FxCop for Ajax Code

In Visual Studio, create a new Script# ClassLibrary.

Lets add some code. Replace the contents of Class1.cs with the following c# code:

using System;
using System.DHTML;

namespace Bookmarking {

    [Record]
    public sealed class Bookmark {
        public string title;
        public string url;
    }

    public class Bookmarks {

        public static void LoadBookmarks(DOMElement list) {
            string bookmarkService = "Bookmarks.ashx/GetList";

            XMLHttpRequest request = new XMLHttpRequest();
            request.Open("GET", bookmarkService);
            request.Onreadystatechange = delegate() {
                if ((request.ReadyState == 4) && (request.Status == 200)) {
                    Bookmark[] bookmarks =
                        (Bookmark[])Script.Eval(request.ResponseText);

                    foreach (Bookmark b in bookmarks) {
                        AnchorElement anchor = (AnchorElement)Document.CreateElement("a");
                        anchor.Href = b.url;
                        anchor.InnerHTML = b.title;

                        DOMElement listElement = Document.CreateElement("li");
                        listElement.AppendChild(anchor);

                        list.AppendChild(listElement);
                    }
                }
            };

            request.Send(null);
        }
    }
}

For the sake of completeness in this post, here is the debug flavor of the generated script (the release flavor is minimized and condensed):

Type.createNamespace('Bookmarking');

Bookmarking.Bookmarks = function Bookmarking_Bookmarks() {
}

Bookmarking.Bookmarks.loadBookmarks = function Bookmarking_Bookmarks$loadBookmarks(list) {
    var bookmarkService = 'Bookmarks.ashx/GetList';
    var request = new XMLHttpRequest();
    request.open('GET', bookmarkService);
    request.onreadystatechange = Delegate.create(null, function() {
        if ((request.readyState === 4) && (request.status === 200)) {
            var bookmarks = eval(request.responseText);
            var $enum1 = bookmarks.getEnumerator();
            while ($enum1.moveNext()) {
                var b = $enum1.get_current();
                var anchor = document.createElement('a');
                anchor.href = b.url;
                anchor.innerHTML = b.title;
                var listElement = document.createElement('li');
                listElement.appendChild(anchor);
                list.appendChild(listElement);
            }
        }
    });
    request.send(null);
}

Bookmarking.Bookmarks.createClass('Bookmarking.Bookmarks');

In addition, an assembly was generated by the regular c# compiler. If you open up the project folder in Explorer, you'll see a Project.FxCop file in the Properties subfolder. Double-click that, and FxCop should open up. The project has been already set up to analyze the resulting assembly.

You'll see the warning around our use of Script.Eval. For our scenario using Script.Eval to generate an eval expression in script is a legitimate use of the functionality to deserialize the list of bookmarks from the XMLHttp response, so we want to suppress this warning. Lets go back to the c# code, and add a source exclusion. There are also some other warnings suggesting our class should be static (which I'll fix), and on public fields on our Bookmark class (which I'll suppress, given the Bookmark class represents a JSON object returned from the service).

using System;
using System.Diagnostics.CodeAnalysis;
using System.DHTML;

namespace Bookmarking {

    [Record]
    public sealed class Bookmark {

        [SuppressMessage("Microsoft.Design", "CA1051:DoNotDeclareVisibleInstanceFields")]
        public string title;

        [SuppressMessage("Microsoft.Design", "CA1051:DoNotDeclareVisibleInstanceFields")]
        public string url;
    }

    public static class Bookmarks {

        [SuppressMessage("Script.General", "SS0001:ScriptAvoidEval",
                         Justification = "Using Script.Eval to perform JSON deserialization")]
        public static void LoadBookmarks(DOMElement list) {
            ...
        }
    }
}

If you compile this and re-run the tool, you'll see the warnings goes away. Your code now documents the suppression along with the justification in a standard manner. If Script.Eval did not make sense (because of its perf overhead), you now know about a potential issue, and a possibly better way to go about implementing your code, should that be warranted.

I think the real power comes with creating custom FxCop rules that go beyond the default set of design guidelines and cater to script-specific scenarios. The Script.Eval check is a custom rule that is the first rule I have implemented.

Other initial ideas for basic rules might be to flag use of browser-specific or non-standard script APIs, or creating deep class hierarchies that are costly in script. I'd love to hear from if they have other ideas of APIs or patterns to flags, or design guidelines to look for and enforce via custom rules.