Download
FAQ
Give Feedback

Free Trial

Overview
Code Quality
Metrics
Dependencies
Inventory
Rulesets
SDK
HowTo's

SharePoint Customization Analysis Framework (SPCAF)

Rulesets

All Analyzers

Minimum Settings

Minimum Recommended Settings

Extended Recommended Settings

Migration Assessment Settings

SharePoint Framework - All Rules

Angular application

Minimum Settings

These settings focus on the most critical problems in your code for which Code Analysis is the most accurate. Only analyzers from the categories Correctness, Security and Supportability are applied.

Filename: RS01_MinimumRules.spruleset

Enabled Analyzers, Categories and Rules

The following list provides an overview which rules are enabled for the current ruleset.

Farm/Sandboxed Solutions

Correctness

Fix loader errors

Declare required attribute 'SolutionId' in Solution

Define a valid GUID for attribute 'SolutionId' in Solution

Remove unused files from Solution package

Declare element 'SafeControl' for each implemented WebControl

Deploy referenced Assembly with correct version, culture and public key token

Do not set SPSite.CatchAccessDeniedException property

Do not set SPSite.ReadLocked property

Do not use SPWeb.Properties property

Do not call deprecated members

Do not implement deprecated interfaces

Do not inherit from deprecated type

Do not reference deprecated types

Remove empty Resource files

Avoid duplicate keys in Resource file

Declare required attributes in SiteDefinition

Declare element 'SiteDefinition' in Solution

Do not reference WebApplication Feature in attribute 'VisibilityFeatureDependency'

Declare required attributes in Feature

Define a valid GUID for attribute 'Id' in Feature

Remove spaces from Feature folder

Define attribute 'Title' in Feature with max. 255 characters

Do not define attribute 'ActiveOnDefault' in Feature with Scope 'Web' or 'Site'

Do not define attribute 'AutoActivateInCentralAdmin' in Feature with Scope 'Farm'

Define required attributes for Feature receiver

Define correct SolutionId in Feature

Define ReceiverAssembly in Feature correctly

Define Version in Feature correctly

Add missing assembly for 'ReceiverAssembly' in Feature

Deploy the 'ReceiverAssembly' of a Feature to GAC

Declare attribute 'Title' in Feature

Do not define Feature Id with curly brackets

Add Resources when DefaultResourceFile is declared

Declare required fields in FieldType

Do not declare field 'InternalType' in FieldTypes

Do not declare field 'SQLType' in FieldTypes

Declare field 'FieldTypeClass' in FieldType

Do not use obsolete RenderPattern in FieldTypes

Do not use PropertySchema in FieldTypes

Do not define Field in Feature with scope 'WebApplication' or 'Farm'

Add curly brackets to Field ID

Define a unique Field ID

Define Field ID as valid GUID

Declare required attributes in Field

Define Field DisplayName with max. 255 characters

Do not use deprecated attribute 'FromBaseType'

Declare all recommended attributes in Field

Do not define lower case attribute 'Id' in Field

Declare attribute 'Mult' for Type 'LookupMulti' and 'UserMulti'

Define a unique Field Name

Define a unique Field StaticName

Do not define ContentType ID longer than 1024 characters

Do not define ContentType in Feature with scope 'WebApplication' or 'Farm'

Declare required attributes in ContentType

Do not define duplicate ContentType ID

Do not define ContentType Name longer than 124 characters

Define ContentTypes ID as hexadecimal GUID

Do not declare attributes in ContentType which are reserved for internal use

Do not declare obsolete attributes in ContentType

Inherit ContentType from existing parent ContentType

Define correct parent FeatureId in ContentType

Define attribute 'Inherits' to FALSE in ContentType if RemoveFieldRef are used

Define attribute 'Inherits' to FALSE in ContentType if Custom Forms are used

Avoid XML comments inside a ContentType definition

Do not define Module in Feature with scope 'WebApplication' or 'Farm'

Add missing referenced File for Module

Declare File element in Module

Do not define ListInstance in Feature with scope 'WebApplication' or 'Farm'

Declare required attributes in ListInstance

Define unique value for attribute 'Id' in ListInstance

Deploy missing ListTemplate for ListInstance

Remove curly brackets from attribute FeatureId in ListInstance

Deploy missing ListDefinition in CustomSchema of ListInstance

Do not define ListTemplate in Feature with scope 'WebApplication' or 'Farm'

Declare required attributes in ListTemplate

Do not define ListTemplate Name with spaces

Define unique attribute 'Type' for ListTemplate

Deploy missing Image in ListTemplate

Do not deploy Taxonomy fields using ListTemplate.

Do not define ContentTypeBinding in Feature with scope 'WebApplication' or 'Farm'

Declare required attribute in CustomAction

Define unique value for 'Id' in CustomAction

Deploy missing file in UrlAction for CustomAction

Deploy missing file in ImageUrl for CustomAction

Deploy missing file in Ribbon for CustomAction

Deploy missing file in CommandUIHandler for CustomAction

Declare required attributes in CustomActionGroup

Do not define Receiver in Feature with scope 'WebApplication' or 'Farm'

Declare Scope for Receivers in Site Features

Do not define Receiver 'EmailReceived' on SiteCollection level.

Define ControlAssembly and ControlClass in DelegateControl

Deploy missing assembly from attribute ControlAssembly

Deploy missing control from attribute ControlSrc

Do not define Worfklow in Feature with scope 'Web', 'WebApplication' or 'Farm'

Declare required attributes in Workflow

Define a valid GUID for attribute 'Id' in Workflow

Do not define DocumentConveter in Feature with scope 'Web', 'Site' or 'Farm'

Declare property 'Title' in WebParts

Declare required attributes in FieldRef

Define attribute 'ID' with curly brackets in FieldRef

Define attribute 'ID' in FieldRef in correct casing

Declare required attributes in RemoveFieldRef

Do not declare ignored attributes in RemoveFieldRef

Define attribute 'ID' with curly brackets in RemoveFieldRef

Do not define TemplateAssociation in Feature with scope 'Web'

Declare required attributes in TemplateAssocation

Do not define PropertyBag in Feature with scope 'WebApplication' or 'Farm'

Declare required attributes in FeatureActivationDependency

Define optional attributes in FeatureActivationDependency correctly

Do not add ActivationDependency to hidden Feature

Do not add ActivationDependency to a Feature with a more restrictive scope

Do not add cross-scope ActivationDependency to a hidden Feature

Do not chain ActivationDependencies of Features when last Feature is visible

Do not create circular chain of FeatureActivationDependencies

Declare element 'DefaultDescription' in schema of ListTemplate

Declare required attributes in schema of ListTemplate

Deploy missing assembly for WebService (.svc)

Declare required attributes in WebTemplate

Derive WebTemplate from an existing Template

Do not declare obsolete attributes

Define Boolean attributes in upper case

Remove spaces from resource keys

Add translation for a resource key

Security

Do not update list of blocked extensions

Avoid setting 'AllowUnsafeUpdates' on SPWeb

Avoid setting 'AllowUnsafeUpdates' on SPSite

Do not call 'WindowsIdentity.Impersonate'

Do not set 'AllowEveryoneViewItems' for SPList to TRUE

Avoid usage of 'RunWithElevatedPrivileges'

Do not add PageParserPaths to web.config

Do not call 'HttpUtility.HtmlEncode'.

Do not nest calls to RunWithElevatedPrivileges

CAS Policy 'Maschine' with access='Administer' is not allowed

Policy Permission Impersonate not allowed

Do not define 'FileIOPermission' with 'Unrestricted=true'

Do not define 'RegistryPermission' with 'Unrestricted=true'

Do not define 'SecurityPermission' with 'Unrestricted=true'

Do not define 'EnvironmentPermission' with 'Unrestricted=true'

Do not define 'SmtpPermission' with 'Unrestricted=true'

Do not set 'AllowEveryoneViewItems' to TRUE in ListDefinition

Do not use inline code in ASPX pages

Add 'SharePoint:FormDigest' to ASPX page

Supportability

Do not override SharePoint system files

Do not access SharePoint API via reflection

Do not read ConnectionString from SPContentDatabase

Do not query SharePoint databases directly

Do not start Process.Start in a feature and event receiver

Do not write to the SharePoint file system

Do not modify the registry on a SharePoint system

Do not modify Farm settings via code

Do not activate Farm features via code

Do not modify WebApplication settings via code

Do not activate WebApp features via code

Office 365 Compatibility

SiteDefinition references VisibilityFeatureDependency which is not transformable

SiteDefinition references ProvisioningAssembly which is not transformable

Feature contains FeatureReceiver

Feature has scope 'WebApplication' or 'Farm' Warning

Field contains resource keys

Field based upon custom field type

Field has not ID value set

Calculated field outputs HTML encoded string

ContentType contains complex to transform event receiver code

ContentType inherits unknown parent ContentType

ContentType inherits custom parent ContentType which needs to be provisioned before

ContentType references a custom Field which needs to be provisioned before

ContentType references an unknown Field

ContentType uses DocumentTemplate

ContentType references DocumentTemplate in Layouts folder

ContentType contains resource keys

List instance contains resource keys

Field Reference has no ID value set

Custom Action contains a reference to the layouts system folder

Custom action contains resource keys

Custom Action contains a reference to the admin system folder

Performance

Avoid use of SPMonitoredScope in Render and OnInit methods

Avoid Verbose Logging/Tracing in production code

Do not retrieve SPListItemCollection inside loop

JavaScript

Correctness

No assignment in conditional statement

Consider to not use, or shim the console object

Consider to disallow Controls Characters in Regular Expressions

Consider to disallow extra boolean casts

Disallow negated left operand of 'in' operator

Disallow Global Object Function Calls

Disallow usage of NaN directly

Ensure type checks are against valid types

Assignment to function name not allowed

Do not do toString directly on method objects

Disallow use of delete on variables

Catch identifiers should be unique

Ambiguous named function expression

Export not at module level

Numeric literal causes overflow or underflow exception

Strict operator always evaluates to true or false

Array literal trailing commas has cross-browser difference

Variable or function declaration redefines the catch error name

Constant declaration already declared

Duplicate lexical declaration; cannot redefine let or const variables

High-surrogate pair value not followed by low-surrogate value

Reserved words and should not be used as an identifier

Low-surrogate pair value not preceeded by high-surrogate value

Function declaration should not be inside a statement. Cross-browser behavior difference

Reserved word used as object literal property name; cross-browser issue

Identifier already in use

Octal literals are deprecated. Possible cross-browser behavior difference

New line not allowed

Imported module does not export name

Semicolon insertion

A statement block is expected

Suspect assigment

Strict-mode does not allow certain variable names

Strict-mode does not allow certain function names

Strict-mode does not allow duplicate property names

Strict-mode does not allow assignment to certain variables

Strict-mode does not allow ++ or -- on certain objects

Strict-mode does not allow certain delete operands

Strict-mode does not allow certain argument names

Assignment to constant

String literal is not safe for inline

Strict-mode does not allow assignment to undefined variables

End of file encountered before function is properly closed

Expected ///#ENDIF directive

Expected ///#ENDDEBUG directive

Invalid numeric literal

Suspect equality comparison

Strict-mode does not allow certain catch error binding names

Binding patterns in var statements require initializer

Implicit object property name must be identifier

Setter method must have a single format argument

Rest parameter can only be last parameter

Unable to convert to binding syntax

Unable to convert from binding syntax

Invalid binding syntax

Methods not allowed in object literal bindings

Expected for or if keyword

Expected class element

Duplicate class element name

Class constructor must be regular method

Class static method cannot be named 'prototype'

Expected binding

Multiple default exports

Import statement must include module name

Duplicate module declaration

Imported module has no default export

Expected 'from'

Expected string literal

Expected specifier set

Arrow functions cannot be constructors

Application Error

No Source Error

Could not parse JavaScript code

Syntax error

Expected ':'

Expected ';' between statements

Syntax error in regular expression

Invalid character

Unterminated string constant

Unterminated comment

'return' statement outside of function

Can't have 'break' outside of loop

Can't have 'continue' outside of loop

unused label

Expected hexadecimal digit

Expected 'while'

Label redefined

Label not found

'default' can only appear once in a 'switch' statement

Expected identifier or string

Expected '@end'

Conditional compilation is turned off

Expected 'catch'

Unmatched 'else'; no 'if' defined

Expected ','

Missing 'case' or 'default' statement

Unmatched '@end'; no '@if' defined

Unmatched '@else'; no '@if' defined

Unmatched '@elif'; no '@if' defined

Expecting more source characters

Too many tokens have been skipped in the process of recovering from errors. The file may not be a JScript.NET file

Did you intend to have an empty statement for this branch of the if statement?

A variable argument list must be the last argument

Function expression expected

JSParser Exception

Resource reference must be single constant value

Conditiona compilation structure too complex

Unterminated ASP.NET block

Strict-mode does not allow with-statements

Strict-mode does not allow duplicate argument names

Design

JavaScript file uses SharePoint REST API

JavaScript file uses SPServices

JavaScript file uses SharePoint JavaScript Object Model

JavaScript file uses Microsoft Graph REST API

JavaScript file uses Microsoft Graph beta REST API

JavaScript file uses Microsoft Graph v1.0 REST API

JavaScript file uses Microsoft Graph SDK

JavaScript file uses PnP JavaScript Core Library

Coding Style

Consider following curly brace conventions

Consider refactoring, too many parameters in function definition, maximum 3

Farm/Sandboxed Solutions

Web

Number of Solution Artifacts

Site Definition Files

Security Relevant Code

GAC Assemblies

CAS Policies

RunWithElevatedPrivileges

WindowsIdentity.Impersonate

SPSite.SystemAccount

SPUtility.SendEmail

MembershipProvider Implementations

ISsoProvider Implementations

Impacting Farm Stability

Farm Features

Field Types

SPWebConfigModifications

Research and Development

Logical Lines of Code in BaseSolutionDefinition

Logical Lines of Code in BdcModelDefinition

Logical Lines of Code in ClientWebPartDefinition

Logical Lines of Code in ConfigurationDefinition

Logical Lines of Code in ContentTypeBindingDefinition

Logical Lines of Code in ContentTypeDefinition

Logical Lines of Code in CTDocumentTemplateDefinition

Logical Lines of Code in CTFieldRefDefinition

Logical Lines of Code in CustomActionDefinition

Logical Lines of Code in CustomActionGroupDefinition

Logical Lines of Code in DelegateControlDefinition

Logical Lines of Code in DocumentConverterDefinition

Logical Lines of Code in DwpFileDefinition

Logical Lines of Code in ElementFile

Logical Lines of Code in ElementManifestReference

Logical Lines of Code in FeatureActivationDependencyDefinition

Logical Lines of Code in FeatureDefinition

Logical Lines of Code in FeatureManifestReference

Logical Lines of Code in FeatureSiteTemplateAssociationDefinition

Logical Lines of Code in FieldDefinition

Logical Lines of Code in FieldRefDefinition

Logical Lines of Code in FieldRefInCTDefinition

Logical Lines of Code in FieldTypeDefinition

Logical Lines of Code in FieldTypesFieldType

Logical Lines of Code in FileDefinition

Logical Lines of Code in HideCustomActionDefinition

Logical Lines of Code in ListDefinition

Logical Lines of Code in ListInstanceDefinition

Logical Lines of Code in ListTemplateDefinition

Logical Lines of Code in ModuleDefinition

Logical Lines of Code in PermissionSetDefinition

Logical Lines of Code in PolicyItemDefinition

Logical Lines of Code in PropertyBagDefinition

Logical Lines of Code in ReceiverDefinition

Logical Lines of Code in ReceiverDefinitionCollection

Logical Lines of Code in RemoveFieldRefDefinition

Logical Lines of Code in ResourceDefinition

Logical Lines of Code in RootFileReference

Logical Lines of Code in SharedFieldDefinition

Logical Lines of Code in SharedFieldReference

Logical Lines of Code in SiteDefinition

Logical Lines of Code in SiteDefinitionManifestFileReference

Logical Lines of Code in SolutionDefinition

Logical Lines of Code in SolutionDependencyManifestReference

Logical Lines of Code in SubFieldTypeDefinition

Logical Lines of Code in TemplateFileReference

Logical Lines of Code in TemplatesTemplate

Logical Lines of Code in TemplatesTemplateConfiguration

Logical Lines of Code in UserMigratorDefinition

Logical Lines of Code in WebPartDefinition

Logical Lines of Code in WebTempFileDefinition

Logical Lines of Code in WebTemplateDefinition

Logical Lines of Code in WorkflowAssociationDefinition

Logical Lines of Code in WorkflowDefinition

XML

CSS

Farm/Sandboxed Solutions

Content Type Bindings

Workflow Associations

SharePoint Dependencies

Assembly Dependencies

Feature Dependencies

Content Type Dependencies

SharePoint Customization Analysis Framework (SPCAF), 7.15.0.0

About
Support
Feedback

Disclaimer: The views and opinions expressed in this documentation and in SPCAF do not necessarily reflect the opinions and recommendations of Microsoft or any member of Microsoft. SPCAF and RENCORE are registered trademarks of Rencore. All other trademarks, service marks, collective marks, copyrights, registered names, and marks used or cited by this documentation are the property of their respective owners.