C# / .NET
Review C# and .NET source and binary scan support in JFrog Xray.
Introduction
JFrog Xray provides security and compliance analysis for C# and .NET applications throughout the software development lifecycle. This page describes the supported scan contexts, capabilities, and dependency analysis available for C# and .NET.
Capabilities
The following capabilities are available for C# and .NET.
| Capability | Source Code Scanning | Binary Scanning |
|---|---|---|
| Vulnerability Matching (CVEs) |  | |
| License Detection | | |
| Malicious Package Detection | |  |
| Operational Risk | | |
| Smart Remediation | | |
Source code scanning analyzes your project's dependency manifest files to identify components and their vulnerabilities. You can use it with the JFrog CLI jf audit command, Frogbot, IDE integrations, and CI pipelines. For more information, see Scan Your Source Code.
Which files a source scan reads depends on the scan method. For those differences, see Source Scanning Engines and Frogbot Versions.
Supported Files
| Package Manager | Supported Files | Available with |
|---|---|---|
| NuGet | .sln, *.csproj, packages.config | Default jf audit |
| NuGet | *.csproj (SDK-style), packages.lock.json, *.deps.json, packages.config, .NET PE files (*.dll, *.exe) – Multi-project solutions, <ProjectReference> support | Frogbot V3 |
Limitation: Directory.Build.props file is not supported.
Dependency Graph
| Package Manager | Dependency Graph | Available with |
|---|---|---|
| NuGet | ⚠️ Project references linked, package dependencies flat | Default jf audit |
| NuGet | ⚠️ Project refs – Projects linked via ProjectReference, transitive NuGet deps not linked | Frogbot V3 |
Binary scanning analyzes built artifacts stored in JFrog Artifactory repositories, extracting package metadata from the artifact format itself. For more information, see Scan Your Binaries.
Supported Files
The following package formats are supported for C# and .NET binary scanning.
| Package Manager | Supported Files |
|---|---|
| NuGet | .nupkg and all archive types |
Additional Information
- NuGet DLL detection only works for third-party NuGet packages.
- For binary contextual analysis when you don't ship a production container image, see Package Applications in Docker for Contextual Analysis.
Related Topics
Updated 25 days ago