although there is no impact on the production code, providing a wrong value can lead to difficulties when debugging the application.

This rule raises an issue when text specified between curly braces refers to members that don’t exist in the current context.

```vbnet Bad theme={null} ' Noncompliant - Name doesn't exist in this context Public Class Person Public Property FullName As String End Class ``` ```vbnet Fix theme={null} Public Class Person Public Property FullName As String End Class ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that all even names match a provided regular expression.

The default configuration is the one recommended by Microsoft:

  • Pascal casing, starting with an upper case character, e.g. BackColor

  • Short abbreviations of 2 letters can be capitalized, e.g. GetID

  • Longer abbreviations need to be lower cased, e.g. GetHtml

```vbnet Bad theme={null} Class Foo Event fooEvent() ' Noncompliant End Class ``` ```vbnet Fix theme={null} Class Foo Event FooEvent() ' Compliant End Class ```

Because parameter names could be changed during refactoring, they should not be spelled out literally in strings. Instead, use \`NameOf(), and the string that’s output will always be correct.

This rule raises an issue when any string in the Throw\` statement is an exact match for the name of one of the method parameters.

```vbnet Bad theme={null} Public Sub DoSomething(param As Integer, secondParam As String) If (param < 0) Throw New Exception("param") ' Noncompliant End If If secondParam is Nothing Throw New Exception("secondParam should be valid") ' Noncompliant End If End Sub ``` ```vbnet Fix theme={null} Public Sub DoSomething(param As Integer, secondParam As String) If (param < 0) Throw New Exception(NameOf(param)) End If If secondParam is Nothing Throw New Exception($"{NameOf(secondParam)} should be valid") End If End Sub ```

Using Thread.Sleep in a test might introduce unpredictable and inconsistent results depending on the environment. Furthermore, it will block the thread, which means the system resources are not being fully used.

```vbnet Bad theme={null} Public Sub SomeTest() Threading.Thread.Sleep(500) ' Noncompliant ' assertions... End Sub ``` ```vbnet Fix theme={null} Public Async Function SomeTest() As Task Await Task.Delay(500) ' assertions... End Function ```

Creating a new Exception without actually throwing it is useless and is probably due to a mistake.

```vbnet Bad theme={null} If x < 0 Then Dim ex = New ArgumentException("x must be nonnegative") End If ``` ```vbnet Fix theme={null} If x < 0 Then Throw New ArgumentException("x must be nonnegative") End If ```

If you’re using a Structure, it is likely because you’re interested in performance. But by failing to implement IEquatable\ you’re loosing performance when comparisons are made because without IEquatable\, boxing and reflection are used to make comparisons.

```vbnet Bad theme={null} Structure MyStruct ' Noncompliant Public Property Value As Integer End Structure ``` ```vbnet Fix theme={null} Structure MyStruct Implements IEquatable(Of MyStruct) Public Property Value As Integer Public Overloads Function Equals(other As MyStruct) As Boolean Implements IEquatable(Of MyStruct).Equals ' ... End Function End Structure ```

Other than \`Exit Select, using an Exit statement is never a good idea.

Exit Do, Exit For, Exit Try, and Exit While will all result in unstructured control flow, i.e. spaghetti code.

Exit Function, Exit Property, and Exit Sub are all poor, less-readable substitutes for a simple return, and if used with code that should return a value (Exit Function and in some cases Exit Property) they could result in a NullReferenceException.

This rule raises an issue for all uses of Exit except Exit Select and Exit Do\` statements in loops without condition.

```vbnet Bad theme={null} Public Class Sample Dim condition As Boolean Public Sub MySub() If condition Then Exit Sub ' Noncompliant End If For index = 1 To 10 If index = 5 Then Exit For ' Noncompliant End If ' ... Next End Sub Function MyFunction() As Object ' ... MyFunction = 42 Exit Function ' Noncompliant End Function End Class ``` ```vbnet Fix theme={null} Public Class Sample Dim condition As Boolean Public Sub MySub() If condition Then Return End If For index = 1 To 4 ' ... Next End Sub Function MyFunction() As Object ' ... Return 42 End Function End Class ```

Unsigned integers have different arithmetic operators than signed ones - operators that few developers understand. Therefore, signed types should be preferred where possible.

```vbnet Bad theme={null} Module Module1 Sub Main() Dim foo1 As UShort ' Noncompliant Dim foo2 As UInteger ' Noncompliant Dim foo3 As ULong ' Noncompliant End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() Dim foo1 As Short Dim foo2 As Integer Dim foo3 As Long End Sub End Module ```

Certain bitwise operations are not needed and should not be performed because their results are predictable.

Specifically, using And -1 with any value always results in the original value.

That is because the binary representation of -1 on a numeric data type supporting negative numbers, such as Integer or Long, is based on two’s complement and made of all 1s: \&B111…​111.

Performing And between a value and \&B111…​111 means applying the And operator to each bit of the value and the bit 1, resulting in a value equal to the provided one, bit by bit.

```vbnet Bad theme={null} anyValue And -1 ' Noncompliant anyValue ' Compliant ``` ```vbnet Fix theme={null} anyValue Or 0 ' Noncompliant anyValue ' Compliant ```

Calling ToString() on an object should always return a string. Thus, overriding the ToString method should never return Nothing because it breaks the method’s implicit contract, and as a result the consumer’s expectations.

```vbnet Bad theme={null} Public Overrides Function ToString() As String Return Nothing ' Noncompliant End Function ``` ```vbnet Fix theme={null} Public Overrides Function ToString() As String Return "" End Function ```

Shared naming conventions allow teams to collaborate efficiently. This rule checks that all non-private Shared ReadOnly fields names match a provided regular expression.

The default configuration is:

  • Pascal casing, starting with an upper case character, e.g. BackColor

  • Short abbreviations of 2 letters can be capitalized, e.g. GetID

  • Longer abbreviations need to be lower cased, e.g. GetHtml

```vbnet Bad theme={null} Class Foo Public Shared ReadOnly foo As Integer ' Noncompliant End Class ``` ```vbnet Fix theme={null} Class Foo Public Shared ReadOnly Foo As Integer ' Compliant End Class ```

Numbers can be shifted with the \<\[/code> and \> operators, but the right operand of the operation needs to be an int or a type that has an implicit conversion to int. However, when the left operand is an object, the compiler’s type checking is turned off, therfore you can pass anything to the right of a shift operator and have it compile. If the argument can’t be implicitly converted to int at runtime, a RuntimeBinderException will be raised.

```vbnet Bad theme={null} Dim o As Object = 5 Dim x As Integer = 5 x = o >> 5 ' Noncompliant x = x << o ' Noncompliant ``` ```vbnet Fix theme={null} x = Nothing >> 5 x = 5 << Nothing ```

Using the same value on either side of a binary operator is almost always a mistake. In the case of logical operators, it is either a copy/paste error and therefore a bug, or it is simply wasted code, and should be simplified. In the case of most binary mathematical operators, having the same value on both sides of an operator yields predictable results, and should be simplified.

This rule ignores \*, +, &, \<\<, and >>.

```vbnet Bad theme={null} If (a = a) Then doZ() End If If a = b OrElse a = b Then doW() End If Dim j = 5 / 5 j = 5 \ 5 j = 5 Mod 5 Dim k = 5 - 5 Dim i = 42 i /= i i -= i ``` ```vbnet Fix theme={null} ```

Array literals are more compact than array creation expressions.

```vbnet Bad theme={null} Module Module1 Sub Main() Dim foo = New String() {"a", "b", "c"} ' Noncompliant End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() Dim foo = {"a", "b", "c"} ' Compliant End Sub End Module ```

Visual Basic .NET offers a non-short-circuit conditional function, \`IIf(), which returns either its second or third parameter based on the expression in the first parameter. Using it is slower than using If() because each parameter is unconditionally evaluated. Further, its use can lead to runtime exceptions because IIf always evaluates all three of its arguments.

The newer version, If()\`, should be used instead because it short-circuits the evaluation of its parameters.

```vbnet Bad theme={null} Public Class Foo Public Sub Bar() Dim var As Object = IIf(Date.Now.Year = 1999, "Lets party!", "Lets party like it is 1999!") ' Noncompliant End Sub End Class ``` ```vbnet Fix theme={null} Public Class Foo Public Sub Bar() Dim var As String = If(Date.Now.Year = 1999, "Lets party!", "Lets party like it is 1999!") End Sub End Class ```

A chain of If/ElseIf statements is evaluated from top to bottom. At most, only one branch will be executed: the first statement with a condition that evaluates to True. Therefore, duplicating a condition leads to unreachable code inside the duplicated condition block. Usually, this is due to a copy/paste error.

The result of such duplication can lead to unreachable code or even to unexpected behavior.

```vbnet Bad theme={null} If param = 1 Then OpenWindow() ElseIf param = 2 Then CloseWindow() ElseIf param = 1 Then ' Noncompliant: condition has already been checked MoveWindowToTheBackground() ' unreachable code End If ``` ```vbnet Fix theme={null} If param = 1 Then OpenWindow() ElseIf param = 2 Then CloseWindow() ElseIf param = 3 Then MoveWindowToTheBackground() End If ```

Using operator pairs (=+ or =-) that look like reversed single operators (+= or -=) is confusing. They compile and run but do not produce the same result as their mirrored counterpart.

```vbnet Bad theme={null} Dim target As Integer = -5 Dim num As Integer = 3 target =- num ' Noncompliant: target = -3. Is that the intended behavior? target =+ num ' Noncompliant: target = 3 ``` ```vbnet Fix theme={null} Dim num As Integer = 3 target -= num ' target = -8 ```

Sharing some naming conventions is a key point to make it possible for a team to efficiently collaborate.

This rule allows to check that all parameter names match a provided regular expression.

The default configuration is the one recommended by Microsoft:

  • Camel casing, starting with a lower case character, e.g. backColor

  • Short abbreviations of 2 letters can be capitalized only when not at the beginning, e.g. id, productID

  • Longer abbreviations need to be lower cased, e.g. html

```vbnet Bad theme={null} Module Module1 Sub GetSomething(ByVal ID As Integer) ' Noncompliant End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub GetSomething(ByVal id As Integer) ' Compliant End Sub End Module ```

The size of a collection and the length of an array are always greater than or equal to zero. Testing it doesn’t make sense, since the result is always true.

```vbnet Bad theme={null} If Collection.Count >= 0 Then ... 'Noncompliant always true If array.Length >= 0 Then ... 'Noncompliant always true ``` ```vbnet Fix theme={null} If Enumerable.Count < 0 Then ... 'Noncompliant always false Dim result As Boolean = Array.Length >= 0 'Noncompliant always true ```

For the sake of backward compatibility, Visual Basic .NET continues to offer a set of functions that convert from Object to different primitive types: CChar, CStr, CBool, CDate, CSng, CDbl, CDec, CByte, CSByte, CShort, CUShort, CInt, CUInt, CLng, CULng. However, using these functions is misleading, because it suggests a cast. It is better to cast explicitly using CType(), or use Convert.To() when the value should be converted.

```vbnet Bad theme={null} Public Class Foo Public Sub Bar(value as Object) Dim stringValue As String = CStr(value) End Sub End Class ``` ```vbnet Fix theme={null} Public Class Foo Public Sub Bar(value as Object) Dim stringValue As String = CType(value, String) End Sub End Class ```

While it is technically correct to assign to parameters from within method bodies, doing so before the parameter value is read is likely a bug. Instead, initial values of parameters should be, if not treated as readonly then at least read before reassignment.

```vbnet Bad theme={null} Module Module1 Sub Foo(ByVal a As Integer) a = 42 ' Noncompliant End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Foo(ByVal a As Integer) Dim tmp = a tmp = 42 End Sub End Module ```

This rule applies whenever an \`If statement is followed by one or more ElseIf statements; the final ElseIf should be followed by an Else statement.

The requirement for a final Else statement is defensive programming.

The Else statement should either take appropriate action or contain a suitable comment as to why no action is taken. This is consistent with the requirement to have a final Case Else clause in a Select Case\` statement.

```vbnet Bad theme={null} If x = 0 Then DoSomething() ElseIf x = 1 Then DoSomethingElse() End If ``` ```vbnet Fix theme={null} If x = 0 Then DoSomething() ElseIf x = 1 Then DoSomethingElse() Else Throw New ArgumentException("...") End If ```

Since Visual Studio 2010 SP1, the ByVal parameter modifier is implicitly applied, and therefore not required anymore. Removing it from your source code will improve readability.

```vbnet Bad theme={null} Sub Foo(ByVal bar As String) ' ... End Sub ``` ```vbnet Fix theme={null} Sub Foo(bar As String) ' ... End Sub ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that all even handler names match a provided regular expression.

The default configuration is:

  • Either in Pascal case, i.e. starting with an upper case letter, e.g. OnMyButtonClicked

  • Or, a subject, in Pascal or camel case, followed by an underscore followed by an event name, in Pascal case, e.g. btn1\_Clicked

Event handlers with a handles clause and two-parameter methods with EventArgs second parameter are covered by this rule.

```vbnet Bad theme={null} Module Module1 Sub subject__SomeEvent() Handles X.SomeEvent ' Noncompliant - two underscores End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub subject_SomeEvent() Handles X.SomeEvent ' Compliant End Sub End Module ```

Consistently using the \`& operator for string concatenation make the developer intentions clear.

&, unlike +, will convert its operands to strings and perform an actual concatenation.

+\` on the other hand can be an addition, or a concatenation, depending on the operand types.

```vbnet Bad theme={null} Module Module1 Sub Main() Console.WriteLine("1" + 2) ' Noncompliant - will display "3" End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() Console.WriteLine(1 & 2) ' Compliant - will display "12" Console.WriteLine(1 + 2) ' Compliant - but will display "3" Console.WriteLine("1" & 2) ' Compliant - will display "12" End Sub End Module ```

Shared naming conventions allow teams to collaborate efficiently. This rule checks that all enum names match a provided regular expression.

The default configuration is the one recommended by Microsoft:

  • Pascal casing, starting with an upper case character, e.g. BackColor

  • Short abbreviations of 2 letters can be capitalized, e.g. GetID

  • Longer abbreviations need to be lower case, e.g. GetHtml

  • If the enum is marked as \[Flags] then its name should be plural (e.g. MyOptions), otherwise, names should be singular (e.g. MyOption)

```vbnet Bad theme={null} Public Enum foo ' Noncompliant FooValue = 0 End Enum ``` ```vbnet Fix theme={null} Public Enum Option ' Noncompliant None = 0, Option1 = 1, Option2 = 2 End Enum ```

Creating an extension method that extends Object is not recommended because it makes the method available on every type. Extensions should be applied at the most specialized level possible, and that is very unlikely to be Object.

```vbnet Bad theme={null} Imports System.Runtime.CompilerServices Module MyExtensions Sub SomeExtension(obj As Object) ' Noncompliant ' ... End Sub End Module ``` ```vbnet Fix theme={null} ```

An enumeration can be decorated with the FlagsAttribute to indicate that it can be used as a bit field: a set of flags, that can be independently set and reset.

For example, the following definition of the day of the week:

```vbnet Bad theme={null} Enum Days Monday = 1 ' 0b00000001 Tuesday = 2 ' 0b00000010 Wednesday = 4 ' 0b00000100 Thursday = 8 ' 0b00001000 Friday = 16 ' 0b00010000 Saturday = 32 ' 0b00100000 Sunday = 64 ' 0b01000000 End Enum ``` ```vbnet Fix theme={null} Enum Days ' ... None = 0 ' 0b00000000 Weekdays = Monday Or Tuesday Or Wednesday Or Thursday Or Friday ' 0b00011111 Weekend = Saturday Or Sunday ' 0b01100000 All = Weekdays Or Weekend ' 0b01111111 End Enum ```

The repetition of the Not operator is usually a typo. The second operator invalidates the first one:

```vbnet Bad theme={null} Dim b As Boolean = False Dim c As Boolean = Not Not b 'Noncompliant: equivalent to "b" ``` ```vbnet Fix theme={null} ```

StringBuilder instances that never build a string clutter the code and worse are a drag on performance. Either they should be removed, or the missing ToString() call should be added.

```vbnet Bad theme={null} Public Sub DoSomething(ByVal strings As List(Of String)) Dim sb As StringBuilder = New StringBuilder() ' Noncompliant sb.Append("Got: ") For Each str As String In strings sb.Append(str).Append(", ") Next End Sub ``` ```vbnet Fix theme={null} Public Sub DoSomething(ByVal strings As List(Of String)) For Each str As String In strings Next End Sub ```

To improve the code readability, the explicit line continuation character, \_, should not be used. Instead, it is better to break lines after an operator.

```vbnet Bad theme={null} Module Module1 Sub Main() ' Noncompliant Console.WriteLine("Hello" _ & "world") End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() Console.WriteLine("Hello" & "world") End Sub End Module ```

Nested control flow statements If, Select, For, For Each, While, Do, and Try are often key ingredients in creating what’s known as "Spaghetti code". This code smell can make your program difficult to understand and maintain.

When numerous control structures are placed inside one another, the code becomes a tangled, complex web. This significantly reduces the code’s readability and maintainability, and it also complicates the testing process.

```vbnet Bad theme={null} If condition1 ' Compliant - depth = 1 ' ... If condition2 ' Compliant - depth = 2 ' ... For i = 0 to 10 ' Compliant - depth = 3, not exceeding the limit ' ... If condition4 ' Noncompliant - depth = 4 If condition5 ' Depth = 5, exceeding the limit, but issues are only reported on depth = 4 ' ... End If Return End If Next End If End If ``` ```vbnet Fix theme={null} ```

Recursion is a technique used to define a problem in terms of the problem itself, usually in terms of a simpler version of the problem itself.

For example, the implementation of the generator for the n-th value of the Fibonacci sequence comes naturally from its mathematical definition, when recursion is used:

```vbnet Bad theme={null} Function NthFibonacciNumber(ByVal n As Integer) As Integer If n <= 1 Then Return 1 Else Return NthFibonacciNumber(n - 1) + NthFibonacciNumber(n - 2) End If End Function ``` ```vbnet Fix theme={null} Function NthFibonacciNumber(ByVal n As Integer) As Integer Dim previous As Integer = 0 Dim last As Integer = 1 For i = 0 To n - 1 Dim temp = previous previous = last last = last + temp Next Return last End Function ```

A Catch clause that only rethrows the caught exception has the same effect as omitting the Catch altogether and letting it bubble up automatically.

```vbnet Bad theme={null} Dim s As String = "" Try s = File.ReadAllText(fileName) Catch e As Exception Throw End Try ``` ```vbnet Fix theme={null} Dim s As String = File.ReadAllText(fileName) ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that all \`Private Shared ReadOnly field names comply with the provided regular expression.

The default configuration is:

  • Optionally, can start with an underscore character or "s\_", e.g. \_foo, s\_foo\`

  • Camel casing, starting with a lower case character, e.g. backColor

  • Short abbreviations of 2 letters can be capitalized only when not at the beginning, e.g. "id" in productID

  • Longer abbreviations need to be lower cased, e.g. html

```vbnet Bad theme={null} Class Foo Private Shared ReadOnly Foo As Integer ' Noncompliant End Class ``` ```vbnet Fix theme={null} Class Foo Private Shared ReadOnly foo As Integer ' Compliant End Class ```

Nullable value types can hold either a value or Nothing.

The value stored in the nullable type can be accessed with the Value property or by casting it to the underlying type. Still, both operations throw an InvalidOperationException when the value is Nothing. A nullable type should always be tested before accessing the value to avoid raising exceptions.

```vbnet Bad theme={null} Sub Sample(condition As Boolean) Dim nullableValue As Integer? = If(condition, 42, Nothing) Console.WriteLine(nullableValue.Value) ' Noncompliant: InvalidOperationException is raised Dim nullableCast As Integer? = If(condition, 42, Nothing) Console.WriteLine(CType(nullableCast, Integer)) ' Noncompliant: InvalidOperationException is raised End Sub ``` ```vbnet Fix theme={null} Sub Sample(condition As Boolean) Dim nullableValue As Integer? = If(condition, 42, Nothing) If nullableValue.HasValue Then Console.WriteLine(nullableValue.Value) End If Dim nullableCast As Integer? = If(condition, 42, Nothing) If nullableCast.HasValue Then Console.WriteLine(CType(nullableCast, Integer)) End If End Sub ```

Throwing general exceptions such as \`Exception, SystemException and ApplicationException will have a negative impact on any code trying to catch these exceptions.

From a consumer perspective, it is generally a best practice to only catch exceptions you intend to handle. Other exceptions should ideally not be caught and let to propagate up the stack trace so that they can be dealt with appropriately. When a generic exception is thrown, it forces consumers to catch exceptions they do not intend to handle, which they then have to re-throw.

Besides, when working with a generic type of exception, the only way to distinguish between multiple exceptions is to check their message, which is error-prone and difficult to maintain. Legitimate exceptions may be unintentionally silenced and errors may be hidden.

For instance, if an exception such as StackOverflowException is caught and not re-thrown, it may prevent the program from terminating gracefully.

When throwing an exception, it is therefore recommended to throw the most specific exception possible so that it can be handled intentionally by consumers.

Additionally, some reserved exceptions should not be thrown manually. Exceptions such as IndexOutOfRangeException, NullReferenceException, OutOfMemoryException or ExecutionEngineException\` will be thrown automatically by the runtime when the corresponding error occurs. Many of them indicate serious errors, which the application may not be able to recover from. It is therefore recommended to avoid throwing them as well as using them as base classes.

```vbnet Bad theme={null} Public Sub DoSomething(obj As Object) If obj Is Nothing Then ' Noncompliant Throw New NullReferenceException("obj") ' Noncompliant: This reserved exception should not be thrown manually End If ' ... End Sub ``` ```vbnet Fix theme={null} Public Sub DoSomething(obj As Object) If obj Is Nothing Then Throw New ArgumentNullException("obj") ' Compliant: this is a specific and non-reserved exception type End If ' ... End Sub ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that property names match a provided regular expression.

The default configuration is the one recommended by Microsoft:

  • Pascal casing, starting with an upper case character, e.g. BackColor

  • Short abbreviations of 2 letters can be capitalized, e.g. GetID

  • Longer abbreviations need to be lower cased, e.g. GetHtml

```vbnet Bad theme={null} Module Module1 Public Property foo As Integer ' Noncompliant End Module ``` ```vbnet Fix theme={null} Module Module1 Public Property Foo As Integer ' Compliant End Module ```

Properties provide a way to enforce encapsulation by providing property procedures that give controlled access to Private fields. However, in classes with multiple fields, it is not unusual that copy-and-paste is used to quickly create the needed properties, which can result in the wrong field being accessed by the property procedures.

```vbnet Bad theme={null} Class C Private _x As Integer Private _Y As Integer Public ReadOnly Property Y As Integer Get Return _x ' Noncompliant: The returned field should be '_y' End Get End Property End Class ``` ```vbnet Fix theme={null} Public Class Sample Private _x As Integer Private _y As Integer Public Property Y As Integer Get Return _x ' Noncompliant: field '_y' is not used in the return value End Get Set(value As Integer) _x = value ' Noncompliant: field '_y' is not updated End Set End Property End Class ```

End statements exit the control flow of the program in an unstructured way. This statement stops code execution immediately without executing Dispose or Finalize methods, or executing Finally blocks. Therefore, it should be avoided.

```vbnet Bad theme={null} Module Module1 Sub Print(ByVal str As String) Try ... End ' Noncompliant Finally ' do something important here ... End Try End Sub End Module ``` ```vbnet Fix theme={null} ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that all non-private fields names match a provided regular expression.

Note that this rule does not apply to non-private Shared ReadOnly fields, for which there is another rule.

The default configuration is:

  • Pascal casing, starting with an upper case character, e.g. BackColor

  • Short abbreviations of 2 letters can be capitalized, e.g. GetID

  • Longer abbreviations need to be lower cased, e.g. GetHtml

```vbnet Bad theme={null} Class Foo Public foo As Integer ' Noncompliant End Class ``` ```vbnet Fix theme={null} Class Foo Public Foo As Integer ' Compliant End Class ```

Most checks against an IndexOf value compare it with -1 because 0 is a valid index.

```vbnet Bad theme={null} strings.IndexOf(someString) = -1 ' Test for "index not found" strings.IndexOf(someString) < 0 ' Test for "index not found" strings.IndexOf(someString) >= 0 ' Test for "index found" ``` ```vbnet Fix theme={null} strings.Contains(someString) ' Boolean result ```

When Select Case statements have large sets of case clauses, it is usually an attempt to map two sets of data. A Dictionary should be used instead to make the code more readable and maintainable.

```vbnet Bad theme={null} Public Class TooManyCase Public Function MapValues(Ch As Char) As Integer Select Case Ch ' Noncompliant: 5 cases, "Case Else" excluded, more than maximum = 4 Case "a"c Return 1 Case "b"c, "c"c Return 2 Case "d"c Return 3 Case "e"c Return 4 Case "f"c, "g"c, "h"c Return 5 Case Else Return 6 End Select End Function End Class ``` ```vbnet Fix theme={null} Public Class TooManyCase Private fMatching As New Dictionary(Of Char, Integer) From { { "a"c, 1 }, { "b"c, 2 }, { "c"c, 2 }, { "d"c, 3 }, { "e"c, 4 }, { "f"c, 5 }, { "g"c, 5 }, { "h"c, 5 }, } Public Function MapValues(Ch As Char) As Integer Dim Value As Integer If fMatching.TryGetValue(Ch, Value) Then Return Value Else Return 6 End If End Function End Class ```

GoTo is an unstructured control flow statement. It makes code less readable and maintainable. Structured control flow statements such as If, For, While, or Exit should be used instead.

```vbnet Bad theme={null} Sub GoToStatementDemo() Dim number As Integer = 1 Dim sampleString As String ' Evaluate number and branch to appropriate label. If number = 1 Then GoTo Line1 Else GoTo Line2 Line1: sampleString = "Number equals 1" GoTo LastLine Line2: ' The following statement never gets executed because number = 1. sampleString = "Number equals 2" LastLine: ' Write "Number equals 1" in the Debug window. Debug.WriteLine(sampleString) End Sub ``` ```vbnet Fix theme={null} Sub GoToStatementDemo() Dim number As Integer = 1 Dim sampleString As String ' Evaluate number and branch to appropriate label. If number = 1 Then sampleString = "Number equals 1" Else sampleString = "Number equals 2" End If Debug.WriteLine(sampleString) End Sub ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that all \`Private Const field names comply with the provided regular expression.

The default configuration is:

  • Optionally, can start with an underscore character or "s\_", e.g. \_foo, s\_foo\`

  • Camel casing, starting with a lower case character, e.g. backColor

  • Short abbreviations of 2 letters can be capitalized only when not at the beginning, e.g. "id" in productID

  • Longer abbreviations need to be lower cased, e.g. html

```vbnet Bad theme={null} Module Module1 Private Const Foo = 0 ' Noncompliant End Module ``` ```vbnet Fix theme={null} Module Module1 Private Const foo = 0 ' Compliant End Module ```

Declaring multiple variable on one line is difficult to read.

```vbnet Bad theme={null} Module Module1 Public Const AAA As Integer = 5, BBB = 42, CCC As String = "foo" ' Noncompliant End Module ``` ```vbnet Fix theme={null} Module Module1 Public Const AAA As Integer = 5 Public Const BBB = 42 Public Const CCC as String = "foo" End Module ```

Using .Count() to test for emptiness works, but using .Any() makes the intent clearer, and the code more readable. However, there are some cases where special attention should be paid:

  • if the collection is an EntityFramework or other ORM query, calling .Count() will cause executing a potentially massive SQL query and could put a large overhead on the application database. Calling .Any() will also connect to the database, but will generate much more efficient SQL.

  • if the collection is part of a LINQ query that contains .Select() statements that create objects, a large amount of memory could be unnecessarily allocated. Calling .Any() will be much more efficient because it will execute fewer iterations of the enumerable.

```vbnet Bad theme={null} Private Function HasContent(Strings As IEnumerable(Of String)) As Boolean Return Strings.Count() > 0 ' Noncompliant End Function Private Function HasContent2(Strings As IEnumerable(Of String)) As Boolean Return Strings.Count() >= 1 ' Noncompliant End Function Private Function IsEmpty(Strings As IEnumerable(Of String)) As Boolean Return Strings.Count() = 0 ' Noncompliant End Function ``` ```vbnet Fix theme={null} Private Function HasContent(Strings As IEnumerable(Of String)) As Boolean Return Strings.Any End Function Private Function HasContent2(Strings As IEnumerable(Of String)) As Boolean Return Strings.Any End Function Private Function IsEmpty(Strings As IEnumerable(Of String)) As Boolean Return Not Strings.Any End Function ```

The Select...Case statement should be used only to clearly define some new branches in the control flow. As soon as a case clause contains too many statements this highly decreases the readability of the overall control flow statement. In such case, the content of the case clause should be extracted into a dedicated procedure.

```vbnet Bad theme={null} Select Case number Case 1 To 5 ' Noncompliant: 4 statements in the case MethodCall1("") MethodCall2("") MethodCall3("") MethodCall4("") Case Else ' ... End Select ``` ```vbnet Fix theme={null} Select Case number Case 1 To 5 DoSomething() Case Else ' ... End Select ... Sub DoSomething() MethodCall1("") MethodCall2("") MethodCall3("") MethodCall4("") End Sub ```

Shared naming conventions allow teams to collaborate efficiently. This rule checks that all subroutine and function names match a provided regular expression.

The default configuration is the one recommended by Microsoft:

  • Pascal casing, starting with an upper case character, e.g. BackColor

  • Short abbreviations of 2 letters can be capitalized, e.g. GetID

  • Longer abbreviations need to be lower cased, e.g. GetHtml

  • Event handlers with a handles clause and two-parameter methods with EventArgs second parameter are not covered by this rule.

```vbnet Bad theme={null} Module Module1 Sub bad_subroutine() ' Noncompliant End Sub Public Function Bad_Function() As Integer ' Noncompliant Return 42 End Function End Module ``` ```vbnet Fix theme={null} Module Module1 Sub GoodSubroutine() ' Compliant End Sub Public Function GoodFunction() As Integer ' Compliant Return 42 End Function End Module ```

Having all branches of a Select Case or If chain with the same implementation indicates a problem.

In the following code:

```vbnet Bad theme={null} Dim b As Integer = If(a > 12, 4, 4) // Noncompliant If b = 0 Then // Noncompliant DoTheThing() Else DoTheThing() End If Select Case i // Noncompliant Case 1 DoSomething() Case 2 DoSomething() Case 3 DoSomething() Case Else DoSomething() End Select ``` ```vbnet Fix theme={null} If b = 0 Then ' No issue, this could have been done on purpose to make the code more readable DoTheThing() ElseIf DoTheThing() End If ```

Sharing some naming conventions is a key point to make it possible for a team to efficiently collaborate.

This rule allows to check that all interface names match a provided regular expression.

The default configuration is the one recommended by Microsoft:

  • Must start with an upper case 'I' character, e.g. IFoo

  • Followed by Pascal casing, starting with an upper case character, e.g. IEnumerable

  • Short abbreviations of 2 letters can be capitalized, e.g. IFooID

  • Longer abbreviations need to be lower cased, e.g. IFooHtml

```vbnet Bad theme={null} Interface Foo ' Noncompliant End Interface ``` ```vbnet Fix theme={null} Interface IFoo ' Compliant End Interface ```

A Do ... Loop without a While or Until condition must be terminated by an unstructured Exit Do statement. It is safer and more readable to use structured loops instead.

```vbnet Bad theme={null} Module Module1 Sub Main() Dim i = 1 Do ' Non-Compliant If i = 10 Then Exit Do End If Console.WriteLine(i) i = i + 1 Loop End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() For i = 1 To 9 ' Compliant Console.WriteLine(i) Next End Sub End Module ```

Inconsistent naming conventions can lead to confusion and errors when working in a team. This rule ensures that all generic type parameter names follow a consistent naming convention by checking them against a provided regular expression.

The default configuration follows Microsoft’s recommended convention:

  • Generic type parameter names must start with an upper case 'T', e.g. T

  • The rest of the name should use Pascal casing, starting with an upper case character, e.g. TKey

  • Short abbreviations of 2 letters can be capitalized, e.g. TFooID

  • Longer abbreviations should be lowercased, e.g. TFooHtml

```vbnet Bad theme={null} Public Class Foo(Of tkey) ' Noncompliant End Class ``` ```vbnet Fix theme={null} Public Class Foo(Of TKey) ' Compliant End Class ```

Methods declared as Public, Protected, or Protected Friend can be accessed from other assemblies, which means you should validate parameters to be within the expected constraints. In general, checking against Nothing is recommended in defensive programming.

This rule raises an issue when a parameter of a publicly accessible method is not validated against Nothing before being dereferenced.

```vbnet Bad theme={null} Public Class Sample Public Property Message As String Public Sub PublicMethod(Arg As Exception) Message = Arg.Message ' Noncompliant End Sub Protected Sub ProtectedMethod(Arg As Exception) Message = Arg.Message ' Noncompliant End Sub End Class ``` ```vbnet Fix theme={null} Public Class Sample Public Property Message As String Public Sub PublicMethod(Arg As Exception) If Arg IsNot Nothing Then Message = Arg.Message ' Noncompliant End Sub Protected Sub ProtectedMethod(Arg As Exception) ArgumentNullException.ThrowIfNull(Arg) Message = Arg.Message ' Noncompliant End Sub Private Sub PrivateMethod(Arg As Exception) Message = Arg.Message ' Compliant: method is not publicly accessible End Sub End Class ```

There’s no need to null test in conjunction with an TypeOf ... Is test. Nothing is not an instance of anything, so a null check is redundant.

```vbnet Bad theme={null} If (x IsNot Nothing And TypeOf x Is MyClass) ' ... End If If (x Is Nothing Or TypeOf x IsNot MyClass) ' ... End If ``` ```vbnet Fix theme={null} If (TypeOf x Is MyClass) ' ... End If If (TypeOf x IsNot MyClass) ' ... End If ```

There is no good excuse for an empty class. If it’s being used simply as a common extension point, it should be replaced with an Interface. If it was stubbed in as a placeholder for future development it should be fleshed-out. In any other case, it should be eliminated.

```vbnet Bad theme={null} Public Class Empty ' Noncompliant End Class ``` ```vbnet Fix theme={null} Public Interface IEmpty End Interface ```

Visual Basic .NET, unlike many other programming languages, has no "fall-through" for its Select cases. Each case already has an implicit Exit Select as its last instruction. It therefore is redundant to explicitly add one.

```vbnet Bad theme={null} Module Module1 Sub Main() Dim x = 0 Select Case x Case 0 Console.WriteLine("0") Exit Select ' Noncompliant Case Else Console.WriteLine("Not 0") Exit Select ' Noncompliant End Select End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() Dim x = 0 Select Case x Case 0 ' Compliant Console.WriteLine("0") Case Else ' Compliant Console.WriteLine("Not 0") End Select End Sub End Module ```

Indexed properties are meant to represent access to a logical collection. When multiple parameters are required, this design guideline may be violated, and refactoring the property into a method is preferable.

```vbnet Bad theme={null} Module Module1 ReadOnly Property Sum(ByVal a As Integer, ByVal b As Integer) ' Noncompliant Get Return a + b End Get End Property End Module ``` ```vbnet Fix theme={null} Module Module1 Function Sum(ByVal a As Integer, ByVal b As Integer) ' Compliant Return a + b End Function End Module ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that all enumeration value names match a provided regular expression.

The default configuration is the one recommended by Microsoft:

  • Pascal casing, starting with an upper case character, e.g. BackColor

  • Short abbreviations of 2 letters can be capitalized, e.g. GetID

  • Longer abbreviations need to be lower cased, e.g. GetHtml

```vbnet Bad theme={null} Enum Foo fooValue ' Noncompliant End Enum ``` ```vbnet Fix theme={null} Enum Foo FooValue ' Compliant End Enum ```

The ... IsNot ... syntax is more compact and more readable than the Not ... Is ... syntax.

```vbnet Bad theme={null} Module Module1 Sub Main() Dim a = Not "a" Is Nothing ' Noncompliant End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() Dim a = "a" IsNot Nothing ' Compliant End Sub End Module ```

Prefer the use of \`Try ... Catch blocks instead of On Error statements.

Visual Basic .NET and Visual Basic 2005 offer structured exception handling that provides a powerful, more readable alternative to the On Error Goto error handling from previous versions of Microsoft Visual Basic. Structured exception handling is more powerful because it allows you to nest error handlers inside other error handlers within the same procedure. Furthermore, structured exception handling uses a block syntax similar to the If...Else...End If\` statement. This makes Visual Basic .NET and Visual Basic 2005 code more readable and easier to maintain.

```vbnet Bad theme={null} Sub DivideByZero() On Error GoTo nextstep Dim result As Integer Dim num As Integer num = 100 result = num / 0 nextstep: System.Console.WriteLine("Error") End Sub ``` ```vbnet Fix theme={null} Sub DivideByZero() Try Dim result As Integer Dim num As Integer num = 100 result = num / 0 Catch System.Console.WriteLine("Error") End Try End Sub ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that all \`Private field names match the provided regular expression.

Note that this rule does not apply to Private Shared ReadOnly fields, which are checked by another rule.

The default configuration is:

  • Optionally, can start with an underscore character or "s\_", e.g. \_foo, s\_foo\`

  • Camel casing, starting with a lower case character, e.g. backColor

  • Short abbreviations of 2 letters can be capitalized only when not at the beginning, e.g. "id" in productID

  • Longer abbreviations need to be lower cased, e.g. html

```vbnet Bad theme={null} Class Foo Private Foo As Integer ' Noncompliant End Class ``` ```vbnet Fix theme={null} Class Foo Private foo As Integer ' Compliant End Class ```

The ... = \{} syntax is more compact, more readable and less error-prone.

```vbnet Bad theme={null} Module Module1 Sub Main() Dim foo(1) As String ' Noncompliant foo(0) = "foo" foo(1) = "bar" End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() Dim foo = {"foo", "bar"} ' Compliant End Sub End Module ```

Shared coding conventions allow teams to collaborate efficiently. This rule checks that all namespace names match a provided regular expression.

The default configuration is the one recommended by Microsoft:

  • Pascal casing, starting with an upper case character, e.g. Microsoft, System

  • Short abbreviations of 2 letters can be capitalized, e.g. System.IO

  • Longer abbreviations need to be lower cased

```vbnet Bad theme={null} Namespace foo ' Noncompliant End Namespace ``` ```vbnet Fix theme={null} Namespace Foo ' Compliant End Namespace ```

StringBuilder is more efficient than string concatenation, especially when the operator is repeated over and over as in loops.

```vbnet Bad theme={null} Module Module1 Sub Main() Dim foo = "" foo &= "Result: " ' Compliant - outside of loop For i = 1 To 9 foo &= i ' Noncompliant Next End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() Dim foo = New System.Text.StringBuilder foo.Append("Result: ") ' Compliant For i = 1 To 9 foo.Append(i) ' Compliant Next End Sub End Module ```

Numbers are infinite, but the types that hold them are not. Each numeric type has hard upper and lower bounds. Try to calculate numbers beyond those bounds, and the result will be an OverflowException. When the compilation is configured to remove integer overflow checking, the value will be silently wrapped around from the expected positive value to a negative one, or vice versa.

```vbnet Bad theme={null} Public Function Transform(Value As Integer) As Integer If Value <= 0 Then Return Value Dim Number As Integer = Integer.MaxValue Return Number + Value ' Noncompliant End Function ``` ```vbnet Fix theme={null} Public Function Transform(Value As Integer) As Long If Value <= 0 Then Return Value Dim Number As Long = Integer.MaxValue Return Number + Value End Function ```

Method for creating empty arrays Array.Empty(Of TElement) was introduced in .NET 4.6 to optimize object instantiation and memory allocation. It also improves code readability by making developer’s intent more explicit. This new method should be preferred over empty array declaration.

```vbnet Bad theme={null} Public Sub Method() Dim Values1(-1) As Integer ' Noncompliant Dim Values2 As Integer() = New Integer() {} ' Noncompliant Dim Values3 As Integer() = {} ' Noncompliant Dim Values4() As Integer = {} ' Noncompliant End Sub ``` ```vbnet Fix theme={null} Public Sub Method() Dim Values1 As Integer() = Array.Empty(Of Integer) Dim Values2 As Integer() = Array.Empty(Of Integer) Dim Values3 As Integer() = Array.Empty(Of Integer) Dim Values4() As Integer = Array.Empty(Of Integer) End Sub ```

The requirement for a final Case Else clause is defensive programming.

This clause should either take appropriate action or contain a suitable comment as to why no action is taken.

```vbnet Bad theme={null} Select Case param ' Noncompliant - Case Else clause is missing Case 0 DoSomething() Case 1 DoSomethingElse() End Select ``` ```vbnet Fix theme={null} Select Case param Case 0 DoSomething() Case 1 DoSomethingElse() Case Else ' Compliant DoSomethingElse() End Select ```

Nested \`Select Case structures are difficult to understand because you can easily confuse the cases of an inner Select Case as belonging to an outer statement. Therefore nested Select Case statements should be avoided.

Specifically, you should structure your code to avoid the need for nested Select Case statements, but if you cannot, then consider moving the inner Select Case\` to another function.

```vbnet Bad theme={null} Public Sub Foo(A As Integer, B As Integer) Select Case A Case 0 ' ... Case 1 Select Case B ' Noncompliant; nested Select Case Case 2 ' ... Case 3 ' ... Case 4 ' ... Case Else ' ... End Select Case 2 ' ... Case Else ' ... End Select End Sub ``` ```vbnet Fix theme={null} Public Sub Foo(A As Integer, B As Integer) Select Case A Case 0 ' ... Case 1 HandleB(B) Case 2 ' ... Case Else ' ... End Select End Sub ```

Subscribing to events without unsubscribing later on can lead to memory leaks or even duplicate subscriptions, i.e. code which is executed multiple times by mistake.

Even if there is no problem right now, the code is more difficult to review and a simple refactoring can create a bug. For example the lifetime of the event publisher could change and prevent subscribers from being garbage collected.

There are patterns to automatically unsubscribe, but the simplest and most readable solution remains to unsubscribe from events explicitly using \`RemoveHandler.

This rule raises an issue when a class subscribes to an even using AddHandler without explicitly unsubscribing with RemoveHandler\`.

```vbnet Bad theme={null} Class MyEventProcucer Public Shared Event EventFired As EventHandler End Class Public Class MyEventSubscriber Implements IDisposable Public Sub New() AddHandler MyEventProcucer.EventFired, AddressOf c_EventFired 'Noncompliant End Sub Private Sub c_EventFired(sender As Object, e As EventArgs) End Sub Public Sub Dispose() Implements IDisposable.Dispose End Sub End Class ``` ```vbnet Fix theme={null} Class MyEventProcucer Public Shared Event EventFired As EventHandler End Class Public Class MyEventSubscriber Implements IDisposable Public Sub New() AddHandler MyEventProcucer.EventFired, AddressOf c_EventFired End Sub Private Sub c_EventFired(ByVal sender As Object, ByVal e As EventArgs) End Sub Public Sub Dispose() Implements IDisposable.Dispose RemoveHandler MyEventProcucer.EventFired, AddressOf c_EventFired End Sub End Class ```

Passing parameters by reference requires developers to understand the subtle differences between reference and value types. It is preferable to avoid passing parameters by reference when possible.

```vbnet Bad theme={null} Module Module1 Sub Foo(ByRef result As Integer) ' Non-Compliant result = 42 End Sub Sub Main() Dim result As Integer Foo(result) Console.WriteLine(result) End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Function Foo() As Integer ' Compliant Return 42 End Function Sub Main() Dim result As Integer = Foo() Console.WriteLine(result) End Sub End Module ```

"After" and "Before" prefixes or suffixes should not be used to indicate pre and post events. The concepts of before and after should be given to events using the present and past tense.

```vbnet Bad theme={null} Class Foo Event BeforeClose() ' Noncompliant Event AfterClose() ' Noncompliant End Class ``` ```vbnet Fix theme={null} Class Foo Event Closing() ' Compliant Event Closed() ' Compliant End Class ```

One of the principles of a unit test is that it must have full control of the system under test. This is problematic when production code includes calls to static methods, which cannot be changed or controlled. Date/time functions are usually provided by system libraries as static methods.

This can be improved by wrapping the system calls in an object or service that can be controlled inside the unit test.

```vbnet Bad theme={null} Public Class Foo Public Function HelloTime() As String Return $"Hello at {DateTime.UtcNow}" End Function End Class ``` ```vbnet Fix theme={null} Public Interface IClock Function UtcNow() As Date End Interface Public Class Foo Public Function HelloTime(clock As IClock) As String Return $"Hello at {clock.UtcNow()}" End Function End Class Public Class FooTest Public Class TestClock Implements IClock ' implement End Class Public Sub HelloTime_Gives_CorrectTime() Dim dateTime = New DateTime(2017, 06, 11) Assert.Equal((New Foo()).HelloTime(New TestClock(dateTime)), $"Hello at {dateTime}") End Sub End Class ```

If a lock is acquired and released within a method, then it must be released along all execution paths of that method.

Failing to do so will expose the conditional locking logic to the method’s callers and hence be deadlock-prone.

```vbnet Bad theme={null} Class Example Private obj As Object = New Object() Public Sub DoSomethingWithMonitor() Monitor.Enter(obj) ' Noncompliant: not all paths release the lock If IsInitialized() Then ' ... Monitor.Exit(obj) End If End Sub End Class ``` ```vbnet Fix theme={null} Class Example Private lockObj As ReaderWriterLockSlim = New ReaderWriterLockSlim() Public Sub DoSomethingWithReaderWriteLockSlim() lockObj.EnterReadLock() ' Noncompliant: not all paths release the lock If IsInitialized() Then ' ... lockObj.ExitReadLock() End If End Sub End Class ```

It is needlessly complex to invert the result of a boolean comparison. The opposite comparison should be made instead.

```vbnet Bad theme={null} If Not (a = 2) Then // Noncompliant Dim b as Boolean = Not (i < 10) // Noncompliant ``` ```vbnet Fix theme={null} If a <> 2 Then Dim b as Boolean = i >= 10 ```

Regular expressions have their own syntax that is understood by regular expression engines. Those engines will throw an exception at runtime if they are given a regular expression that does not conform to that syntax.

To avoid syntax errors, special characters should be escaped with backslashes when they are intended to be matched literally and references to capturing groups should use the correctly spelled name or number of the group.

```vbnet Bad theme={null} Sub Regexes(Input As String) Dim Rx As New Regex("[A") ' Noncompliant: unmatched "[" Dim Match = Regex.Match(Input, "[A") ' Noncompliant Dim NegativeLookahead As New Regex("a(?!b)", RegexOptions.NonBacktracking) ' Noncompliant: negative lookahead without backtracking Dim NegativeLookbehind As New Regex("(?

Operating systems have global directories where any user has write access. Those folders are mostly used as temporary storage areas like \`/tmp in Linux based systems. An application manipulating files from these folders is exposed to race conditions on filenames: a malicious user can try to create a file with a predictable name before the application does. A successful attack can result in other files being accessed, modified, corrupted or deleted. This risk is even higher if the application runs with elevated permissions.

In the past, it has led to the following vulnerabilities:

This rule raises an issue whenever it detects a hard-coded path to a publicly writable directory like /tmp (see examples bellow). It also detects access to environment variables that point to publicly writable directories, e.g., TMP and TMPDIR.

  • /tmp

  • /var/tmp

  • /usr/tmp

  • /dev/shm

  • /dev/mqueue

  • /run/lock

  • /var/run/lock

  • /Library/Caches

  • /Users/Shared

  • /private/tmp

  • /private/var/tmp

  • \Windows\Temp

  • \Temp

  • \TMP\`

```vbnet Bad theme={null} Dim RandomPath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName()) ' Creates a new file with write, non inheritable permissions which is deleted on close. Using FileStream As New FileStream(RandomPath, FileMode.CreateNew, FileAccess.Write, FileShare.None, 4096, FileOptions.DeleteOnClose) Using Writer As New StreamWriter(FileStream) ' Sensitive ' ... End Using End Using ``` ```vbnet Fix theme={null} ```

Putting multiple statements on a single line lowers the code readability and makes debugging the code more complex.

Unresolved directive in \ - include::\{noncompliant}\[]

Write one statement per line to improve readability.

Unresolved directive in \ - include::\{compliant}\[]

```vbnet Bad theme={null} Dim a = 0 : Dim b = 0 ' Noncompliant ``` ```vbnet Fix theme={null} Dim a = 0 Dim b = 0 ```

The information that an enumeration type is actually an enumeration or a set of flags should not be duplicated in its name.

```vbnet Bad theme={null} Enum FooFlags ' Noncompliant Foo = 1 Bar = 2 Baz = 4 End Enum ``` ```vbnet Fix theme={null} Enum Foo ' Compliant Foo = 1 Bar = 2 Baz = 4 End Enum ```

When executing an OS command and unless you specify the full path to the executable, then the locations in your application’s PATH environment variable will be searched for the executable. That search could leave an opening for an attacker if one of the elements in PATH is a directory under his control.

```vbnet Bad theme={null} Dim p As New Process() p.StartInfo.FileName = "C:\Apps\binary.exe" ' Compliant ``` ```vbnet Fix theme={null} ```

Having a permissive Cross-Origin Resource Sharing policy is security-sensitive. It has led in the past to the following vulnerabilities:

Same origin policy in browsers prevents, by default and for security-reasons, a javascript frontend to perform a cross-origin HTTP request to a resource that has a different origin (domain, protocol, or port) from its own. The requested target can append additional HTTP headers in response, called CORS, that act like directives for the browser and change the access control policy / relax the same origin policy.

```vbnet Bad theme={null} Response.AppendHeader("Access-Control-Allow-Origin", "trustedwebsite.com") // Compliant ``` ```vbnet Fix theme={null} ``` ```vbnet Bad theme={null} towns.Item(x) = "London" towns.Item(x) = "Chicago"; // Noncompliant ``` ```vbnet Fix theme={null} ```

When declaring a Windows Communication Foundation (WCF) OperationContract method as one-way, that service method won’t return any result, not even an underlying empty confirmation message. These are fire-and-forget methods that are useful in event-like communication. Therefore, specifying a return type has no effect and can confuse readers.

```vbnet Bad theme={null} Interface IMyService Function SomethingHappened(ByVal parameter As Integer) As Integer ' Noncompliant End Interface ``` ```vbnet Fix theme={null} Interface IMyService Sub SomethingHappened(ByVal parameter As Integer) End Interface ```

Development tools and frameworks usually have options to make debugging easier for developers. Although these features are useful during development, they should never be enabled for applications deployed in production. Debug instructions or error messages can leak detailed information about the system, like the application’s path or file names.

```vbnet Bad theme={null} Imports Microsoft.AspNetCore.Builder Imports Microsoft.AspNetCore.Hosting Namespace MyMvcApp Public Class Startup Public Sub Configure(ByVal app As IApplicationBuilder, ByVal env As IHostingEnvironment) ' Those calls are Sensitive because it seems that they will run in production app.UseDeveloperExceptionPage() 'Sensitive app.UseDatabaseErrorPage() 'Sensitive End Sub End Class End Namespace ``` ```vbnet Fix theme={null} Imports Microsoft.AspNetCore.Builder Imports Microsoft.AspNetCore.Hosting Namespace MyMvcApp Public Class Startup Public Sub Configure(ByVal app As IApplicationBuilder, ByVal env As IHostingEnvironment) If env.IsDevelopment() Then ' Compliant ' The following calls are ok because they are disabled in production app.UseDeveloperExceptionPage() app.UseDatabaseErrorPage() End If End Sub End Class End Namespace ```

A boolean literal can be represented in two different ways: \{true} or \{false}. They can be combined with logical operators (\{ops}) to produce logical expressions that represent truth values. However, comparing a boolean literal to a variable or expression that evaluates to a boolean value is unnecessary and can make the code harder to read and understand. The more complex a boolean expression is, the harder it will be for developers to understand its meaning and expected behavior, and it will favour the introduction of new bugs.

```vbnet Bad theme={null} If BooleanMethod() = True Then ' Noncompliant ' ... End If If BooleanMethod() = False Then ' Noncompliant ' ... End If If BooleanMethod() OrElse False Then ' Noncompliant ' ... End If DoSomething(Not False) ' Noncompliant DoSomething(BooleanMethod() = True) ' Noncompliant Dim booleanVariable = If(BooleanMethod(), True, False) ' Noncompliant booleanVariable = If(BooleanMethod(), True, exp) ' Noncompliant booleanVariable = If(BooleanMethod(), False, exp) ' Noncompliant booleanVariable = If(BooleanMethod(), exp, True) ' Noncompliant booleanVariable = If(BooleanMethod(), exp, False) ' Noncompliant ``` ```vbnet Fix theme={null} If BooleanMethod() Then ' ... End If If Not BooleanMethod() Then ' ... End If If BooleanMethod() Then ' ... End If DoSomething(True) DoSomething(BooleanMethod()) Dim booleanVariable = BooleanMethod() booleanVariable = BooleanMethod() OrElse exp booleanVariable = Not BooleanMethod() AndAlso exp booleanVariable = Not BooleanMethod() OrElse exp booleanVariable = BooleanMethod() AndAlso exp ```

This rule is meant to be used as a way to track code which is marked as being deprecated. Deprecated code should eventually be removed.

```vbnet Bad theme={null} ' Noncompliant Sub Procedure() End Sub ``` ```vbnet Fix theme={null} ```

Properties with only setters are confusing and counterintuitive. Instead, a property getter should be added if possible, or the property should be replaced with a setter method.

```vbnet Bad theme={null} Module Module1 WriteOnly Property Foo() As Integer ' Non-Compliant Set(ByVal value As Integer) ' ... some code ... End Set End Property End Module ``` ```vbnet Fix theme={null} Module Module1 Sub SetFoo(ByVal value As Integer) ' Compliant ' ... some code ... End Sub End Module ```

When optional parameter values are not passed to base method calls, the value passed in by the caller is ignored. This can cause the function to behave differently than expected, leading to errors and making the code difficult to debug.

```vbnet Bad theme={null} Public Class BaseClass Public Overridable Sub MyMethod(ByVal Optional i As Integer = 1) Console.WriteLine(i) End Sub End Class Public Class DerivedClass Inherits BaseClass Public Overrides Sub MyMethod(ByVal Optional i As Integer = 1) ' ... MyBase.MyMethod() ' Noncompliant: caller's value is ignored End Sub Private Shared Function Main(ByVal args As String()) As Integer Dim dc As DerivedClass = New DerivedClass() dc.MyMethod(12) ' prints 1 End Function End Class ``` ```vbnet Fix theme={null} Public Class BaseClass Public Overridable Sub MyMethod(ByVal Optional i As Integer = 1) Console.WriteLine(i) End Sub End Class Public Class DerivedClass Inherits BaseClass Public Overrides Sub MyMethod(ByVal Optional i As Integer = 1) ' ... MyBase.MyMethod(i) End Sub Private Shared Function Main(ByVal args As String()) As Integer Dim dc As DerivedClass = New DerivedClass() dc.MyMethod(12) ' prints 12 End Function End Class ```

Fields should not be part of an API, and therefore should always be private. Indeed, they cannot be added to an interface for instance, and validation cannot be added later on without breaking backward compatibility. Instead, developers should encapsulate their fields into properties. Explicit property getters and setters can be introduced for validation purposes or to smooth the transition to a newer system.

```vbnet Bad theme={null} Class Foo Public Foo = 42 ' Noncompliant End Class ``` ```vbnet Fix theme={null} Class Foo Public Property Foo = 42 ' Compliant End Class ```

Successful Zip Bomb attacks occur when an application expands untrusted archive files without controlling the size of the expanded data, which can lead to denial of service. A Zip bomb is usually a malicious archive file of a few kilobytes of compressed data but turned into gigabytes of uncompressed data. To achieve this extreme compression ratio, attackers will compress irrelevant data (eg: a long string of repeated bytes).

```vbnet Bad theme={null} Const ThresholdRatio As Double = 10 Const ThresholdSize As Integer = 1024 * 1024 * 1024 ' 1 GB Const ThresholdEntries As Integer = 10000 Dim TotalSizeArchive, TotalEntryArchive, TotalEntrySize, Cnt As Integer Dim Buffer(1023) As Byte Using ZipToOpen As New FileStream("ZipBomb.zip", FileMode.Open), Archive As New ZipArchive(ZipToOpen, ZipArchiveMode.Read) For Each Entry As ZipArchiveEntry In Archive.Entries Using s As Stream = Entry.Open TotalEntryArchive += 1 TotalEntrySize = 0 Do Cnt = s.Read(Buffer, 0, Buffer.Length) TotalEntrySize += Cnt TotalSizeArchive += Cnt If TotalEntrySize / Entry.CompressedLength > ThresholdRatio Then Exit Do ' Ratio between compressed And uncompressed data Is highly suspicious, looks Like a Zip Bomb Attack Loop While Cnt > 0 End Using If TotalSizeArchive > ThresholdSize Then Exit For ' The uncompressed data size Is too much for the application resource capacity If TotalEntryArchive > ThresholdEntries Then Exit For ' Too much entries in this archive, can lead to inodes exhaustion of the system Next End Using ``` ```vbnet Fix theme={null} ```

Having a field in a child class with a name that differs from a parent class' field only by capitalization is sure to cause confusion. Such child class fields should be renamed.

```vbnet Bad theme={null} Public Class Fruit Protected PlantingSeason As String ' ... End Class Public Class Raspberry Inherits Fruit Protected Plantingseason As String ' Noncompliant ' ... End Class ``` ```vbnet Fix theme={null} Public Class Fruit Protected PlantingSeason As String ' ... End Class Public Class Raspberry Inherits Fruit Protected WhenToPlant As String ' ... End Class ```

Nested code - blocks of code inside blocks of code - is eventually necessary, but increases complexity. This is why keeping the code as flat as possible, by avoiding unnecessary nesting, is considered a good practice.

Merging if statements when possible will decrease the nesting of the code and improve its readability.

```vbnet Bad theme={null} If condition1 Then If condition2 Then ' Noncompliant ' ... End If End If ``` ```vbnet Fix theme={null} If condition1 AndAlso condition2 Then ' ... End If ```

An empty \{operationName} is generally considered bad practice and can lead to confusion, readability, and maintenance issues. Empty \{operationName}s bring no functionality and are misleading to others as they might think the \{operationName} implementation fulfills a specific and identified requirement.

There are several reasons for a \{operationName} not to have a body:

  • It is an unintentional omission, and should be fixed to prevent an unexpected behavior in production.

  • It is not yet, or never will be, supported. In this case an exception should be thrown.

  • The method is an intentionally-blank override. In this case a nested comment should explain the reason for the blank override.

```vbnet Bad theme={null} Sub ShouldNotBeEmpty() ' Noncompliant - method is empty End Sub Sub NotImplementedYet() ' Noncompliant - method is empty End Sub Sub WillNeverBeImplemented() ' Noncompliant - method is empty End Sub Sub EmptyOnPurpose() ' Noncompliant - method is empty End Sub ``` ```vbnet Fix theme={null} Sub ShouldNotBeEmpty() DoSomething() End Sub Sub NotImplementedYet() Throw New NotImplementedException End Sub Sub WillNeverBeImplemented() Throw New NotSupportedException End Sub Sub EmptyOnPurpose() ' Do nothing because of X End Sub ```

Clear-text protocols such as \`ftp, telnet, or http lack encryption of transported data, as well as the capability to build an authenticated connection. It means that an attacker able to sniff traffic from the network can read, modify, or corrupt the transported content. These protocols are not secure as they expose applications to an extensive range of risks:

  • sensitive data exposure

  • traffic redirected to a malicious endpoint

  • malware-infected software update or installer

  • execution of client-side code

  • corruption of critical information

Even in the context of isolated networks like offline environments or segmented cloud environments, the insider threat exists. Thus, attacks involving communications being sniffed or tampered with can still happen.

For example, attackers could successfully compromise prior security layers by:

  • bypassing isolation mechanisms

  • compromising a component of the network

  • getting the credentials of an internal IAM account (either from a service account or an actual person)

In such cases, encrypting communications would decrease the chances of attackers to successfully leak data or steal credentials from other network components. By layering various security practices (segmentation and encryption, for example), the application will follow the defense-in-depth principle.

Note that using the http\` protocol is being deprecated by major web browsers.

In the past, it has led to the following vulnerabilities:

```vbnet Bad theme={null} Dim UrlHttp As String = "http://example.com" ' Noncompliant Dim UrlFtp As String = "ftp://anonymous@example.com" ' Noncompliant Dim UrlTelnet As String = "telnet://anonymous@example.com" ' Noncompliant ``` ```vbnet Fix theme={null} Using Smtp As New SmtpClient("host", 25) ' Noncompliant, EnableSsl Is Not Set End Using Using Telnet As New MyTelnet.Client("host", port) ' Noncompliant, rule raises Security Hotspot On any member containing "Telnet" End Using ```

The use of parentheses, even those not required to enforce a desired order of operations, can clarify the intent behind a piece of code. However, redundant pairs of parentheses could be misleading and should be removed.

```vbnet Bad theme={null} If a AndAlso ((x + y > 0)) Then ' Noncompliant ' ... End If Return ((x + 1)) ' Noncompliant ``` ```vbnet Fix theme={null} If a AndAlso x + y > 0 Then ' ... End If Return x + 1 ```

Array designators should always be located on the type for better code readability. Otherwise, developers must look both at the type and the variable name to know whether or not a variable is an array.

```vbnet Bad theme={null} Module Module1 Sub Main() Dim foo() As String ' Noncompliant End Sub End Module ``` ```vbnet Fix theme={null} Module Module1 Sub Main() Dim foo As String() ' Compliant End Sub End Module ```

Arbitrary OS command injection vulnerabilities are more likely when a shell is spawned rather than a new process, indeed shell meta-chars can be used (when parameters are user-controlled for instance) to inject OS commands.

```vbnet Bad theme={null} Imports System.Security Imports System.Diagnostics Namespace N Class A Public Sub Foo(ByVal process As Process) Process.Start("/usr/bin/file.exe") ' Compliant End Sub End Class End Namespace ``` ```vbnet Fix theme={null} ```

Rejecting requests with significant content length is a good practice to control the network traffic intensity and thus resource consumption in order to prevent DoS attacks.

```vbnet Bad theme={null} Imports Microsoft.AspNetCore.Mvc Public Class MyController Inherits Controller ' Sensitive: No size limit ' Sensitive: 10485760 B = 10240 KB = 10 MB is more than the recommended limit of 8MB Public Function PostRequest(Model model) As IActionResult ' ... End Function ' Sensitive: 10485760 B = 10240 KB = 10 MB is more than the recommended limit of 8MB Public Function MultipartFormRequest(Model model) As IActionResult ' ... End Function End Class ``` ```vbnet Fix theme={null} Imports Microsoft.AspNetCore.Mvc Public Class MyController Inherits Controller ' Compliant: 8388608 B = 8192 KB = 8 MB Public Function PostRequest(Model model) As IActionResult ' ... End Function ' Compliant: 8388608 B = 8192 KB = 8 MB Public Function MultipartFormRequest(Model model) AS IActionResult ' ... End Function End Class ```

Formatted SQL queries can be difficult to maintain, debug and can increase the risk of SQL injection when concatenating untrusted values into the query. However, this rule doesn’t detect SQL injections (unlike rule S3649), the goal is only to highlight complex/formatted queries.

```vbnet Bad theme={null} Public Sub Foo(ByVal context As DbContext, ByVal value As String) context.Database.ExecuteSqlCommand("SELECT * FROM mytable WHERE mycol=@p0", value) ' Compliant, the query is parameterized End Sub ``` ```vbnet Fix theme={null} ```

A typical code smell known as unused function parameters refers to parameters declared in a function but not used anywhere within the function’s body. While this might seem harmless at first glance, it can lead to confusion and potential errors in your code. Disregarding the values passed to such parameters, the function’s behavior will be the same, but the programmer’s intention won’t be clearly expressed anymore. Therefore, removing function parameters that are not being utilized is considered best practice.

```vbnet Bad theme={null} Private Sub DoSomething(ByVal a As Integer, ByVal b as Integer) ' "b" is unused Compute(a) End Sub Private Function DoSomething2(ByVal a As Integer, ByVal b As Integer) As Integer ' "a" is unused Compute(b) Return b End Function ``` ```vbnet Fix theme={null} Private Sub DoSomething(ByVal a As Integer) Compute(a) End Sub Private Function DoSomething2(ByVal b As Integer) As Integer Compute(b) Return b End Function ```

Shared naming conventions allow teams to collaborate efficiently.

This rule raises an issue when a class name does not match a provided regular expression.

```vbnet Bad theme={null} Class foo ' Noncompliant End Class ``` ```vbnet Fix theme={null} Class Foo End Class ```

Assemblies should explicitly indicate whether they are meant to be COM visible or not. If the ComVisibleAttribute is not present, the default is to make the content of the assembly visible to COM clients.

Note that COM visibility can be overridden for individual types and members.

```vbnet Bad theme={null} Namespace MyLibrary ' Noncompliant End Namespace ``` ```vbnet Fix theme={null} Namespace MyLibrary End Namespace ```

switch statements are useful when there are many different cases depending on the value of the same expression.

For just one or two cases, however, the code will be more readable with if statements.

```vbnet Bad theme={null} Select Case variable Case 0 doSomething() Case Else doSomethingElse() End Select ``` ```vbnet Fix theme={null} If variable = 0 Then doSomething() Else doSomethingElse() End If ```

Conditional expressions which are always true or false can lead to unreachable code.

```vbnet Bad theme={null} Dim a = False If a Then Dispose() ' Never reached End If ``` ```vbnet Fix theme={null} Const debug = False '... If debug Then ' Print something End If ```

There is no reason to re-assign a variable to itself. Either this statement is redundant and should be removed, or the re-assignment is a mistake and some other value or variable was intended for the assignment instead.

```vbnet Bad theme={null} Public Sub SetName(name As String) name = name ' Noncompliant End Sub ``` ```vbnet Fix theme={null} Public Sub SetName(name As String) Me.name = name ' Compliant End Sub ```

Serialization event handlers that don’t have the correct signature will not be called, bypassing augmentations to automated serialization and deserialization events.

A method is designated a serialization event handler by applying one of the following serialization event attributes:

Serialization event handlers take a single parameter of type StreamingContext, return void, and have private visibility.

This rule raises an issue when any of these constraints are not respected.

```vbnet Bad theme={null} Public Class Foo Public Sub OnSerializing(ByVal context As StreamingContext) ' Noncompliant: should be private End Sub Private Function OnSerialized(ByVal context As StreamingContext) As Integer ' Noncompliant: should return void End Function Private Sub OnDeserializing() ' Noncompliant: should have a single parameter of type StreamingContext End Sub Public Sub OnSerializing2(Of T)(ByVal context As StreamingContext) ' Noncompliant: should have no type parameters End Sub Private Sub OnDeserialized(ByVal context As StreamingContext, ByVal str As String) ' Noncompliant: should have a single parameter of type StreamingContext End Sub End Class ``` ```vbnet Fix theme={null} Public Class Foo Private Sub OnSerializing(ByVal context As StreamingContext) End Sub Private Sub OnSerialized(ByVal context As StreamingContext) End Sub Private Sub OnDeserializing(ByVal context As StreamingContext) End Sub Private Sub OnDeserialized(ByVal context As StreamingContext) End Sub End Class ```

Assemblies should conform with the Common Language Specification (CLS) in order to be usable across programming languages. To be compliant an assembly has to indicate it with System.CLSCompliantAttribute.

```vbnet Bad theme={null} Namespace MyLibrary End Namespace ``` ```vbnet Fix theme={null} ```

Constant members are copied at compile time to the call sites, instead of being fetched at runtime.

As an example, say you have a library with a constant \`Version member set to 1.0, and a client application linked to it. This library is then updated and Version is set to 2.0. Unfortunately, even after the old DLL is replaced by the new one, Version will still be 1.0 for the client application. In order to see 2.0, the client application would need to be rebuilt against the new version of the library.

This means that you should use constants to hold values that by definition will never change, such as Zero\`. In practice, those cases are uncommon, and therefore it is generally better to avoid constant members.

This rule only reports issues on public constant fields, which can be reached from outside the defining assembly.

```vbnet Bad theme={null} Public Class Foo Public Const Version = 1.0 ' Noncompliant End Class ``` ```vbnet Fix theme={null} Public Class Foo Public Shared ReadOnly Property Version = 1.0 ' Compliant End Class ```

According to the Single Responsibility Principle, introduced by Robert C. Martin in his book "Principles of Object Oriented Design", a class should have only one responsibility:

If a class has more than one responsibility, then the responsibilities become coupled.

Changes to one responsibility may impair or inhibit the class' ability to meet the others.

This kind of coupling leads to fragile designs that break in unexpected ways when changed.

Classes which rely on many other classes tend to aggregate too many responsibilities and should be split into several smaller ones.

Nested classes dependencies are not counted as dependencies of the outer class.

```vbnet Bad theme={null} Class Foo ' Non-Compliant - depends on too many other classes Dim a1 As T1 ' Foo is coupled to T1 Dim a2 As T2 ' Foo is coupled to T2 Dim a3 As T3 ' Foo is coupled to T3 Dim a4 As T4 ' etc. Dim a5 As T5 Dim a6 As T6 Dim a7 As T7 Dim a8 As T8 Dim a9 As T9 Dim a10 As T10 Dim a11 As T11 Dim a12 As T12 Dim a13 As T13 Dim a14 As T14 Dim a15 As T15 Dim a16 As T16 Dim a17 As T17 Dim a18 As T18 Dim a19 As T19 Dim a20 As T20 Dim a21 As T21 End Class ``` ```vbnet Fix theme={null} ```

Nested ternaries are hard to read and can make the order of operations complex to understand.

Unresolved directive in \ - include::\{noncompliant}\[]

Instead, use another line to express the nested operation in a separate statement.

Unresolved directive in \ - include::\{compliant}\[]

```vbnet Bad theme={null} Public Function GetReadableStatus(job As Job) As String Return If(job.IsRunning, "Running", If(job.HasErrors, "Failed", "Succeeded")) ' Noncompliant End Function ``` ```vbnet Fix theme={null} Public Function GetReadableStatus(job As Job) As String If job.IsRunning Then Return "Running" Return If(job.HasErrors, "Failed", "Succeeded") End Function ```

Clear, communicative naming is important in code. It helps maintainers and API users understand the intentions for and uses of a unit of code. Using "exception" in the name of a class that does not extend Exception or one of its subclasses is a clear violation of the expectation that a class' name will indicate what it is and/or does.

```vbnet Bad theme={null} Public Class FruitException ' Noncompliant - this has nothing to do with Exception Private expected As Fruit Private unusualCharacteristics As String Private appropriateForCommercialExploitation As Boolean ' ... End Class Public Class CarException ' Noncompliant - does not derive from any Exception-based class Public Sub New(message As String, inner As Exception) ' ... End Sub End Class ``` ```vbnet Fix theme={null} Public Class FruitSport ' Compliant - class name does not end with 'Exception' Private expected As Fruit Private unusualCharacteristics As String Private appropriateForCommercialExploitation As Boolean ' ... End Class Public Class CarException Inherits Exception ' Compliant - correctly extends System.Exception Public Sub New(message As String, inner As Exception) MyBase.New(message, inner) ' ... End Sub End Class ```

For clarity, all overloads of the same method should be grouped together. That lets both users and maintainers quickly understand all the current available options.

```vbnet Bad theme={null} Interface IMyInterface Function DoTheThing() As Integer Function DoTheOtherThing() As String // Noncompliant Function DoTheThing(ByVal Path As String) As Integer End Interface ``` ```vbnet Fix theme={null} Interface IMyInterface Function DoTheThing() As Integer Function DoTheThing(ByVal Path As String) As Integer Function DoTheOtherThing() As String End Interface ```

Duplicated string literals make the process of refactoring complex and error-prone, as any change would need to be propagated on all occurrences.

```vbnet Bad theme={null} Public Class Foo Private Name As String = "foobar" ' Noncompliant Public ReadOnly Property DefaultName As String = "foobar" ' Noncompliant Public Sub New(Optional Value As String = "foobar") ' Noncompliant Dim Something = If(Value, "foobar") ' Noncompliant End Sub End Class ``` ```vbnet Fix theme={null} Public Class Foo Private Const Foobar As String = "foobar" Private Name As String = Foobar Public ReadOnly Property DefaultName As String = Foobar Public Sub New(Optional Value As String = Foobar) Dim Something = If(Value, Foobar) End Sub End Class ```

Types are declared in namespaces in order to prevent name collisions and as a way to organize them into the object hierarchy. Types that are defined outside any named namespace are in a global namespace that cannot be referenced in code.

```vbnet Bad theme={null} Public Class Foo End Class Public Structure Bar End Structure ``` ```vbnet Fix theme={null} Namespace SomeSpace Public Class Foo End Class Public Structure Bar End Structure End Namespace ```

Altering or bypassing the accessibility of classes, methods, or fields through reflection violates the encapsulation principle. This can break the internal contracts of the accessed target and lead to maintainability issues and runtime errors.

This rule raises an issue when reflection is used to change the visibility of a class, method or field, and when it is used to directly update a field value.

```vbnet Bad theme={null} Imports System.Reflection Dim dynClass = Type.GetType("MyInternalClass") ' Sensitive. Using BindingFlags.NonPublic will return non-public members Dim bindingAttr As BindingFlags = BindingFlags.NonPublic Or BindingFlags.Static Dim dynMethod As MethodInfo = dynClass.GetMethod("mymethod", bindingAttr) Dim result = dynMethod.Invoke(dynClass, Nothing) ``` ```vbnet Fix theme={null} ```

CoSetProxyBlanket and CoInitializeSecurity both work to set the permissions context in which the process invoked immediately after is executed. Calling them from within that process is useless because it’s too late at that point; the permissions context has already been set.

Specifically, these methods are meant to be called from non-managed code such as a C++ wrapper that then invokes the managed, i.e. C# or VB.NET, code.

```vbnet Bad theme={null} Public Class Noncompliant Public Shared Function CoSetProxyBlanket(pProxy As Object, dwAuthnSvc as UInt32, dwAuthzSvc As UInt32, pServerPrincName As String, dwAuthnLevel As UInt32, dwImpLevel As UInt32, pAuthInfo As IntPtr, dwCapabilities As UInt32) As Integer End Function Public Enum RpcAuthnLevel [Default] = 0 None = 1 Connect = 2 [Call] = 3 Pkt = 4 PktIntegrity = 5 PktPrivacy = 6 End Enum Public Enum RpcImpLevel [Default] = 0 Anonymous = 1 Identify = 2 Impersonate = 3 [Delegate] = 4 End Enum Public Enum EoAuthnCap None = &H00 MutualAuth = &H01 StaticCloaking = &H20 DynamicCloaking = &H40 AnyAuthority = &H80 MakeFullSIC = &H100 [Default] = &H800 SecureRefs = &H02 AccessControl = &H04 AppID = &H08 Dynamic = &H10 RequireFullSIC = &H200 AutoImpersonate = &H400 NoCustomMarshal = &H2000 DisableAAA = &H1000 End Enum Public Shared Function CoInitializeSecurity(pVoid As IntPtr, cAuthSvc As Integer, asAuthSvc As IntPtr, pReserved1 As IntPtr, level As RpcAuthnLevel, impers As RpcImpLevel, pAuthList As IntPtr, dwCapabilities As EoAuthnCap, pReserved3 As IntPtr) As Integer End Function Public Sub DoSomething() Dim Hres1 As Integer = CoSetProxyBlanket(Nothing, 0, 0, Nothing, 0, 0, IntPtr.Zero, 0) ' Noncompliant Dim Hres2 As Integer = CoInitializeSecurity(IntPtr.Zero, -1, IntPtr.Zero, IntPtr.Zero, RpcAuthnLevel.None, RpcImpLevel.Impersonate, IntPtr.Zero, EoAuthnCap.None, IntPtr.Zero) ' Noncompliant End Sub End Class ``` ```vbnet Fix theme={null} ```

Not specifying a timeout for regular expressions can lead to a Denial-of-Service attack. Pass a timeout when using System.Text.RegularExpressions to process untrusted input because a malicious user might craft a value for which the evaluation lasts excessively long.

Ask Yourself Whether

  • the input passed to the regular expression is untrusted.

  • the regular expression contains patterns vulnerable to catastrophic backtracking.

There is a risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

  • It is recommended to specify a matchTimeout when executing a regular expression.

  • Make sure regular expressions are not vulnerable to Denial-of-Service attacks by reviewing the patterns.

  • Consider using a non-backtracking algorithm by specifying RegexOptions.NonBacktracking.

```vbnet Bad theme={null} Public Sub RegexPattern(Input As String) Dim EmailPattern As New Regex(".+@.+", RegexOptions.None) Dim IsNumber as Boolean = Regex.IsMatch(Input, "[0-9]+") Dim IsLetterA as Boolean = Regex.IsMatch(Input, "(a+)+") End Sub ``` ```vbnet Fix theme={null} Public Sub RegexPattern(Input As String) Dim EmailPattern As New Regex(".+@.+", RegexOptions.None, TimeSpan.FromMilliseconds(100)) Dim IsNumber as Boolean = Regex.IsMatch(Input, "[0-9]+", RegexOptions.None, TimeSpan.FromMilliseconds(100)) Dim IsLetterA As Boolean = Regex.IsMatch(Input, "(a+)+", RegexOptions.NonBacktracking) '.Net 7 And above AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", TimeSpan.FromMilliseconds(100)) 'process-wide setting End Sub ```

ASP.NET 1.1+ comes with a feature called Request Validation, preventing the server to accept content containing un-encoded HTML. This feature comes as a first protection layer against Cross-Site Scripting (XSS) attacks and act as a simple Web Application Firewall (WAF) rejecting requests potentially containing malicious content.

While this feature is not a silver bullet to prevent all XSS attacks, it helps to catch basic ones. It will for example prevent \