SharePoint Code Analysis Framework (SPCAF)

SPC020201: Do not update list of blocked extensions

SPC020202: Avoid setting 'AllowUnsafeUpdates' on SPWeb

SPC020203: Avoid setting 'AllowUnsafeUpdates' on SPSite

SPC020204: Do not call 'WindowsIdentity.Impersonate'

SPC020205: Do not set 'AllowEveryoneViewItems' for SPList to TRUE

SPC020206: Avoid usage of 'RunWithElevatedPrivileges'

SPC020210: Do not add PageParserPaths to web.config

SPC020220: Do not call 'HttpUtility.HtmlEncode'.

SPC020221: Do not nest calls to RunWithElevatedPrivileges

SPC020602: CAS Policy 'Maschine' with access='Administer' is not allowed

SPC020603: Policy Permission Impersonate not allowed

SPC020611: Do not define 'FileIOPermission' with 'Unrestricted=true'

SPC020612: Do not define 'RegistryPermission' with 'Unrestricted=true'

SPC020613: Do not define 'SecurityPermission' with 'Unrestricted=true'

SPC020614: Do not define 'EnvironmentPermission' with 'Unrestricted=true'

SPC020615: Do not define 'SmtpPermission' with 'Unrestricted=true'

SPC025501: Do not set 'AllowEveryoneViewItems' to TRUE in ListDefinition

SPC026901: Do not use inline code in ASPX pages

SPC026902: Add 'SharePoint:FormDigest' to ASPX page

SPC020210: Do not add PageParserPaths to web.config

PageParserPaths can be used to enable inline code in ASPX pages which is not allowed.

TypeName:	DoNotAddPageParserPathToWebConfig
CheckId:	SPC020210
Severity:	CriticalWarning
Type:	AssemblyFileReference

Resolution

Do not add PageParserPaths to web.config via SPWebConfigModification to enable inline code in ASPX pages.

Remarks

The rule can only check the appearance of 'SPWebConfigModification' and the string 'PageParserPaths' in the same class. This can lead to false positive results.

Links

Inline Code: Technical Details

comments powered by Disqus

Copyright © 2013 RENCORE AB. All Rights Reserved

Disclaimer: The views and opinions expressed in this documentation and in SPCAF are those of the creators and do not necessarily reflect the opinions and recommendations of Microsoft or any member of Microsoft. All trademarks, service marks, collective marks, copyrights, registered names, and marks used or cited by this documentation are the property of their respective owners.

SharePoint Code Analysis Framework, Version 4.5.2.7855, see www.spcaf.com for more information