New rule S6640: Allowing unsafe code is security-sensitive

[egon-okerman-sonarsource]

Why

C# allows for unsafe code blocks, where it is possible to define pointer types, fixed buffers, to use manual memory allocation,... The CLR cannot verify the safety of this code, therefore it can in some circumstances lead to unexpected behavior and security risks.

Detection logic

All unsafe code blocks should be detected. This can either be a keyword in a method header, or a keyword for a block expression. Examples and more information can be found in the language reference.

Examples

Sensitive

private unsafe int subarraySum(int[] array, int start, int end)  // Sensitive
{
    var sum = 0;

    // Skip array bound checks for extra performance
    fixed (int* firstNumber = array)
    {
        for (int i = start; i < end; i++)
            sum += *(firstNumber + i);
    }

    return sum;
}

Compliant

private int subarraySum(int[] array, int start, int end)
{
    var sum = 0;

    Span<int> span = array.AsSpan();
    for (int i = start; i < end; i++)
        sum += span[i];

    return sum;
}

RSPEC

The relevant RSPEC PR can be found here. It also contains additional information regarding the issue message and highlighting.