> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Vbnet
> [accordion] Invalid casts should be avoided
>
> A cast is an [explicit conversion](https://learn.microsoft.com/en-us/dotnet/visual-basic/programming-guide/language-features/data-types/implicit-and-explicit-conversions), which is a way to tell the compiler the intent to convert from one type to another.
>
> In Visual Basic, there are two explicit conversion operators:
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Sub Method(Value As Object)
> Dim i As Integer
> i = DirectCast(Value, Integer) ' Direct casting from object holding an integer type to Integer
> i = CType(Value, Integer) ' Conversion from the underlying type to Integer
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Interface IMyInterface
> End Interface
>
> Public Class Implementer
> Implements IMyInterface
> End Class
>
> Public Class AnotherClass
> End Class
>
> Module Program
> Sub Main()
> Dim Another As New AnotherClass
> Dim x As IMyInterface = DirectCast(Another, IMyInterface) ' Noncompliant: InvalidCastException is being thrown
> End Sub
> End Module
> ```
> [accordion] Return statements should be used instead of assigning values to function names
>
> Functions can return values using two different syntaxes. The modern, and correct, way to do it is to use a \`Return statement. The VB6 way, i.e. old way, is to assign a return value to the function’s name .
>
> The VB6 syntax is obsolete as it was introduced to simplify migration from VB6 projects. The compiler will create a local variable which is implicitly returned when execution exits the function’s scope.
>
> Return\` statement should be used instead as they are easier to read and understand.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Function FunctionName() As Integer
> FunctionName = 42 ' Noncompliant
> End Function
>
> Public Function FunctionNameFromVariable() As Integer
> Dim Value As Integer = 42
> FunctionNameFromVariable = Value ' Noncompliant
> End Function
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Function FunctionName() As Integer
> Return 42
> End Function
>
> Public Function FunctionNameFromVariable() As Integer
> Dim Value As Integer = 42
> Return Value
> End Function
> ```
> [accordion] Arrays should not be created for ParamArray parameters
>
> There’s no point in creating an array solely for the purpose of passing it to a ParamArray parameter. Simply pass the elements directly. They will be consolidated into an array automatically.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class SurroundingClass
> Public Sub Base()
> Method(New String() { "s1", "s2" }) ' Noncompliant: unnecessary
> Method(New String(12) {}) ' Compliant
> End Sub
>
> Public Sub Method(ParamArray args As String())
> ' Do something
> End Sub
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class SurroundingClass
> Public Sub Base()
> Method("s1", "s2")
> Method(New String(12) {})
> End Sub
>
> Public Sub Method(ParamArray args As String())
> ' Do something
> End Sub
> End Class
> ```
> [accordion] Short-circuit logic should be used in boolean contexts
>
> [Short-circuit evaluation](https://en.wikipedia.org/wiki/Short-circuit_evaluation) is an evaluation strategy for [Boolean operators](https://en.wikipedia.org/wiki/Logical_connective), that doesn’t evaluate the second argument of the operator if it is not needed to determine the result of the operation.
>
> VB.NET provides logical operators that implement short-circuiting evaluations AndAlso and OrElse, as well as the non-short-circuiting versions And and Or. Unlike short-circuiting operators, the non-short-circuiting operators evaluate both operands and afterward perform the logical operation.
>
> For example False AndAlso FunctionCall always results in False even when the FunctionCall invocation would raise an exception. In contrast, False And FunctionCall also evaluates FunctionCall, and results in an exception if FunctionCall raises an exception.
>
> Similarly, True OrElse FunctionCall always results in True, no matter what the return value of FunctionCall would be.
>
> The use of non-short-circuit logic in a boolean context is likely a mistake, one that could cause serious program errors as conditions are evaluated under the wrong circumstances.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If GetTrue() Or GetFalse() Then ' Noncompliant: both sides evaluated
> End If
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If GetTrue() OrElse GetFalse() Then ' Compliant: short-circuit logic used
> End If
> ```
> [accordion] Expressions should not be too complex
>
> Complex boolean expressions are hard to read and so to maintain.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If ((condition1 AndAlso condition2) OrElse (condition3 AndAlso condition4)) AndAlso condition5) Then 'Noncompliant
> ...
> End If
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If ((MyFirstCondition() OrElse MySecondCondition()) AndAlso MyLastCondition()) Then
> ...
> End If
> ```
> [accordion] Indexed properties should be named Item
>
> In most cases, indexed properties should be named Item for consistency. Exceptions are when there exists a name which is obviously better, for example `System.String.Chars(System.Int32)`.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Dim array = {"apple", "banana", "orange", "strawberry"}
>
> ReadOnly Property Foo(ByVal index As Integer) ' Noncompliant
> Get
> Return array(index)
> End Get
> End Property
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Dim array = {"apple", "banana", "orange", "strawberry"}
>
> ReadOnly Property Item(ByVal index As Integer)
> Get
> Return array(index)
> End Get
> End Property
> End Module
> ```
> [accordion] Loops with at most one iteration should be refactored
>
> A [loop](https://learn.microsoft.com/en-us/dotnet/visual-basic/programming-guide/language-features/control-flow/loop-structures) statement with at most one iteration is equivalent to an If statement; the following block is executed only once.
>
> If the initial intention was to conditionally execute the block only once, an If statement should be used instead. If that was not the initial intention, the block of the loop should be fixed so the block is executed multiple times.
>
> A loop statement with at most one iteration can happen when a statement unconditionally transfers control, such as a jump statement or a throw statement, is misplaced inside the loop block.
>
> This rule raises when the following statements are misplaced:
>
>
> -
> [Exit](https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/statements/exit-statement)
>
>
> -
> [Continue](https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/statements/continue-statement)
>
>
> -
> [Return](https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/statements/return-statement)
>
>
> -
> [Throw](https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/statements/throw-statement)
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Function Method(items As IEnumerable(Of Object)) As Object
> For i As Integer = 0 To 9
> Console.WriteLine(i)
> Exit For ' Noncompliant: loop only executes once
> Next
>
> For Each item As Object In items
> Return item ' Noncompliant: loop only executes once
> Next
> Return Nothing
> End Function
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Function Method(items As IEnumerable(Of Object)) As Object
> For i As Integer = 0 To 9
> Console.WriteLine(i)
> Next
>
> Dim item = items.FirstOrDefault()
> If item IsNot Nothing Then
> Return item
> End If
> Return Nothing
> End Function
> ```
> [accordion] With statements should be used for a series of calls to the same object
>
> Using the `With` statement for a series of calls to the same object makes the code more readable.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Dim product = New With {.Name = "paperclips", .RetailPrice = 1.2, .WholesalePrice = 0.6, .A = 0, .B = 0, .C = 0}
>
> Sub Main()
> product.Name = "" ' Noncompliant
> product.RetailPrice = 0
> product.WholesalePrice = 0
> product.A = 0
> product.B = 0
> product.C = 0
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Dim product = New With {.Name = "paperclips", .RetailPrice = 1.2, .WholesalePrice = 0.6, .A = 0, .B = 0, .C = 0}
>
> Sub Main()
> With product
> .Name = ""
> .RetailPrice = 0
> .WholesalePrice = 0
> .A = 0
> .B = 0
> .C = 0
> End With
> End Sub
> End Module
> ```
> [accordion] Windows Forms entry points should be marked with STAThread
>
> When an assembly uses Windows Forms (classes and interfaces from the \`System.Windows.Forms namespace) its entry point should be marked with the STAThreadAttribute to indicate that the threading model should be "Single-Threaded Apartment" (STA) which is the only one supported by Windows Forms.
>
> This rule raises an issue when the entry point (Shared Sub Main\` method) of an assembly using Windows Forms is not marked as STA.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Imports System.Windows.Forms
>
> Public Class Foo
> Shared Sub Main()
> Dim winForm As Form = New Form
> Application.Run(winForm)
> End Sub
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Imports System.Windows.Forms
>
> Public Class Foo
> Shared Sub Main()
> Dim winForm As Form = New Form
> Application.Run(winForm)
> End Sub
> End Class
> ```
> [accordion] Non-private constants should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that all non-private `Const` field names comply with the provided regular expression.
>
> The default configuration is the one recommended by Microsoft:
>
>
> -
> Pascal casing, starting with an upper case character, e.g. BackColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. GetID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. GetHtml
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Public Const foo = 0 ' Noncompliant
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Public Const Foo = 0 ' Compliant
> End Module
> ```
> [accordion] DebuggerDisplayAttribute strings should reference existing members
>
> The DebuggerDisplayAttribute is used to determine how an object is displayed in the debugger window.
>
> The DebuggerDisplayAttribute constructor takes a single mandatory argument: the string to be displayed in the value column for instances of the type. Any text within curly braces is evaluated as the name of a field or property, or any complex expression containing method calls and operators.
>
> Naming a non-existent member between curly braces will result in a BC30451 error in the debug window when debugging objects. Although there is no impact on the production code, providing a wrong value can lead to difficulties when debugging the application.
>
> This rule raises an issue when text specified between curly braces refers to members that don’t exist in the current context.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> ' Noncompliant - Name doesn't exist in this context
> Public Class Person
>
> Public Property FullName As String
>
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
>
> Public Class Person
>
> Public Property FullName As String
>
> End Class
> ```
> [accordion] Events should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that all even names match a provided regular expression.
>
> The default configuration is the one recommended by Microsoft:
>
>
> -
> Pascal casing, starting with an upper case character, e.g. BackColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. GetID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. GetHtml
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class Foo
> Event fooEvent() ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class Foo
> Event FooEvent() ' Compliant
> End Class
> ```
> [accordion] NameOf should be used
>
> Because parameter names could be changed during refactoring, they should not be spelled out literally in strings. Instead, use \`NameOf(), and the string that’s output will always be correct.
>
> This rule raises an issue when any string in the Throw\` statement is an exact match for the name of one of the method parameters.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Sub DoSomething(param As Integer, secondParam As String)
> If (param < 0)
> Throw New Exception("param") ' Noncompliant
> End If
> If secondParam is Nothing
> Throw New Exception("secondParam should be valid") ' Noncompliant
> End If
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Sub DoSomething(param As Integer, secondParam As String)
> If (param < 0)
> Throw New Exception(NameOf(param))
> End If
> If secondParam is Nothing
> Throw New Exception($"{NameOf(secondParam)} should be valid")
> End If
> End Sub
> ```
> [accordion] Thread.Sleep should not be used in tests
>
> Using Thread.Sleep in a test might introduce unpredictable and inconsistent results depending on the environment. Furthermore, it will block the [thread](https://en.wikipedia.org/wiki/Thread_\(computing\)), which means the system resources are not being fully used.
>
> ```vbnet Bad theme={"theme":"css-variables"}
>
> Public Sub SomeTest()
> Threading.Thread.Sleep(500) ' Noncompliant
> ' assertions...
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
>
> Public Async Function SomeTest() As Task
> Await Task.Delay(500)
> ' assertions...
> End Function
> ```
> [accordion] Exceptions should not be created without being thrown
>
> Creating a new `Exception` without actually throwing it is useless and is probably due to a mistake.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If x < 0 Then
> Dim ex = New ArgumentException("x must be nonnegative")
> End If
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If x < 0 Then
> Throw New ArgumentException("x must be nonnegative")
> End If
> ```
> [accordion] Value types should implement IEquatable\
>
> If you’re using a Structure, it is likely because you’re interested in performance. But by failing to implement IEquatable\ you’re loosing performance when comparisons are made because without IEquatable\, boxing and reflection are used to make comparisons.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Structure MyStruct ' Noncompliant
>
> Public Property Value As Integer
>
> End Structure
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Structure MyStruct
> Implements IEquatable(Of MyStruct)
>
> Public Property Value As Integer
>
> Public Overloads Function Equals(other As MyStruct) As Boolean Implements IEquatable(Of MyStruct).Equals
> ' ...
> End Function
>
> End Structure
> ```
> [accordion] Exit statements should not be used
>
> Other than \`Exit Select, using an Exit statement is never a good idea.
>
> Exit Do, Exit For, Exit Try, and Exit While will all result in unstructured control flow, i.e. spaghetti code.
>
> Exit Function, Exit Property, and Exit Sub are all poor, less-readable substitutes for a simple return, and if used with code that should return a value (Exit Function and in some cases Exit Property) they could result in a NullReferenceException.
>
> This rule raises an issue for all uses of Exit except Exit Select and Exit Do\` statements in loops without condition.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Sample
> Dim condition As Boolean
>
> Public Sub MySub()
> If condition Then
> Exit Sub ' Noncompliant
> End If
>
> For index = 1 To 10
> If index = 5 Then
> Exit For ' Noncompliant
> End If
> ' ...
> Next
> End Sub
> Function MyFunction() As Object
> ' ...
> MyFunction = 42
> Exit Function ' Noncompliant
> End Function
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class Sample
> Dim condition As Boolean
>
> Public Sub MySub()
> If condition Then
> Return
> End If
>
> For index = 1 To 4
> ' ...
> Next
> End Sub
> Function MyFunction() As Object
> ' ...
> Return 42
> End Function
> End Class
> ```
> [accordion] Signed types should be preferred to unsigned ones
>
> Unsigned integers have different arithmetic operators than signed ones - operators that few developers understand. Therefore, signed types should be preferred where possible.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo1 As UShort ' Noncompliant
> Dim foo2 As UInteger ' Noncompliant
> Dim foo3 As ULong ' Noncompliant
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo1 As Short
> Dim foo2 As Integer
> Dim foo3 As Long
> End Sub
> End Module
> ```
> [accordion] Unnecessary bit operations should not be performed
>
> Certain [bitwise operations](https://learn.microsoft.com/en-us/dotnet/visual-basic/programming-guide/language-features/operators-and-expressions/logical-and-bitwise-operators#bitwise-operations) are not needed and should not be performed because their results are predictable.
>
> Specifically, using And -1 with any value always results in the original value.
>
> That is because the binary representation of -1 on a [numeric data type](https://learn.microsoft.com/en-us/dotnet/visual-basic/programming-guide/language-features/data-types/numeric-data-types) supporting negative numbers, such as Integer or Long, is based on [two’s complement](https://en.wikipedia.org/wiki/Two%27s_complement) and made of all 1s: \&B111…111.
>
> Performing And between a value and \&B111…111 means applying the And operator to each bit of the value and the bit 1, resulting in a value equal to the provided one, bit by bit.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> anyValue And -1 ' Noncompliant
> anyValue ' Compliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> anyValue Or 0 ' Noncompliant
> anyValue ' Compliant
> ```
> [accordion] ToString() method should not return Nothing
>
> Calling [ToString()](https://learn.microsoft.com/en-us/dotnet/api/system.object.tostring) on an object should always return a string. Thus, overriding the ToString method should never return Nothing because it breaks the method’s implicit contract, and as a result the consumer’s expectations.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Overrides Function ToString() As String
> Return Nothing ' Noncompliant
> End Function
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Overrides Function ToString() As String
> Return ""
> End Function
> ```
> [accordion] Non-private Shared ReadOnly fields should comply with a naming convention
>
> Shared naming conventions allow teams to collaborate efficiently. This rule checks that all non-private `Shared ReadOnly` fields names match a provided regular expression.
>
> The default configuration is:
>
>
> -
> Pascal casing, starting with an upper case character, e.g. BackColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. GetID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. GetHtml
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class Foo
> Public Shared ReadOnly foo As Integer ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class Foo
> Public Shared ReadOnly Foo As Integer ' Compliant
> End Class
> ```
> [accordion] Right operands of shift operators should be integers
>
> Numbers can be shifted with the \<[\[/code> and \ and \)> [operators](https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/operators/bit-shift-operators), but the right operand of the operation needs to be an int or a type that has an [implicit conversion](https://learn.microsoft.com/en-us/dotnet/visual-basic/programming-guide/language-features/data-types/implicit-and-explicit-conversions) to int. However, when the left operand is an object, the compiler’s type checking is turned off, therfore you can pass anything to the right of a shift operator and have it compile. If the argument can’t be implicitly converted to int at runtime, a [RuntimeBinderException](https://learn.microsoft.com/en-us/dotnet/api/microsoft.csharp.runtimebinder.runtimebinderexception) will be raised.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim o As Object = 5
> Dim x As Integer = 5
>
> x = o >> 5 ' Noncompliant
> x = x << o ' Noncompliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> x = Nothing >> 5
> x = 5 << Nothing
> ```
> [accordion] Identical expressions should not be used on both sides of a binary operator
>
> Using the same value on either side of a binary operator is almost always a mistake. In the case of logical operators, it is either a copy/paste error and therefore a bug, or it is simply wasted code, and should be simplified. In the case of most binary mathematical operators, having the same value on both sides of an operator yields predictable results, and should be simplified.
>
> This rule ignores `*, +, &, <<, and >>`.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If (a = a) Then
> doZ()
> End If
>
> If a = b OrElse a = b Then
> doW()
> End If
>
> Dim j = 5 / 5
> j = 5 \ 5
> j = 5 Mod 5
> Dim k = 5 - 5
>
> Dim i = 42
> i /= i
> i -= i
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Array literals should be used instead of array creation expressions
>
> Array literals are more compact than array creation expressions.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo = New String() {"a", "b", "c"} ' Noncompliant
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo = {"a", "b", "c"} ' Compliant
> End Sub
> End Module
> ```
> [accordion] IIf should not be used
>
> Visual Basic .NET offers a non-short-circuit conditional function, \`IIf(), which returns either its second or third parameter based on the expression in the first parameter. Using it is slower than using If() because each parameter is unconditionally evaluated. Further, its use can lead to runtime exceptions because IIf always evaluates all three of its arguments.
>
> The newer version, If()\`, should be used instead because it short-circuits the evaluation of its parameters.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Foo
> Public Sub Bar()
> Dim var As Object = IIf(Date.Now.Year = 1999, "Lets party!", "Lets party like it is 1999!") ' Noncompliant
> End Sub
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class Foo
> Public Sub Bar()
> Dim var As String = If(Date.Now.Year = 1999, "Lets party!", "Lets party like it is 1999!")
> End Sub
> End Class
> ```
> [accordion] Related If/ElseIf statements should not have the same condition
>
> A chain of [If/ElseIf](https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/statements/if-then-else-statement) statements is evaluated from top to bottom. At most, only one branch will be executed: the first statement with a condition that evaluates to True.
> Therefore, duplicating a condition leads to unreachable code inside the duplicated condition block. Usually, this is due to a copy/paste error.
>
> The result of such duplication can lead to unreachable code or even to unexpected behavior.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If param = 1 Then
> OpenWindow()
> ElseIf param = 2 Then
> CloseWindow()
> ElseIf param = 1 Then ' Noncompliant: condition has already been checked
> MoveWindowToTheBackground() ' unreachable code
> End If
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If param = 1 Then
> OpenWindow()
> ElseIf param = 2 Then
> CloseWindow()
> ElseIf param = 3 Then
> MoveWindowToTheBackground()
> End If
> ```
> [accordion] Non-existent operators like =+ should not be used
>
> Using operator pairs (`=+ or =-) that look like reversed single operators (+= or -=`) is confusing. They compile and run but do not produce the same result as their mirrored counterpart.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim target As Integer = -5
> Dim num As Integer = 3
>
> target =- num ' Noncompliant: target = -3. Is that the intended behavior?
> target =+ num ' Noncompliant: target = 3
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Dim num As Integer = 3
>
> target -= num ' target = -8
> ```
> [accordion] Method parameters should follow a naming convention
>
> Sharing some naming conventions is a key point to make it possible for a team to efficiently collaborate.
>
> This rule allows to check that all parameter names match a provided regular expression.
>
> The default configuration is the one recommended by Microsoft:
>
>
> -
> Camel casing, starting with a lower case character, e.g. backColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized only when not at the beginning, e.g. id, productID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. html
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub GetSomething(ByVal ID As Integer) ' Noncompliant
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub GetSomething(ByVal id As Integer) ' Compliant
> End Sub
> End Module
> ```
> [accordion] Collection sizes and array length comparisons should make sense
>
> The size of a collection and the length of an array are always greater than or equal to zero. Testing it doesn’t make sense, since the result is always `true`.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If Collection.Count >= 0 Then ... 'Noncompliant always true
>
> If array.Length >= 0 Then ... 'Noncompliant always true
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If Enumerable.Count < 0 Then ... 'Noncompliant always false
>
> Dim result As Boolean = Array.Length >= 0 'Noncompliant always true
> ```
> [accordion] CType should be used for casting and explicit conversions
>
> For the sake of backward compatibility, Visual Basic .NET continues to offer a set of functions that convert from Object to different primitive types: `CChar, CStr, CBool, CDate, CSng, CDbl, CDec, CByte, CSByte, CShort, CUShort, CInt, CUInt, CLng, CULng. However, using these functions is misleading, because it suggests a cast. It is better to cast explicitly using CType(), or use Convert.To()` when the value should be converted.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Foo
> Public Sub Bar(value as Object)
> Dim stringValue As String = CStr(value)
> End Sub
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class Foo
> Public Sub Bar(value as Object)
> Dim stringValue As String = CType(value, String)
> End Sub
> End Class
> ```
> [accordion] Method parameters and caught exceptions should not be reassigned
>
> While it is technically correct to assign to parameters from within method bodies, doing so before the parameter value is read is likely a bug. Instead, initial values of parameters should be, if not treated as `readonly` then at least read before reassignment.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Foo(ByVal a As Integer)
> a = 42 ' Noncompliant
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Foo(ByVal a As Integer)
> Dim tmp = a
> tmp = 42
> End Sub
> End Module
> ```
> [accordion] If ... ElseIf constructs should end with Else clauses
>
> This rule applies whenever an \`If statement is followed by one or more ElseIf statements; the final ElseIf should be followed by an Else statement.
>
> The requirement for a final Else statement is defensive programming.
>
> The Else statement should either take appropriate action or contain a suitable comment as to why no action is taken. This is consistent with the requirement to have a final Case Else clause in a Select Case\` statement.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If x = 0 Then
> DoSomething()
> ElseIf x = 1 Then
> DoSomethingElse()
> End If
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If x = 0 Then
> DoSomething()
> ElseIf x = 1 Then
> DoSomethingElse()
> Else
> Throw New ArgumentException("...")
> End If
> ```
> [accordion] ByVal should not be used
>
> Since Visual Studio 2010 SP1, the `ByVal` parameter modifier is implicitly applied, and therefore not required anymore. Removing it from your source code will improve readability.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Sub Foo(ByVal bar As String)
> ' ...
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Sub Foo(bar As String)
> ' ...
> End Sub
> ```
> [accordion] Event handlers should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that all even handler names match a provided regular expression.
>
> The default configuration is:
>
>
> -
> Either in Pascal case, i.e. starting with an upper case letter, e.g. OnMyButtonClicked
>
>
> -
> Or, a subject, in Pascal or camel case, followed by an underscore followed by an event name, in Pascal case, e.g. btn1\_Clicked
>
>
>
> Event handlers with a `handles clause and two-parameter methods with EventArgs` second parameter are covered by this rule.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub subject__SomeEvent() Handles X.SomeEvent ' Noncompliant - two underscores
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub subject_SomeEvent() Handles X.SomeEvent ' Compliant
> End Sub
> End Module
> ```
> [accordion] The & operator should be used to concatenate strings
>
> Consistently using the \`& operator for string concatenation make the developer intentions clear.
>
> &, unlike +, will convert its operands to strings and perform an actual concatenation.
>
> +\` on the other hand can be an addition, or a concatenation, depending on the operand types.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Console.WriteLine("1" + 2) ' Noncompliant - will display "3"
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Console.WriteLine(1 & 2) ' Compliant - will display "12"
> Console.WriteLine(1 + 2) ' Compliant - but will display "3"
> Console.WriteLine("1" & 2) ' Compliant - will display "12"
> End Sub
> End Module
> ```
> [accordion] Enumeration types should comply with a naming convention
>
> Shared naming conventions allow teams to collaborate efficiently. This rule checks that all enum names match a provided regular expression.
>
> The default configuration is the one recommended by Microsoft:
>
>
> -
> Pascal casing, starting with an upper case character, e.g. BackColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. GetID
>
>
> -
> Longer abbreviations need to be lower case, e.g. GetHtml
>
>
> -
> If the enum is marked as \[Flags] then its name should be plural (e.g. MyOptions), otherwise, names should be singular (e.g. MyOption)
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Enum foo ' Noncompliant
> FooValue = 0
> End Enum
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
>
> Public Enum Option ' Noncompliant
> None = 0,
> Option1 = 1,
> Option2 = 2
> End Enum
> ```
> [accordion] Extension methods should not extend Object
>
> Creating an extension method that extends `Object is not recommended because it makes the method available on every type. Extensions should be applied at the most specialized level possible, and that is very unlikely to be Object`.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Imports System.Runtime.CompilerServices
>
> Module MyExtensions
>
> Sub SomeExtension(obj As Object) ' Noncompliant
> ' ...
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Flags enumerations zero-value members should be named None
>
> An enumeration can be decorated with the [FlagsAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.flagsattribute) to indicate that it can be used as a [bit field](https://en.wikipedia.org/wiki/Bit_field): a set of flags, that can be independently set and reset.
>
> For example, the following definition of the day of the week:
>
> ```vbnet Bad theme={"theme":"css-variables"}
>
> Enum Days
> Monday = 1 ' 0b00000001
> Tuesday = 2 ' 0b00000010
> Wednesday = 4 ' 0b00000100
> Thursday = 8 ' 0b00001000
> Friday = 16 ' 0b00010000
> Saturday = 32 ' 0b00100000
> Sunday = 64 ' 0b01000000
> End Enum
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
>
> Enum Days
> ' ...
> None = 0 ' 0b00000000
> Weekdays = Monday Or Tuesday Or Wednesday Or Thursday Or Friday ' 0b00011111
> Weekend = Saturday Or Sunday ' 0b01100000
> All = Weekdays Or Weekend ' 0b01111111
> End Enum
> ```
> [accordion] Not boolean operator should not be repeated
>
> The repetition of the `Not` operator is usually a typo. The second operator invalidates the first one:
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim b As Boolean = False
> Dim c As Boolean = Not Not b 'Noncompliant: equivalent to "b"
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] StringBuilder data should be used
>
> StringBuilder instances that never build a string clutter the code and worse are a drag on performance. Either they should be removed, or the missing ToString() call should be added.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Sub DoSomething(ByVal strings As List(Of String))
> Dim sb As StringBuilder = New StringBuilder() ' Noncompliant
> sb.Append("Got: ")
>
> For Each str As String In strings
> sb.Append(str).Append(", ")
> Next
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Sub DoSomething(ByVal strings As List(Of String))
> For Each str As String In strings
> Next
> End Sub
> ```
> [accordion] Line continuations should not be used
>
> To improve the code readability, the explicit line continuation character, `_`, should not be used. Instead, it is better to break lines after an operator.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> ' Noncompliant
> Console.WriteLine("Hello" _
> & "world")
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
>
> Console.WriteLine("Hello" &
> "world")
> End Sub
> End Module
> ```
> [accordion] Control flow statements If, For, For Each, Do, While, Select and Try should not be nested too deeply
>
> Nested control flow statements `If, Select, For, For Each, While, Do, and Try` are often key ingredients in creating
> what’s known as "Spaghetti code". This code smell can make your program difficult to understand and maintain.
>
> When numerous control structures are placed inside one another, the code becomes a tangled, complex web.
> This significantly reduces the code’s readability and maintainability, and it also complicates the testing process.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If condition1 ' Compliant - depth = 1
> ' ...
> If condition2 ' Compliant - depth = 2
> ' ...
> For i = 0 to 10 ' Compliant - depth = 3, not exceeding the limit
> ' ...
> If condition4 ' Noncompliant - depth = 4
> If condition5 ' Depth = 5, exceeding the limit, but issues are only reported on depth = 4
> ' ...
> End If
> Return
> End If
> Next
> End If
> End If
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Type inheritance should not be recursive
>
> [Recursion](https://en.wikipedia.org/wiki/Recursion) is a technique used to define a problem in terms of the problem itself, usually in terms of a simpler version of the problem itself.
>
> For example, the implementation of the generator for the n-th value of the [Fibonacci sequence](https://en.wikipedia.org/wiki/Fibonacci_sequence) comes naturally from its mathematical definition, when recursion is used:
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Function NthFibonacciNumber(ByVal n As Integer) As Integer
> If n <= 1 Then
> Return 1
> Else
> Return NthFibonacciNumber(n - 1) + NthFibonacciNumber(n - 2)
> End If
> End Function
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Function NthFibonacciNumber(ByVal n As Integer) As Integer
> Dim previous As Integer = 0
> Dim last As Integer = 1
>
> For i = 0 To n - 1
> Dim temp = previous
> previous = last
> last = last + temp
> Next
>
> Return last
> End Function
> ```
> [accordion] catch clauses should do more than rethrow
>
> A Catch clause that only rethrows the caught exception has the same effect as omitting the Catch altogether and letting it bubble up automatically.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim s As String = ""
> Try
> s = File.ReadAllText(fileName)
> Catch e As Exception
> Throw
> End Try
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Dim s As String = File.ReadAllText(fileName)
> ```
> [accordion] Private Shared ReadOnly fields should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that all \`Private Shared ReadOnly field names comply with the provided regular expression.
>
> The default configuration is:
>
>
> -
> Optionally, can start with an underscore character or "s\_", e.g. \_foo, s\_foo\`
>
>
> -
> Camel casing, starting with a lower case character, e.g. backColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized only when not at the beginning, e.g. "id" in productID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. html
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class Foo
> Private Shared ReadOnly Foo As Integer ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class Foo
> Private Shared ReadOnly foo As Integer ' Compliant
> End Class
> ```
> [accordion] Empty nullable value should not be accessed
>
> [Nullable value types](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1) can hold either a value or Nothing.
>
> The value stored in the nullable type can be accessed with the Value property or by casting it to the underlying type. Still, both operations throw an InvalidOperationException when the value is Nothing. A nullable type should always be tested before accessing the value to avoid raising exceptions.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Sub Sample(condition As Boolean)
> Dim nullableValue As Integer? = If(condition, 42, Nothing)
> Console.WriteLine(nullableValue.Value) ' Noncompliant: InvalidOperationException is raised
>
> Dim nullableCast As Integer? = If(condition, 42, Nothing)
> Console.WriteLine(CType(nullableCast, Integer)) ' Noncompliant: InvalidOperationException is raised
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Sub Sample(condition As Boolean)
> Dim nullableValue As Integer? = If(condition, 42, Nothing)
> If nullableValue.HasValue Then
> Console.WriteLine(nullableValue.Value)
> End If
>
> Dim nullableCast As Integer? = If(condition, 42, Nothing)
> If nullableCast.HasValue Then
> Console.WriteLine(CType(nullableCast, Integer))
> End If
> End Sub
> ```
> [accordion] General or reserved exceptions should never be thrown
>
> Throwing general exceptions such as \`Exception, SystemException and ApplicationException will have a negative impact on any code trying to catch these exceptions.
>
> From a consumer perspective, it is generally a best practice to only catch exceptions you intend to handle. Other exceptions should ideally not be caught and let to propagate up the stack trace so that they can be dealt with appropriately. When a generic exception is thrown, it forces consumers to catch exceptions they do not intend to handle, which they then have to re-throw.
>
> Besides, when working with a generic type of exception, the only way to distinguish between multiple exceptions is to check their message, which is error-prone and difficult to maintain. Legitimate exceptions may be unintentionally silenced and errors may be hidden.
>
> For instance, if an exception such as StackOverflowException is caught and not re-thrown, it may prevent the program from terminating gracefully.
>
> When throwing an exception, it is therefore recommended to throw the most specific exception possible so that it can be handled intentionally by consumers.
>
> Additionally, some reserved exceptions should not be thrown manually. Exceptions such as IndexOutOfRangeException, NullReferenceException, OutOfMemoryException or ExecutionEngineException\` will be thrown automatically by the runtime when the corresponding error occurs. Many of them indicate serious errors, which the application may not be able to recover from. It is therefore recommended to avoid throwing them as well as using them as base classes.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Sub DoSomething(obj As Object)
> If obj Is Nothing Then
> ' Noncompliant
> Throw New NullReferenceException("obj") ' Noncompliant: This reserved exception should not be thrown manually
> End If
> ' ...
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Sub DoSomething(obj As Object)
> If obj Is Nothing Then
> Throw New ArgumentNullException("obj") ' Compliant: this is a specific and non-reserved exception type
> End If
> ' ...
> End Sub
> ```
> [accordion] Properties should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that property names match a provided regular expression.
>
> The default configuration is the one recommended by Microsoft:
>
>
> -
> Pascal casing, starting with an upper case character, e.g. BackColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. GetID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. GetHtml
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Public Property foo As Integer ' Noncompliant
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Public Property Foo As Integer ' Compliant
> End Module
> ```
> [accordion] Property procedures should access the expected fields
>
> Properties provide a way to enforce [encapsulation](https://en.wikipedia.org/wiki/Encapsulation_\(computer_programming\)) by providing property procedures that give controlled access to Private fields. However, in classes with multiple fields, it is not unusual that [copy-and-paste](https://en.wikipedia.org/wiki/Copy-and-paste_programming) is used to quickly create the needed properties, which can result in the wrong field being accessed by the property procedures.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class C
> Private _x As Integer
> Private _Y As Integer
>
> Public ReadOnly Property Y As Integer
> Get
> Return _x ' Noncompliant: The returned field should be '_y'
> End Get
> End Property
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class Sample
>
> Private _x As Integer
> Private _y As Integer
>
> Public Property Y As Integer
> Get
> Return _x ' Noncompliant: field '_y' is not used in the return value
> End Get
> Set(value As Integer)
> _x = value ' Noncompliant: field '_y' is not updated
> End Set
> End Property
>
> End Class
> ```
> [accordion] End statements should not be used
>
> `End statements exit the control flow of the program in an unstructured way. This statement stops code execution immediately without executing Dispose or Finalize methods, or executing Finally` blocks. Therefore, it should be avoided.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Print(ByVal str As String)
> Try
> ...
> End ' Noncompliant
> Finally
> ' do something important here
> ...
> End Try
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Non-private fields should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that all non-private fields names match a provided regular expression.
>
> Note that this rule does not apply to non-private `Shared ReadOnly` fields, for which there is another rule.
>
> The default configuration is:
>
>
> -
> Pascal casing, starting with an upper case character, e.g. BackColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. GetID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. GetHtml
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class Foo
> Public foo As Integer ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class Foo
> Public Foo As Integer ' Compliant
> End Class
> ```
> [accordion] IndexOf checks should not be for positive numbers
>
> Most checks against an [IndexOf](https://learn.microsoft.com/en-us/dotnet/api/system.string.indexof) value compare it with -1 because **0 is a valid index**.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> strings.IndexOf(someString) = -1 ' Test for "index not found"
> strings.IndexOf(someString) < 0 ' Test for "index not found"
> strings.IndexOf(someString) >= 0 ' Test for "index found"
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> strings.Contains(someString) ' Boolean result
> ```
> [accordion] Select Case statements should not have too many Case clauses
>
> When [Select Case](https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/statements/select-case-statement) statements have large sets of case clauses, it is usually an attempt to map two sets of data. A [Dictionary](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.dictionary-2) should be used instead to make the code more readable and maintainable.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class TooManyCase
>
> Public Function MapValues(Ch As Char) As Integer
> Select Case Ch ' Noncompliant: 5 cases, "Case Else" excluded, more than maximum = 4
> Case "a"c
> Return 1
> Case "b"c, "c"c
> Return 2
> Case "d"c
> Return 3
> Case "e"c
> Return 4
> Case "f"c, "g"c, "h"c
> Return 5
> Case Else
> Return 6
> End Select
> End Function
>
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class TooManyCase
>
> Private fMatching As New Dictionary(Of Char, Integer) From {
> { "a"c, 1 },
> { "b"c, 2 },
> { "c"c, 2 },
> { "d"c, 3 },
> { "e"c, 4 },
> { "f"c, 5 },
> { "g"c, 5 },
> { "h"c, 5 },
> }
>
> Public Function MapValues(Ch As Char) As Integer
> Dim Value As Integer
> If fMatching.TryGetValue(Ch, Value) Then
> Return Value
> Else
> Return 6
> End If
> End Function
>
> End Class
> ```
> [accordion] GoTo statements should not be used
>
> `GoTo is an unstructured control flow statement. It makes code less readable and maintainable. Structured control flow statements such as If, For, While, or Exit` should be used instead.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Sub GoToStatementDemo()
> Dim number As Integer = 1
> Dim sampleString As String
> ' Evaluate number and branch to appropriate label.
> If number = 1 Then GoTo Line1 Else GoTo Line2
> Line1:
> sampleString = "Number equals 1"
> GoTo LastLine
> Line2:
> ' The following statement never gets executed because number = 1.
> sampleString = "Number equals 2"
> LastLine:
> ' Write "Number equals 1" in the Debug window.
> Debug.WriteLine(sampleString)
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Sub GoToStatementDemo()
> Dim number As Integer = 1
> Dim sampleString As String
> ' Evaluate number and branch to appropriate label.
> If number = 1 Then
> sampleString = "Number equals 1"
> Else
> sampleString = "Number equals 2"
> End If
> Debug.WriteLine(sampleString)
> End Sub
> ```
> [accordion] Private constants should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that all \`Private Const field names comply with the provided regular expression.
>
> The default configuration is:
>
>
> -
> Optionally, can start with an underscore character or "s\_", e.g. \_foo, s\_foo\`
>
>
> -
> Camel casing, starting with a lower case character, e.g. backColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized only when not at the beginning, e.g. "id" in productID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. html
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Private Const Foo = 0 ' Noncompliant
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Private Const foo = 0 ' Compliant
> End Module
> ```
> [accordion] Multiple variables should not be declared on the same line
>
> Declaring multiple variable on one line is difficult to read.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Public Const AAA As Integer = 5, BBB = 42, CCC As String = "foo" ' Noncompliant
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Public Const AAA As Integer = 5
> Public Const BBB = 42
> Public Const CCC as String = "foo"
> End Module
> ```
> [accordion] Any() should be used to test for emptiness
>
> Using .Count() to test for emptiness works, but using .Any() makes the intent clearer, and the code more readable. However, there are some cases where special attention should be paid:
>
>
> -
> if the collection is an EntityFramework or other ORM query, calling .Count() will cause executing a potentially massive SQL query and could put a large overhead on the application database. Calling .Any() will also connect to the database, but will generate much more efficient SQL.
>
>
> -
> if the collection is part of a LINQ query that contains .Select() statements that create objects, a large amount of memory could be unnecessarily allocated. Calling .Any() will be much more efficient because it will execute fewer iterations of the enumerable.
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Private Function HasContent(Strings As IEnumerable(Of String)) As Boolean
> Return Strings.Count() > 0 ' Noncompliant
> End Function
>
> Private Function HasContent2(Strings As IEnumerable(Of String)) As Boolean
> Return Strings.Count() >= 1 ' Noncompliant
> End Function
>
> Private Function IsEmpty(Strings As IEnumerable(Of String)) As Boolean
> Return Strings.Count() = 0 ' Noncompliant
> End Function
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Private Function HasContent(Strings As IEnumerable(Of String)) As Boolean
> Return Strings.Any
> End Function
>
> Private Function HasContent2(Strings As IEnumerable(Of String)) As Boolean
> Return Strings.Any
> End Function
>
> Private Function IsEmpty(Strings As IEnumerable(Of String)) As Boolean
> Return Not Strings.Any
> End Function
> ```
> [accordion] Select...Case clauses should not have too many lines of code
>
> The `Select...Case` statement should be used only to clearly define some new branches in the control flow. As soon as a case clause contains too many statements this highly decreases the readability of the overall control flow statement. In such case, the content of the case clause should be extracted into a dedicated procedure.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Select Case number
> Case 1 To 5 ' Noncompliant: 4 statements in the case
> MethodCall1("")
> MethodCall2("")
> MethodCall3("")
> MethodCall4("")
> Case Else
> ' ...
> End Select
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Select Case number
> Case 1 To 5
> DoSomething()
> Case Else
> ' ...
> End Select
> ...
> Sub DoSomething()
> MethodCall1("")
> MethodCall2("")
> MethodCall3("")
> MethodCall4("")
> End Sub
> ```
> [accordion] Functions and procedures should comply with a naming convention
>
> Shared naming conventions allow teams to collaborate efficiently. This rule checks that all subroutine and function names match a provided regular expression.
>
> The default configuration is the one recommended by Microsoft:
>
>
> -
> Pascal casing, starting with an upper case character, e.g. BackColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. GetID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. GetHtml
>
>
> -
> Event handlers with a handles clause and two-parameter methods with `EventArgs` second parameter are not covered by this rule.
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub bad_subroutine() ' Noncompliant
> End Sub
>
> Public Function Bad_Function() As Integer ' Noncompliant
> Return 42
> End Function
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub GoodSubroutine() ' Compliant
> End Sub
>
> Public Function GoodFunction() As Integer ' Compliant
> Return 42
> End Function
> End Module
> ```
> [accordion] All branches in a conditional structure should not have exactly the same implementation
>
> Having all branches of a Select Case or If chain with the same implementation indicates a problem.
>
> In the following code:
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim b As Integer = If(a > 12, 4, 4) // Noncompliant
>
> If b = 0 Then // Noncompliant
> DoTheThing()
> Else
> DoTheThing()
> End If
>
> Select Case i // Noncompliant
> Case 1
> DoSomething()
> Case 2
> DoSomething()
> Case 3
> DoSomething()
> Case Else
> DoSomething()
> End Select
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If b = 0 Then ' No issue, this could have been done on purpose to make the code more readable
> DoTheThing()
> ElseIf
> DoTheThing()
> End If
> ```
> [accordion] Interface names should comply with a naming convention
>
> Sharing some naming conventions is a key point to make it possible for a team to efficiently collaborate.
>
> This rule allows to check that all interface names match a provided regular expression.
>
> The default configuration is the one recommended by Microsoft:
>
>
> -
> Must start with an upper case 'I' character, e.g. IFoo
>
>
> -
> Followed by Pascal casing, starting with an upper case character, e.g. IEnumerable
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. IFooID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. IFooHtml
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Interface Foo ' Noncompliant
> End Interface
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Interface IFoo ' Compliant
> End Interface
> ```
> [accordion] Do loops should not be used without a While or Until condition
>
> A `Do ... Loop without a While or Until condition must be terminated by an unstructured Exit Do` statement. It is safer and more readable to use structured loops instead.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim i = 1
>
> Do ' Non-Compliant
> If i = 10 Then
> Exit Do
> End If
>
> Console.WriteLine(i)
>
> i = i + 1
> Loop
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> For i = 1 To 9 ' Compliant
> Console.WriteLine(i)
> Next
> End Sub
> End Module
> ```
> [accordion] Generic type parameter names should comply with a naming convention
>
> Inconsistent naming conventions can lead to confusion and errors when working in a team. This rule ensures that all generic type parameter names follow a consistent naming convention by checking them against a provided regular expression.
>
> The default configuration follows Microsoft’s recommended convention:
>
>
> -
> Generic type parameter names must start with an upper case 'T', e.g. T
>
>
> -
> The rest of the name should use Pascal casing, starting with an upper case character, e.g. TKey
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. TFooID
>
>
> -
> Longer abbreviations should be lowercased, e.g. TFooHtml
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Foo(Of tkey) ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class Foo(Of TKey) ' Compliant
> End Class
> ```
> [accordion] Arguments of public methods should be validated against Nothing
>
> Methods declared as Public, Protected, or Protected Friend can be accessed from other assemblies, which means you should validate parameters to be within the expected constraints. In general, checking against Nothing is recommended in defensive programming.
>
> This rule raises an issue when a parameter of a publicly accessible method is not validated against Nothing before being dereferenced.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Sample
>
> Public Property Message As String
>
> Public Sub PublicMethod(Arg As Exception)
> Message = Arg.Message ' Noncompliant
> End Sub
>
> Protected Sub ProtectedMethod(Arg As Exception)
> Message = Arg.Message ' Noncompliant
> End Sub
>
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class Sample
>
> Public Property Message As String
>
> Public Sub PublicMethod(Arg As Exception)
> If Arg IsNot Nothing Then Message = Arg.Message ' Noncompliant
> End Sub
>
> Protected Sub ProtectedMethod(Arg As Exception)
> ArgumentNullException.ThrowIfNull(Arg)
> Message = Arg.Message ' Noncompliant
> End Sub
>
> Private Sub PrivateMethod(Arg As Exception)
> Message = Arg.Message ' Compliant: method is not publicly accessible
> End Sub
>
> End Class
> ```
> [accordion] Null checks should not be used with TypeOf Is
>
> There’s no need to null test in conjunction with an `TypeOf ... Is test. Nothing` is not an instance of anything, so a null check is redundant.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If (x IsNot Nothing And TypeOf x Is MyClass)
> ' ...
> End If
>
> If (x Is Nothing Or TypeOf x IsNot MyClass)
> ' ...
> End If
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If (TypeOf x Is MyClass)
> ' ...
> End If
>
> If (TypeOf x IsNot MyClass)
> ' ...
> End If
> ```
> [accordion] Classes should not be empty
>
> There is no good excuse for an empty class. If it’s being used simply as a common extension point, it should be replaced with an `Interface`. If it was stubbed in as a placeholder for future development it should be fleshed-out. In any other case, it should be eliminated.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Empty ' Noncompliant
>
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Interface IEmpty
>
> End Interface
> ```
> [accordion] Exit Select statements should not be used redundantly
>
> Visual Basic .NET, unlike many other programming languages, has no "fall-through" for its `Select cases. Each case already has an implicit Exit Select` as its last instruction. It therefore is redundant to explicitly add one.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim x = 0
> Select Case x
> Case 0
> Console.WriteLine("0")
> Exit Select ' Noncompliant
> Case Else
> Console.WriteLine("Not 0")
> Exit Select ' Noncompliant
> End Select
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim x = 0
> Select Case x
> Case 0 ' Compliant
> Console.WriteLine("0")
> Case Else ' Compliant
> Console.WriteLine("Not 0")
> End Select
> End Sub
> End Module
> ```
> [accordion] Indexed properties with more than one parameter should not be used
>
> Indexed properties are meant to represent access to a logical collection. When multiple parameters are required, this design guideline may be violated, and refactoring the property into a method is preferable.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> ReadOnly Property Sum(ByVal a As Integer, ByVal b As Integer) ' Noncompliant
> Get
> Return a + b
> End Get
> End Property
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Function Sum(ByVal a As Integer, ByVal b As Integer) ' Compliant
> Return a + b
> End Function
> End Module
> ```
> [accordion] Enumeration values should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that all enumeration value names match a provided regular expression.
>
> The default configuration is the one recommended by Microsoft:
>
>
> -
> Pascal casing, starting with an upper case character, e.g. BackColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. GetID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. GetHtml
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Enum Foo
> fooValue ' Noncompliant
> End Enum
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Enum Foo
> FooValue ' Compliant
> End Enum
> ```
> [accordion] IsNot should be used instead of Not ... Is ...
>
> The `... IsNot ... syntax is more compact and more readable than the Not ... Is ...` syntax.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim a = Not "a" Is Nothing ' Noncompliant
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim a = "a" IsNot Nothing ' Compliant
> End Sub
> End Module
> ```
> [accordion] On Error statements should not be used
>
> Prefer the use of \`Try ... Catch blocks instead of On Error statements.
>
> Visual Basic .NET and Visual Basic 2005 offer structured exception handling that provides a powerful, more readable alternative to the On Error Goto error handling from previous versions of Microsoft Visual Basic. Structured exception handling is more powerful because it allows you to nest error handlers inside other error handlers within the same procedure. Furthermore, structured exception handling uses a block syntax similar to the If...Else...End If\` statement. This makes Visual Basic .NET and Visual Basic 2005 code more readable and easier to maintain.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Sub DivideByZero()
> On Error GoTo nextstep
> Dim result As Integer
> Dim num As Integer
> num = 100
> result = num / 0
> nextstep:
> System.Console.WriteLine("Error")
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Sub DivideByZero()
> Try
> Dim result As Integer
> Dim num As Integer
> num = 100
> result = num / 0
> Catch
> System.Console.WriteLine("Error")
> End Try
> End Sub
> ```
> [accordion] Private fields should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that all \`Private field names match the provided regular expression.
>
> Note that this rule does not apply to Private Shared ReadOnly fields, which are checked by another rule.
>
> The default configuration is:
>
>
> -
> Optionally, can start with an underscore character or "s\_", e.g. \_foo, s\_foo\`
>
>
> -
> Camel casing, starting with a lower case character, e.g. backColor
>
>
> -
> Short abbreviations of 2 letters can be capitalized only when not at the beginning, e.g. "id" in productID
>
>
> -
> Longer abbreviations need to be lower cased, e.g. html
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class Foo
> Private Foo As Integer ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class Foo
> Private foo As Integer ' Compliant
> End Class
> ```
> [accordion] Arrays should be initialized using the ... = \{} syntax
>
> The `... = {}` syntax is more compact, more readable and less error-prone.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo(1) As String ' Noncompliant
> foo(0) = "foo"
> foo(1) = "bar"
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo = {"foo", "bar"} ' Compliant
> End Sub
> End Module
> ```
> [accordion] Namespace names should comply with a naming convention
>
> Shared coding conventions allow teams to collaborate efficiently. This rule checks that all namespace names match a provided regular expression.
>
> The default configuration is the one recommended by Microsoft:
>
>
> -
> Pascal casing, starting with an upper case character, e.g. Microsoft, System
>
>
> -
> Short abbreviations of 2 letters can be capitalized, e.g. System.IO
>
>
> -
> Longer abbreviations need to be lower cased
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Namespace foo ' Noncompliant
> End Namespace
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Namespace Foo ' Compliant
> End Namespace
> ```
> [accordion] Strings should not be concatenated using + or & in a loop
>
> `StringBuilder` is more efficient than string concatenation, especially when the operator is repeated over and over as in loops.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo = ""
> foo &= "Result: " ' Compliant - outside of loop
>
> For i = 1 To 9
> foo &= i ' Noncompliant
> Next
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo = New System.Text.StringBuilder
> foo.Append("Result: ") ' Compliant
>
> For i = 1 To 9
> foo.Append(i) ' Compliant
> Next
> End Sub
> End Module
> ```
> [accordion] Calculations should not overflow
>
> Numbers are infinite, but the types that hold them are not. Each numeric type has hard upper and lower bounds. Try to calculate numbers beyond those bounds, and the result will be an OverflowException. When the compilation is configured to remove integer overflow checking, the value will be silently wrapped around from the expected positive value to a negative one, or vice versa.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Function Transform(Value As Integer) As Integer
> If Value <= 0 Then Return Value
> Dim Number As Integer = Integer.MaxValue
> Return Number + Value ' Noncompliant
> End Function
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Function Transform(Value As Integer) As Long
> If Value <= 0 Then Return Value
> Dim Number As Long = Integer.MaxValue
> Return Number + Value
> End Function
> ```
> [accordion] Array.Empty(Of TElement) should be used to instantiate empty arrays
>
> Method for creating empty arrays `Array.Empty(Of TElement)` was introduced in .NET 4.6 to optimize object instantiation and memory allocation. It also improves code readability by making developer’s intent more explicit. This new method should be preferred over empty array declaration.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Sub Method()
> Dim Values1(-1) As Integer ' Noncompliant
> Dim Values2 As Integer() = New Integer() {} ' Noncompliant
> Dim Values3 As Integer() = {} ' Noncompliant
> Dim Values4() As Integer = {} ' Noncompliant
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Sub Method()
> Dim Values1 As Integer() = Array.Empty(Of Integer)
> Dim Values2 As Integer() = Array.Empty(Of Integer)
> Dim Values3 As Integer() = Array.Empty(Of Integer)
> Dim Values4() As Integer = Array.Empty(Of Integer)
> End Sub
> ```
> [accordion] Select statements should end with a Case Else clause
>
> The requirement for a final `Case Else` clause is defensive programming.
>
> This clause should either take appropriate action or contain a suitable comment as to why no action is taken.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Select Case param ' Noncompliant - Case Else clause is missing
> Case 0
> DoSomething()
> Case 1
> DoSomethingElse()
> End Select
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Select Case param
> Case 0
> DoSomething()
> Case 1
> DoSomethingElse()
> Case Else ' Compliant
> DoSomethingElse()
> End Select
> ```
> [accordion] Select Case statements should not be nested
>
> Nested \`Select Case structures are difficult to understand because you can easily confuse the cases of an inner Select Case as belonging to an outer statement. Therefore nested Select Case statements should be avoided.
>
> Specifically, you should structure your code to avoid the need for nested Select Case statements, but if you cannot, then consider moving the inner Select Case\` to another function.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Sub Foo(A As Integer, B As Integer)
> Select Case A
> Case 0
> ' ...
> Case 1
> Select Case B ' Noncompliant; nested Select Case
> Case 2
> ' ...
> Case 3
> ' ...
> Case 4
> ' ...
> Case Else
> ' ...
> End Select
> Case 2
> ' ...
> Case Else
> ' ...
> End Select
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Sub Foo(A As Integer, B As Integer)
> Select Case A
> Case 0
> ' ...
> Case 1
> HandleB(B)
> Case 2
> ' ...
> Case Else
> ' ...
> End Select
> End Sub
> ```
> [accordion] Explicit Event subscriptions should be explicitly unsubscribed.
>
> Subscribing to events without unsubscribing later on can lead to memory leaks or even duplicate subscriptions, i.e. code which is executed multiple times by mistake.
>
> Even if there is no problem right now, the code is more difficult to review and a simple refactoring can create a bug. For example the lifetime of the event publisher could change and prevent subscribers from being garbage collected.
>
> There are patterns to automatically unsubscribe, but the simplest and most readable solution remains to unsubscribe from events explicitly using \`RemoveHandler.
>
> This rule raises an issue when a class subscribes to an even using AddHandler without explicitly unsubscribing with RemoveHandler\`.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class MyEventProcucer
> Public Shared Event EventFired As EventHandler
> End Class
>
> Public Class MyEventSubscriber
> Implements IDisposable
>
> Public Sub New()
> AddHandler MyEventProcucer.EventFired, AddressOf c_EventFired 'Noncompliant
> End Sub
>
> Private Sub c_EventFired(sender As Object, e As EventArgs)
> End Sub
>
> Public Sub Dispose() Implements IDisposable.Dispose
> End Sub
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class MyEventProcucer
> Public Shared Event EventFired As EventHandler
> End Class
>
> Public Class MyEventSubscriber
> Implements IDisposable
>
> Public Sub New()
> AddHandler MyEventProcucer.EventFired, AddressOf c_EventFired
> End Sub
>
> Private Sub c_EventFired(ByVal sender As Object, ByVal e As EventArgs)
> End Sub
>
> Public Sub Dispose() Implements IDisposable.Dispose
> RemoveHandler MyEventProcucer.EventFired, AddressOf c_EventFired
> End Sub
> End Class
> ```
> [accordion] Parameters should not be passed by reference
>
> Passing parameters by reference requires developers to understand the subtle differences between reference and value types. It is preferable to avoid passing parameters by reference when possible.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Foo(ByRef result As Integer) ' Non-Compliant
> result = 42
> End Sub
>
> Sub Main()
> Dim result As Integer
> Foo(result)
> Console.WriteLine(result)
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Function Foo() As Integer ' Compliant
> Return 42
> End Function
>
> Sub Main()
> Dim result As Integer = Foo()
> Console.WriteLine(result)
> End Sub
> End Module
> ```
> [accordion] Event names should not have Before or After as a prefix or suffix
>
> "After" and "Before" prefixes or suffixes should not be used to indicate pre and post events. The concepts of before and after should be given to events using the present and past tense.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class Foo
> Event BeforeClose() ' Noncompliant
> Event AfterClose() ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class Foo
> Event Closing() ' Compliant
> Event Closed() ' Compliant
> End Class
> ```
> [accordion] Use a testable date/time provider
>
> One of the principles of a unit test is that it must have full control of the system under test. This is problematic when production code includes calls to static methods, which cannot be changed or controlled. Date/time functions are usually provided by system libraries as static methods.
>
> This can be improved by wrapping the system calls in an object or service that can be controlled inside the unit test.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Foo
> Public Function HelloTime() As String
> Return $"Hello at {DateTime.UtcNow}"
> End Function
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Interface IClock
> Function UtcNow() As Date
> End Interface
>
> Public Class Foo
> Public Function HelloTime(clock As IClock) As String
> Return $"Hello at {clock.UtcNow()}"
> End Function
> End Class
>
> Public Class FooTest
> Public Class TestClock
> Implements IClock
> ' implement
> End Class
>
>
> Public Sub HelloTime_Gives_CorrectTime()
> Dim dateTime = New DateTime(2017, 06, 11)
> Assert.Equal((New Foo()).HelloTime(New TestClock(dateTime)), $"Hello at {dateTime}")
> End Sub
> End Class
> ```
> [accordion] Locks should be released on all paths
>
> If a lock is acquired and released within a method, then it must be released along all execution paths of that method.
>
> Failing to do so will expose the conditional locking logic to the method’s callers and hence be deadlock-prone.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class Example
> Private obj As Object = New Object()
>
> Public Sub DoSomethingWithMonitor()
> Monitor.Enter(obj) ' Noncompliant: not all paths release the lock
>
> If IsInitialized() Then
> ' ...
> Monitor.Exit(obj)
> End If
> End Sub
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class Example
> Private lockObj As ReaderWriterLockSlim = New ReaderWriterLockSlim()
>
> Public Sub DoSomethingWithReaderWriteLockSlim()
> lockObj.EnterReadLock() ' Noncompliant: not all paths release the lock
> If IsInitialized() Then
> ' ...
> lockObj.ExitReadLock()
> End If
> End Sub
> End Class
> ```
> [accordion] Boolean checks should not be inverted
>
> It is needlessly complex to invert the result of a boolean comparison. The opposite comparison should be made instead.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If Not (a = 2) Then // Noncompliant
> Dim b as Boolean = Not (i < 10) // Noncompliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If a <> 2 Then
> Dim b as Boolean = i >= 10
> ```
> [accordion] Regular expressions should be syntactically valid
>
> Regular expressions have their own syntax that is understood by regular expression engines. Those engines will throw an exception at runtime if they are given a regular expression that does not conform to that syntax.
>
> To avoid syntax errors, special characters should be escaped with backslashes when they are intended to be matched literally and references to capturing groups should use the correctly spelled name or number of the group.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Sub Regexes(Input As String)
> Dim Rx As New Regex("[A") ' Noncompliant: unmatched "["
> Dim Match = Regex.Match(Input, "[A") ' Noncompliant
> Dim NegativeLookahead As New Regex("a(?!b)", RegexOptions.NonBacktracking) ' Noncompliant: negative lookahead without backtracking
> Dim NegativeLookbehind As New Regex("(? End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Sub Regexes(Input As String)
> Dim Rx As New Regex("[A-Z]")
> Dim Match = Regex.Match(Input, "[A-Z]")
> Dim NegativeLookahead As New Regex("a(?!b)")
> Dim NegativeLookbehind As New Regex("(? End Sub
> ```
> [accordion] Using publicly writable directories is security-sensitive
>
> Operating systems have global directories where any user has write access. Those folders are mostly used as temporary storage areas like \`/tmp in Linux based systems. An application manipulating files from these folders is exposed to race conditions on filenames: a malicious user can try to create a file with a predictable name before the application does. A successful attack can result in other files being accessed, modified, corrupted or deleted. This risk is even higher if the application runs with elevated permissions.
>
> In the past, it has led to the following vulnerabilities:
>
>
> -
> [CVE-2012-2451](https://nvd.nist.gov/vuln/detail/CVE-2012-2451)
>
>
> -
> [CVE-2015-1838](https://nvd.nist.gov/vuln/detail/CVE-2015-1838)
>
>
>
> This rule raises an issue whenever it detects a hard-coded path to a publicly writable directory like /tmp (see examples bellow). It also detects access to environment variables that point to publicly writable directories, e.g., TMP and TMPDIR.
>
>
> -
> /tmp
>
>
> -
> /var/tmp
>
>
> -
> /usr/tmp
>
>
> -
> /dev/shm
>
>
> -
> /dev/mqueue
>
>
> -
> /run/lock
>
>
> -
> /var/run/lock
>
>
> -
> /Library/Caches
>
>
> -
> /Users/Shared
>
>
> -
> /private/tmp
>
>
> -
> /private/var/tmp
>
>
> -
> \Windows\Temp
>
>
> -
> \Temp
>
>
> -
> \TMP\`
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim RandomPath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName())
>
> ' Creates a new file with write, non inheritable permissions which is deleted on close.
> Using FileStream As New FileStream(RandomPath, FileMode.CreateNew, FileAccess.Write, FileShare.None, 4096, FileOptions.DeleteOnClose)
> Using Writer As New StreamWriter(FileStream) ' Sensitive
> ' ...
> End Using
> End Using
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Statements should be on separate lines
>
> Putting multiple statements on a single line lowers the code readability and makes debugging the code more complex.
>
> Unresolved directive in \ - include::\{noncompliant}\[]
>
> Write one statement per line to improve readability.
>
> Unresolved directive in \ - include::\{compliant}\[]
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim a = 0 : Dim b = 0 ' Noncompliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Dim a = 0
> Dim b = 0
> ```
> [accordion] Enumeration type names should not have Flags or Enum suffixes
>
> The information that an enumeration type is actually an enumeration or a set of flags should not be duplicated in its name.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Enum FooFlags ' Noncompliant
> Foo = 1
> Bar = 2
> Baz = 4
> End Enum
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Enum Foo ' Compliant
> Foo = 1
> Bar = 2
> Baz = 4
> End Enum
> ```
> [accordion] Searching OS commands in PATH is security-sensitive
>
> When executing an OS command and unless you specify the full path to the executable, then the locations in your application’s `PATH environment variable will be searched for the executable. That search could leave an opening for an attacker if one of the elements in PATH` is a directory under his control.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim p As New Process()
> p.StartInfo.FileName = "C:\Apps\binary.exe" ' Compliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Having a permissive Cross-Origin Resource Sharing policy is security-sensitive
>
> Having a permissive Cross-Origin Resource Sharing policy is security-sensitive. It has led in the past to the following vulnerabilities:
>
>
> -
> [CVE-2018-0269](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0269)
>
>
> -
> [CVE-2017-14460](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14460)
>
>
>
> [Same origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) in browsers prevents, by default and for security-reasons, a javascript frontend to perform a cross-origin HTTP request to a resource that has a different origin (domain, protocol, or port) from its own. The requested target can append additional HTTP headers in response, called [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS), that act like directives for the browser and change the access control policy / relax the same origin policy.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Response.AppendHeader("Access-Control-Allow-Origin", "trustedwebsite.com") // Compliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Map values should not be replaced unconditionally
>
> ```vbnet Bad theme={"theme":"css-variables"}
> towns.Item(x) = "London"
> towns.Item(x) = "Chicago"; // Noncompliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] One-way OperationContract methods should have void return type
>
> When declaring a Windows Communication Foundation (WCF) [OperationContract](https://learn.microsoft.com/en-us/dotnet/api/system.servicemodel.operationcontractattribute?view=dotnet-plat-ext-7.0) method as [one-way](https://learn.microsoft.com/en-us/dotnet/api/system.servicemodel.operationcontractattribute.isoneway?view=dotnet-plat-ext-7.0), that service method won’t return any result, not even an underlying empty confirmation message. These are fire-and-forget methods that are useful in event-like communication. Therefore, specifying a return type has no effect and can confuse readers.
>
> ```vbnet Bad theme={"theme":"css-variables"}
>
> Interface IMyService
>
> Function SomethingHappened(ByVal parameter As Integer) As Integer ' Noncompliant
> End Interface
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
>
> Interface IMyService
>
> Sub SomethingHappened(ByVal parameter As Integer)
> End Interface
> ```
> [accordion] Delivering code in production with debug features activated is security-sensitive
>
> Development tools and frameworks usually have options to make debugging easier for developers. Although these features are useful during development, they should never be enabled for applications deployed in production. Debug instructions or error messages can leak detailed information about the system, like the application’s path or file names.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Imports Microsoft.AspNetCore.Builder
> Imports Microsoft.AspNetCore.Hosting
>
> Namespace MyMvcApp
> Public Class Startup
> Public Sub Configure(ByVal app As IApplicationBuilder, ByVal env As IHostingEnvironment)
> ' Those calls are Sensitive because it seems that they will run in production
> app.UseDeveloperExceptionPage() 'Sensitive
> app.UseDatabaseErrorPage() 'Sensitive
> End Sub
> End Class
> End Namespace
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Imports Microsoft.AspNetCore.Builder
> Imports Microsoft.AspNetCore.Hosting
>
> Namespace MyMvcApp
> Public Class Startup
> Public Sub Configure(ByVal app As IApplicationBuilder, ByVal env As IHostingEnvironment)
> If env.IsDevelopment() Then ' Compliant
> ' The following calls are ok because they are disabled in production
> app.UseDeveloperExceptionPage()
> app.UseDatabaseErrorPage()
> End If
> End Sub
> End Class
> End Namespace
> ```
> [accordion] Boolean literals should not be redundant
>
> A boolean literal can be represented in two different ways: \{true} or \{false}.
> They can be combined with logical operators (\{ops}) to produce logical expressions that represent truth values.
> However, comparing a boolean literal to a variable or expression that evaluates to a boolean value is unnecessary and can make the code harder to read and understand.
> The more complex a boolean expression is, the harder it will be for developers to understand its meaning and expected behavior, and it will favour the introduction of new bugs.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If BooleanMethod() = True Then ' Noncompliant
> ' ...
> End If
> If BooleanMethod() = False Then ' Noncompliant
> ' ...
> End If
> If BooleanMethod() OrElse False Then ' Noncompliant
> ' ...
> End If
> DoSomething(Not False) ' Noncompliant
> DoSomething(BooleanMethod() = True) ' Noncompliant
>
> Dim booleanVariable = If(BooleanMethod(), True, False) ' Noncompliant
> booleanVariable = If(BooleanMethod(), True, exp) ' Noncompliant
> booleanVariable = If(BooleanMethod(), False, exp) ' Noncompliant
> booleanVariable = If(BooleanMethod(), exp, True) ' Noncompliant
> booleanVariable = If(BooleanMethod(), exp, False) ' Noncompliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If BooleanMethod() Then
> ' ...
> End If
> If Not BooleanMethod() Then
> ' ...
> End If
> If BooleanMethod() Then
> ' ...
> End If
> DoSomething(True)
> DoSomething(BooleanMethod())
>
> Dim booleanVariable = BooleanMethod()
> booleanVariable = BooleanMethod() OrElse exp
> booleanVariable = Not BooleanMethod() AndAlso exp
> booleanVariable = Not BooleanMethod() OrElse exp
> booleanVariable = BooleanMethod() AndAlso exp
> ```
> [accordion] Deprecated code should be removed
>
> This rule is meant to be used as a way to track code which is marked as being deprecated. Deprecated code should eventually be removed.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> ' Noncompliant
> Sub Procedure()
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Write-only properties should not be used
>
> Properties with only setters are confusing and counterintuitive. Instead, a property getter should be added if possible, or the property should be replaced with a setter method.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> WriteOnly Property Foo() As Integer ' Non-Compliant
> Set(ByVal value As Integer)
> ' ... some code ...
> End Set
> End Property
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub SetFoo(ByVal value As Integer) ' Compliant
> ' ... some code ...
> End Sub
> End Module
> ```
> [accordion] Optional parameters should be passed to base calls
>
> When optional parameter values are not passed to base method calls, the value passed in by the caller is ignored. This can cause the function to behave differently than expected, leading to errors and making the code difficult to debug.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class BaseClass
> Public Overridable Sub MyMethod(ByVal Optional i As Integer = 1)
> Console.WriteLine(i)
> End Sub
> End Class
>
> Public Class DerivedClass
> Inherits BaseClass
>
> Public Overrides Sub MyMethod(ByVal Optional i As Integer = 1)
> ' ...
> MyBase.MyMethod() ' Noncompliant: caller's value is ignored
> End Sub
>
> Private Shared Function Main(ByVal args As String()) As Integer
> Dim dc As DerivedClass = New DerivedClass()
> dc.MyMethod(12) ' prints 1
> End Function
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class BaseClass
> Public Overridable Sub MyMethod(ByVal Optional i As Integer = 1)
> Console.WriteLine(i)
> End Sub
> End Class
>
> Public Class DerivedClass
> Inherits BaseClass
>
> Public Overrides Sub MyMethod(ByVal Optional i As Integer = 1)
> ' ...
> MyBase.MyMethod(i)
> End Sub
>
> Private Shared Function Main(ByVal args As String()) As Integer
> Dim dc As DerivedClass = New DerivedClass()
> dc.MyMethod(12) ' prints 12
> End Function
> End Class
> ```
> [accordion] Fields should be private
>
> Fields should not be part of an API, and therefore should always be private. Indeed, they cannot be added to an interface for instance, and validation cannot be added later on without breaking backward compatibility. Instead, developers should encapsulate their fields into properties. Explicit property getters and setters can be introduced for validation purposes or to smooth the transition to a newer system.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class Foo
> Public Foo = 42 ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class Foo
> Public Property Foo = 42 ' Compliant
> End Class
> ```
> [accordion] Expanding archive files without controlling resource consumption is security-sensitive
>
> Successful Zip Bomb attacks occur when an application expands untrusted archive files without controlling the size of the expanded data, which can lead to denial of service. A Zip bomb is usually a malicious archive file of a few kilobytes of compressed data but turned into gigabytes of uncompressed data. To achieve this extreme [compression ratio](https://en.wikipedia.org/wiki/Data_compression_ratio), attackers will compress irrelevant data (eg: a long string of repeated bytes).
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Const ThresholdRatio As Double = 10
> Const ThresholdSize As Integer = 1024 * 1024 * 1024 ' 1 GB
> Const ThresholdEntries As Integer = 10000
> Dim TotalSizeArchive, TotalEntryArchive, TotalEntrySize, Cnt As Integer
> Dim Buffer(1023) As Byte
> Using ZipToOpen As New FileStream("ZipBomb.zip", FileMode.Open), Archive As New ZipArchive(ZipToOpen, ZipArchiveMode.Read)
> For Each Entry As ZipArchiveEntry In Archive.Entries
> Using s As Stream = Entry.Open
> TotalEntryArchive += 1
> TotalEntrySize = 0
> Do
> Cnt = s.Read(Buffer, 0, Buffer.Length)
> TotalEntrySize += Cnt
> TotalSizeArchive += Cnt
> If TotalEntrySize / Entry.CompressedLength > ThresholdRatio Then Exit Do ' Ratio between compressed And uncompressed data Is highly suspicious, looks Like a Zip Bomb Attack
> Loop While Cnt > 0
> End Using
> If TotalSizeArchive > ThresholdSize Then Exit For ' The uncompressed data size Is too much for the application resource capacity
> If TotalEntryArchive > ThresholdEntries Then Exit For ' Too much entries in this archive, can lead to inodes exhaustion of the system
> Next
> End Using
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Child class fields should not differ from parent class fields only by capitalization
>
> Having a field in a child class with a name that differs from a parent class' field only by capitalization is sure to cause confusion. Such child class fields should be renamed.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Fruit
>
> Protected PlantingSeason As String
>
> ' ...
>
> End Class
>
> Public Class Raspberry
> Inherits Fruit
>
> Protected Plantingseason As String ' Noncompliant
>
> ' ...
>
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class Fruit
>
> Protected PlantingSeason As String
>
> ' ...
>
> End Class
>
> Public Class Raspberry
> Inherits Fruit
>
> Protected WhenToPlant As String
>
> ' ...
>
> End Class
> ```
> [accordion] Mergeable if statements should be combined
>
> Nested code - blocks of code inside blocks of code - is eventually necessary, but increases complexity. This is why keeping the code as flat as possible, by avoiding unnecessary nesting, is considered a good practice.
>
> Merging if statements when possible will decrease the nesting of the code and improve its readability.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If condition1 Then
> If condition2 Then ' Noncompliant
> ' ...
> End If
> End If
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If condition1 AndAlso condition2 Then
> ' ...
> End If
> ```
> [accordion] Methods should not be empty
>
> An empty \{operationName} is generally considered bad practice and can lead to confusion, readability, and maintenance issues.
> Empty \{operationName}s bring no functionality and are misleading to others as they might think the \{operationName} implementation fulfills a specific and identified requirement.
>
> There are several reasons for a \{operationName} not to have a body:
>
>
> -
> It is an unintentional omission, and should be fixed to prevent an unexpected behavior in production.
>
>
> -
> It is not yet, or never will be, supported. In this case an exception should be thrown.
>
>
> -
> The method is an intentionally-blank override. In this case a nested comment should explain the reason for the blank override.
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Sub ShouldNotBeEmpty() ' Noncompliant - method is empty
> End Sub
>
> Sub NotImplementedYet() ' Noncompliant - method is empty
> End Sub
>
> Sub WillNeverBeImplemented() ' Noncompliant - method is empty
> End Sub
>
> Sub EmptyOnPurpose() ' Noncompliant - method is empty
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Sub ShouldNotBeEmpty()
> DoSomething()
> End Sub
>
> Sub NotImplementedYet()
> Throw New NotImplementedException
> End Sub
>
> Sub WillNeverBeImplemented()
> Throw New NotSupportedException
> End Sub
>
> Sub EmptyOnPurpose()
> ' Do nothing because of X
> End Sub
> ```
> [accordion] Using clear-text protocols is security-sensitive
>
> Clear-text protocols such as \`ftp, telnet, or http lack
> encryption of transported data, as well as the capability to build an
> authenticated connection. It means that an attacker able to sniff traffic from
> the network can read, modify, or corrupt the transported content. These
> protocols are not secure as they expose applications to an extensive range of
> risks:
>
>
> -
> sensitive data exposure
>
>
> -
> traffic redirected to a malicious endpoint
>
>
> -
> malware-infected software update or installer
>
>
> -
> execution of client-side code
>
>
> -
> corruption of critical information
>
>
>
> Even in the context of isolated networks like offline environments or segmented
> cloud environments, the insider threat exists. Thus, attacks involving
> communications being sniffed or tampered with can still happen.
>
> For example, attackers could successfully compromise prior security layers by:
>
>
> -
> bypassing isolation mechanisms
>
>
> -
> compromising a component of the network
>
>
> -
> getting the credentials of an internal IAM account (either from a service
> account or an actual person)
>
>
>
> In such cases, encrypting communications would decrease the chances of attackers
> to successfully leak data or steal credentials from other network components.
> By layering various security practices (segmentation and encryption, for
> example), the application will follow the *defense-in-depth* principle.
>
> Note that using the http\` protocol is being deprecated by
> [major web browsers](https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http).
>
> In the past, it has led to the following vulnerabilities:
>
>
> -
> [CVE-2019-6169](https://nvd.nist.gov/vuln/detail/CVE-2019-6169)
>
>
> -
> [CVE-2019-12327](https://nvd.nist.gov/vuln/detail/CVE-2019-12327)
>
>
> -
> [CVE-2019-11065](https://nvd.nist.gov/vuln/detail/CVE-2019-11065)
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim UrlHttp As String = "http://example.com" ' Noncompliant
> Dim UrlFtp As String = "ftp://anonymous@example.com" ' Noncompliant
> Dim UrlTelnet As String = "telnet://anonymous@example.com" ' Noncompliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Using Smtp As New SmtpClient("host", 25) ' Noncompliant, EnableSsl Is Not Set
> End Using
> Using Telnet As New MyTelnet.Client("host", port) ' Noncompliant, rule raises Security Hotspot On any member containing "Telnet"
> End Using
> ```
> [accordion] Redundant pairs of parentheses should be removed
>
> The use of parentheses, even those not required to enforce a desired order of operations, can clarify the intent behind a piece of code. However, redundant pairs of parentheses could be misleading and should be removed.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> If a AndAlso ((x + y > 0)) Then ' Noncompliant
> ' ...
> End If
>
> Return ((x + 1)) ' Noncompliant
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If a AndAlso x + y > 0 Then
> ' ...
> End If
>
> Return x + 1
> ```
> [accordion] Array designators () should be on the type, not the variable
>
> Array designators should always be located on the type for better code readability. Otherwise, developers must look both at the type and the variable name to know whether or not a variable is an array.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo() As String ' Noncompliant
> End Sub
> End Module
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Module Module1
> Sub Main()
> Dim foo As String() ' Compliant
> End Sub
> End Module
> ```
> [accordion] Using shell interpreter when executing OS commands is security-sensitive
>
> Arbitrary OS command injection vulnerabilities are more likely when a shell is spawned rather than a new process, indeed shell meta-chars can be used (when parameters are user-controlled for instance) to inject OS commands.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Imports System.Security
> Imports System.Diagnostics
>
> Namespace N
> Class A
> Public Sub Foo(ByVal process As Process)
> Process.Start("/usr/bin/file.exe") ' Compliant
> End Sub
> End Class
> End Namespace
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Allowing requests with excessive content length is security-sensitive
>
> Rejecting requests with significant content length is a good practice to control the network traffic intensity and thus resource consumption in order to prevent DoS attacks.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Imports Microsoft.AspNetCore.Mvc
>
> Public Class MyController
> Inherits Controller
>
>
> ' Sensitive: No size limit
> ' Sensitive: 10485760 B = 10240 KB = 10 MB is more than the recommended limit of 8MB
> Public Function PostRequest(Model model) As IActionResult
> ' ...
> End Function
>
>
> ' Sensitive: 10485760 B = 10240 KB = 10 MB is more than the recommended limit of 8MB
> Public Function MultipartFormRequest(Model model) As IActionResult
> ' ...
> End Function
>
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Imports Microsoft.AspNetCore.Mvc
>
> Public Class MyController
> Inherits Controller
>
>
> ' Compliant: 8388608 B = 8192 KB = 8 MB
> Public Function PostRequest(Model model) As IActionResult
> ' ...
> End Function
>
>
> ' Compliant: 8388608 B = 8192 KB = 8 MB
> Public Function MultipartFormRequest(Model model) AS IActionResult
> ' ...
> End Function
>
> End Class
> ```
> [accordion] Formatting SQL queries is security-sensitive
>
> Formatted SQL queries can be difficult to maintain, debug and can increase the risk of SQL injection when concatenating untrusted values into the query. However, this rule doesn’t detect SQL injections (unlike rule S3649), the goal is only to highlight complex/formatted queries.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Sub Foo(ByVal context As DbContext, ByVal value As String)
> context.Database.ExecuteSqlCommand("SELECT * FROM mytable WHERE mycol=@p0", value) ' Compliant, the query is parameterized
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Unused procedure parameters should be removed
>
> A typical code smell known as unused function parameters refers to parameters declared in a function but not used anywhere within the function’s body.
> While this might seem harmless at first glance, it can lead to confusion and potential errors in your code.
> Disregarding the values passed to such parameters, the function’s behavior will be the same, but the programmer’s intention won’t be clearly expressed anymore.
> Therefore, removing function parameters that are not being utilized is considered best practice.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Private Sub DoSomething(ByVal a As Integer, ByVal b as Integer) ' "b" is unused
> Compute(a)
> End Sub
>
> Private Function DoSomething2(ByVal a As Integer, ByVal b As Integer) As Integer ' "a" is unused
> Compute(b)
> Return b
> End Function
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Private Sub DoSomething(ByVal a As Integer)
> Compute(a)
> End Sub
>
> Private Function DoSomething2(ByVal b As Integer) As Integer
> Compute(b)
> Return b
> End Function
> ```
> [accordion] Class names should comply with a naming convention
>
> Shared naming conventions allow teams to collaborate efficiently.
>
> This rule raises an issue when a class name does not match a provided regular expression.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class foo ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Class Foo
> End Class
> ```
> [accordion] Assemblies should explicitly specify COM visibility
>
> Assemblies should explicitly indicate whether they are meant to be COM visible or not. If the `ComVisibleAttribute` is not present, the default is to make the content of the assembly visible to COM clients.
>
> Note that COM visibility can be overridden for individual types and members.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Namespace MyLibrary ' Noncompliant
>
> End Namespace
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
>
>
> Namespace MyLibrary
>
> End Namespace
> ```
> [accordion] Select statements should have at least 3 Case clauses
>
> switch statements are useful when there are many different cases depending on the value of the same expression.
>
> For just one or two cases, however, the code will be more readable with if statements.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Select Case variable
> Case 0
> doSomething()
> Case Else
> doSomethingElse()
> End Select
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> If variable = 0 Then
> doSomething()
> Else
> doSomethingElse()
> End If
> ```
> [accordion] Conditionally executed code should be reachable
>
> Conditional expressions which are always true or false can lead to [unreachable code](https://en.wikipedia.org/wiki/Unreachable_code).
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Dim a = False
>
> If a Then
> Dispose() ' Never reached
> End If
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Const debug = False
> '...
> If debug Then
> ' Print something
> End If
> ```
> [accordion] Variables should not be self-assigned
>
> There is no reason to re-assign a variable to itself. Either this statement is redundant and should be removed, or the re-assignment is a mistake and some other value or variable was intended for the assignment instead.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Sub SetName(name As String)
> name = name ' Noncompliant
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Sub SetName(name As String)
> Me.name = name ' Compliant
> End Sub
> ```
> [accordion] Serialization event handlers should be implemented correctly
>
> Serialization event handlers that don’t have the correct signature will not be called, bypassing augmentations to automated serialization and deserialization events.
>
> A method is designated a serialization event handler by applying one of the following serialization event attributes:
>
>
> -
> [OnSerializingAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.runtime.serialization.onserializingattribute)
>
>
> -
> [OnSerializedAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.runtime.serialization.onserializedattribute)
>
>
> -
> [OnDeserializingAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.runtime.serialization.ondeserializingattribute)
>
>
> -
> [OnDeserializedAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.runtime.serialization.ondeserializedattribute)
>
>
>
> Serialization event handlers take a single parameter of type [StreamingContext](https://learn.microsoft.com/en-us/dotnet/api/system.runtime.serialization.streamingcontext), return void, and have private visibility.
>
> This rule raises an issue when any of these constraints are not respected.
>
> ```vbnet Bad theme={"theme":"css-variables"}
>
> Public Class Foo
>
> Public Sub OnSerializing(ByVal context As StreamingContext) ' Noncompliant: should be private
> End Sub
>
>
> Private Function OnSerialized(ByVal context As StreamingContext) As Integer ' Noncompliant: should return void
> End Function
>
>
> Private Sub OnDeserializing() ' Noncompliant: should have a single parameter of type StreamingContext
> End Sub
>
>
> Public Sub OnSerializing2(Of T)(ByVal context As StreamingContext) ' Noncompliant: should have no type parameters
> End Sub
>
>
> Private Sub OnDeserialized(ByVal context As StreamingContext, ByVal str As String) ' Noncompliant: should have a single parameter of type StreamingContext
> End Sub
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
>
> Public Class Foo
>
> Private Sub OnSerializing(ByVal context As StreamingContext)
> End Sub
>
>
> Private Sub OnSerialized(ByVal context As StreamingContext)
> End Sub
>
>
> Private Sub OnDeserializing(ByVal context As StreamingContext)
> End Sub
>
>
> Private Sub OnDeserialized(ByVal context As StreamingContext)
> End Sub
> End Class
> ```
> [accordion] Assemblies should be marked as CLS compliant
>
> Assemblies should conform with the Common Language Specification (CLS) in order to be usable across programming languages. To be compliant an assembly has to indicate it with `System.CLSCompliantAttribute`.
>
> ```vbnet Bad theme={"theme":"css-variables"}
>
>
> Namespace MyLibrary
>
> End Namespace
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Public constant members should not be used
>
> Constant members are copied at compile time to the call sites, instead of being fetched at runtime.
>
> As an example, say you have a library with a constant \`Version member set to 1.0, and a client application linked to it. This library is then updated and Version is set to 2.0. Unfortunately, even after the old DLL is replaced by the new one, Version will still be 1.0 for the client application. In order to see 2.0, the client application would need to be rebuilt against the new version of the library.
>
> This means that you should use constants to hold values that by definition will never change, such as Zero\`. In practice, those cases are uncommon, and therefore it is generally better to avoid constant members.
>
> This rule only reports issues on public constant fields, which can be reached from outside the defining assembly.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Foo
> Public Const Version = 1.0 ' Noncompliant
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class Foo
> Public Shared ReadOnly Property Version = 1.0 ' Compliant
> End Class
> ```
> [accordion] Classes should not be coupled to too many other classes
>
> According to the Single Responsibility Principle, introduced by Robert C. Martin in his book "Principles of Object Oriented Design", a class should have only one responsibility:
>
> > If a class has more than one responsibility, then the responsibilities become coupled.
> >
> > Changes to one responsibility may impair or inhibit the class' ability to meet the others.
> >
> > This kind of coupling leads to fragile designs that break in unexpected ways when changed.
>
> Classes which rely on many other classes tend to aggregate too many responsibilities and should be split into several smaller ones.
>
> Nested classes dependencies are not counted as dependencies of the outer class.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Class Foo ' Non-Compliant - depends on too many other classes
> Dim a1 As T1 ' Foo is coupled to T1
> Dim a2 As T2 ' Foo is coupled to T2
> Dim a3 As T3 ' Foo is coupled to T3
> Dim a4 As T4 ' etc.
> Dim a5 As T5
> Dim a6 As T6
> Dim a7 As T7
> Dim a8 As T8
> Dim a9 As T9
> Dim a10 As T10
> Dim a11 As T11
> Dim a12 As T12
> Dim a13 As T13
> Dim a14 As T14
> Dim a15 As T15
> Dim a16 As T16
> Dim a17 As T17
> Dim a18 As T18
> Dim a19 As T19
> Dim a20 As T20
> Dim a21 As T21
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] If operators should not be nested
>
> Nested ternaries are hard to read and can make the order of operations complex to understand.
>
> Unresolved directive in \ - include::\{noncompliant}\[]
>
> Instead, use another line to express the nested operation in a separate statement.
>
> Unresolved directive in \ - include::\{compliant}\[]
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Function GetReadableStatus(job As Job) As String
> Return If(job.IsRunning, "Running", If(job.HasErrors, "Failed", "Succeeded")) ' Noncompliant
> End Function
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Function GetReadableStatus(job As Job) As String
> If job.IsRunning Then Return "Running"
> Return If(job.HasErrors, "Failed", "Succeeded")
> End Function
> ```
> [accordion] Classes named like Exception should extend Exception or a subclass
>
> Clear, communicative naming is important in code. It helps maintainers and API users understand the intentions for and uses of a unit of code. Using "exception" in the name of a class that does not extend `Exception` or one of its subclasses is a clear violation of the expectation that a class' name will indicate what it is and/or does.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class FruitException ' Noncompliant - this has nothing to do with Exception
> Private expected As Fruit
> Private unusualCharacteristics As String
> Private appropriateForCommercialExploitation As Boolean
> ' ...
> End Class
>
> Public Class CarException ' Noncompliant - does not derive from any Exception-based class
> Public Sub New(message As String, inner As Exception)
> ' ...
> End Sub
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class FruitSport ' Compliant - class name does not end with 'Exception'
> Private expected As Fruit
> Private unusualCharacteristics As String
> Private appropriateForCommercialExploitation As Boolean
> ' ...
> End Class
>
> Public Class CarException Inherits Exception ' Compliant - correctly extends System.Exception
> Public Sub New(message As String, inner As Exception)
> MyBase.New(message, inner)
> ' ...
> End Sub
> End Class
> ```
> [accordion] Method overloads should be grouped together
>
> For clarity, all overloads of the same method should be grouped together. That lets both users and maintainers quickly understand all the current available options.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Interface IMyInterface
> Function DoTheThing() As Integer
> Function DoTheOtherThing() As String // Noncompliant
> Function DoTheThing(ByVal Path As String) As Integer
> End Interface
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Interface IMyInterface
> Function DoTheThing() As Integer
> Function DoTheThing(ByVal Path As String) As Integer
> Function DoTheOtherThing() As String
> End Interface
> ```
> [accordion] String literals should not be duplicated
>
> Duplicated string literals make the process of refactoring complex and error-prone, as any change would need to be propagated on all occurrences.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Foo
>
> Private Name As String = "foobar" ' Noncompliant
>
> Public ReadOnly Property DefaultName As String = "foobar" ' Noncompliant
>
> Public Sub New(Optional Value As String = "foobar") ' Noncompliant
>
> Dim Something = If(Value, "foobar") ' Noncompliant
>
> End Sub
>
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Class Foo
>
> Private Const Foobar As String = "foobar"
>
> Private Name As String = Foobar
>
> Public ReadOnly Property DefaultName As String = Foobar
>
> Public Sub New(Optional Value As String = Foobar)
>
> Dim Something = If(Value, Foobar)
>
> End Sub
>
> End Class
> ```
> [accordion] Types should be defined in named namespaces
>
> Types are declared in namespaces in order to prevent name collisions and as a way to organize them into the object hierarchy. Types that are defined outside any named namespace are in a global namespace that cannot be referenced in code.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Foo
> End Class
>
> Public Structure Bar
> End Structure
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Namespace SomeSpace
> Public Class Foo
> End Class
>
> Public Structure Bar
> End Structure
> End Namespace
> ```
> [accordion] Reflection should not be used to increase accessibility of classes, methods, or fields
>
> Altering or bypassing the accessibility of classes, methods, or fields through reflection violates the encapsulation principle. This can break the internal contracts of the accessed target and lead to maintainability issues and runtime errors.
>
> This rule raises an issue when reflection is used to change the visibility of a class, method or field, and when it is used to directly update a field value.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Imports System.Reflection
>
> Dim dynClass = Type.GetType("MyInternalClass")
> ' Sensitive. Using BindingFlags.NonPublic will return non-public members
> Dim bindingAttr As BindingFlags = BindingFlags.NonPublic Or BindingFlags.Static
> Dim dynMethod As MethodInfo = dynClass.GetMethod("mymethod", bindingAttr)
> Dim result = dynMethod.Invoke(dynClass, Nothing)
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] CoSetProxyBlanket and CoInitializeSecurity should not be used
>
> `CoSetProxyBlanket and CoInitializeSecurity` both work to set the permissions context in which the process invoked immediately after is executed. Calling them from within that process is useless because it’s too late at that point; the permissions context has already been set.
>
> Specifically, these methods are meant to be called from non-managed code such as a C++ wrapper that then invokes the managed, i.e. C# or VB.NET, code.
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Class Noncompliant
>
>
> Public Shared Function CoSetProxyBlanket(pProxy As Object, dwAuthnSvc as UInt32, dwAuthzSvc As UInt32, pServerPrincName As String, dwAuthnLevel As UInt32, dwImpLevel As UInt32, pAuthInfo As IntPtr, dwCapabilities As UInt32) As Integer
> End Function
>
> Public Enum RpcAuthnLevel
> [Default] = 0
> None = 1
> Connect = 2
> [Call] = 3
> Pkt = 4
> PktIntegrity = 5
> PktPrivacy = 6
> End Enum
>
> Public Enum RpcImpLevel
> [Default] = 0
> Anonymous = 1
> Identify = 2
> Impersonate = 3
> [Delegate] = 4
> End Enum
>
> Public Enum EoAuthnCap
> None = &H00
> MutualAuth = &H01
> StaticCloaking = &H20
> DynamicCloaking = &H40
> AnyAuthority = &H80
> MakeFullSIC = &H100
> [Default] = &H800
> SecureRefs = &H02
> AccessControl = &H04
> AppID = &H08
> Dynamic = &H10
> RequireFullSIC = &H200
> AutoImpersonate = &H400
> NoCustomMarshal = &H2000
> DisableAAA = &H1000
> End Enum
>
>
> Public Shared Function CoInitializeSecurity(pVoid As IntPtr, cAuthSvc As Integer, asAuthSvc As IntPtr, pReserved1 As IntPtr, level As RpcAuthnLevel, impers As RpcImpLevel, pAuthList As IntPtr, dwCapabilities As EoAuthnCap, pReserved3 As IntPtr) As Integer
> End Function
>
> Public Sub DoSomething()
> Dim Hres1 As Integer = CoSetProxyBlanket(Nothing, 0, 0, Nothing, 0, 0, IntPtr.Zero, 0) ' Noncompliant
> Dim Hres2 As Integer = CoInitializeSecurity(IntPtr.Zero, -1, IntPtr.Zero, IntPtr.Zero, RpcAuthnLevel.None, RpcImpLevel.Impersonate, IntPtr.Zero, EoAuthnCap.None, IntPtr.Zero) ' Noncompliant
> End Sub
>
> End Class
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> ```
> [accordion] Not specifying a timeout for regular expressions is security-sensitive
>
> Not specifying a timeout for regular expressions can lead to a Denial-of-Service attack.
> Pass a timeout when using System.Text.RegularExpressions to process untrusted input because a malicious user might craft a value for which the evaluation lasts excessively long.
>
> ## Ask Yourself Whether
>
>
> -
> the input passed to the regular expression is untrusted.
>
>
> -
> the regular expression contains patterns vulnerable to [catastrophic backtracking](https://www.regular-expressions.info/catastrophic.html).
>
>
>
> There is a risk if you answered yes to any of those questions.
>
> ## Recommended Secure Coding Practices
>
>
> -
> It is recommended to specify a [matchTimeout](https://learn.microsoft.com/dotnet/standard/base-types/best-practices#use-time-out-values) when executing a regular expression.
>
>
> -
> Make sure regular expressions are not vulnerable to Denial-of-Service attacks by reviewing the patterns.
>
>
> -
> Consider using a non-backtracking algorithm by specifying [RegexOptions.NonBacktracking](https://learn.microsoft.com/dotnet/api/system.text.regularexpressions.regexoptions?view=net-7.0).
>
>
>
> ```vbnet Bad theme={"theme":"css-variables"}
> Public Sub RegexPattern(Input As String)
> Dim EmailPattern As New Regex(".+@.+", RegexOptions.None)
> Dim IsNumber as Boolean = Regex.IsMatch(Input, "[0-9]+")
> Dim IsLetterA as Boolean = Regex.IsMatch(Input, "(a+)+")
> End Sub
> ```
>
> ```vbnet Fix theme={"theme":"css-variables"}
> Public Sub RegexPattern(Input As String)
> Dim EmailPattern As New Regex(".+@.+", RegexOptions.None, TimeSpan.FromMilliseconds(100))
> Dim IsNumber as Boolean = Regex.IsMatch(Input, "[0-9]+", RegexOptions.None, TimeSpan.FromMilliseconds(100))
> Dim IsLetterA As Boolean = Regex.IsMatch(Input, "(a+)+", RegexOptions.NonBacktracking) '.Net 7 And above
> AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", TimeSpan.FromMilliseconds(100)) 'process-wide setting
> End Sub
> ```
> [accordion] Disabling ASP.NET Request Validation feature is security-sensitive
>
> ASP.NET 1.1+ comes with a feature called *Request Validation*, preventing the server to accept content containing un-encoded HTML. This feature comes as a first protection layer against Cross-Site Scripting (XSS) attacks and act as a simple Web Application Firewall (WAF) rejecting requests potentially containing malicious content.
>
> While this feature is not a silver bullet to prevent all XSS attacks, it helps to catch basic ones. It will for example prevent `