Enable code analysis on shim project (#1361)

build/Build.Settings

@@ -20,6 +20,11 @@
    <PropertyGroup Condition="'$(Configuration)' == 'Release'">
      <UseDebugLibraries>false</UseDebugLibraries>
      <WholeProgramOptimization>true</WholeProgramOptimization>
+     <CodeAnalysisRuleSet>..\DefaultRules.ruleset</CodeAnalysisRuleSet>
+     <RunCodeAnalysis>false</RunCodeAnalysis>
+     <!-- Do not enable code analysis on old compiler versions -->
+     <RunCodeAnalysis Condition="'$(VCToolsRedistVersion)' != '' AND '$(VCToolsRedistVersion)' >= 14.15.26706">true</RunCodeAnalysis>
+     <EnablePREfast>$(RunCodeAnalysis)</EnablePREfast>
    </PropertyGroup>
  
    <ItemDefinitionGroup>

src/AspNetCoreModuleV2/AspNetCore/AppOfflineApplication.cpp

@@ -11,7 +11,8 @@ HRESULT AppOfflineApplication::CreateHandler(IHttpContext* pHttpContext, IREQUES
 {
     try
     {
-        *pRequestHandler = new AppOfflineHandler(pHttpContext, m_strAppOfflineContent);
+        auto handler = std::make_unique<AppOfflineHandler>(*pHttpContext, m_strAppOfflineContent);
+        *pRequestHandler = handler.release();
     }
     CATCH_RETURN();
 
@@ -44,9 +45,9 @@ HRESULT AppOfflineApplication::OnAppOfflineFound()
     if (li.LowPart > 0)
     {
         DWORD bytesRead = 0;
-        std::string pszBuff(li.LowPart + 1, '\0');
+        std::string pszBuff(static_cast<size_t>(li.LowPart) + 1, '\0');
 
-        RETURN_LAST_ERROR_IF(!ReadFile(handle, pszBuff.data(), li.LowPart, &bytesRead, NULL));
+        RETURN_LAST_ERROR_IF(!ReadFile(handle, pszBuff.data(), li.LowPart, &bytesRead, nullptr));
         pszBuff.resize(bytesRead);
 
         m_strAppOfflineContent = pszBuff;
@@ -55,7 +56,7 @@ HRESULT AppOfflineApplication::OnAppOfflineFound()
     return S_OK;
 }
 
-bool AppOfflineApplication::ShouldBeStarted(IHttpApplication& pApplication)
+bool AppOfflineApplication::ShouldBeStarted(const IHttpApplication& pApplication)
 {
     return FileExists(GetAppOfflineLocation(pApplication));
 }

src/AspNetCoreModuleV2/AspNetCore/AppOfflineApplication.h

@@ -20,7 +20,7 @@ public:
 
     HRESULT OnAppOfflineFound() override;
 
-    static bool ShouldBeStarted(IHttpApplication& pApplication);
+    static bool ShouldBeStarted(const IHttpApplication& pApplication);
 
 private:
     std::string m_strAppOfflineContent;

src/AspNetCoreModuleV2/AspNetCore/AppOfflineHandler.cpp

@@ -7,8 +7,8 @@
 
 REQUEST_NOTIFICATION_STATUS AppOfflineHandler::OnExecuteRequestHandler()
 {
-    HTTP_DATA_CHUNK   DataChunk;
+    HTTP_DATA_CHUNK   DataChunk {};
-    IHttpResponse* pResponse = m_pContext->GetResponse();
+    auto pResponse = m_pContext.GetResponse();
 
     DBG_ASSERT(pResponse);
 

src/AspNetCoreModuleV2/AspNetCore/AppOfflineHandler.h

@@ -9,7 +9,7 @@
 class AppOfflineHandler: public REQUEST_HANDLER
 {
 public:
-    AppOfflineHandler(IHttpContext* pContext, const std::string appOfflineContent)
+    AppOfflineHandler(IHttpContext& pContext, const std::string appOfflineContent)
         : m_pContext(pContext),
           m_strAppOfflineContent(appOfflineContent)
     {
@@ -18,6 +18,6 @@ public:
     REQUEST_NOTIFICATION_STATUS OnExecuteRequestHandler() override;
 
 private:
-    IHttpContext* m_pContext;
+    IHttpContext& m_pContext;
     std::string m_strAppOfflineContent;
 };

src/AspNetCoreModuleV2/AspNetCore/ApplicationFactory.h

@@ -5,6 +5,7 @@
 
 #include <array>
 #include <string>
+#include <utility>
 #include "iapplication.h"
 #include "HandleWrapper.h"
 
@@ -21,9 +22,9 @@ HRESULT
 class ApplicationFactory
 {
 public:
-    ApplicationFactory(HMODULE hRequestHandlerDll, std::wstring location, PFN_ASPNETCORE_CREATE_APPLICATION pfnAspNetCoreCreateApplication):
+    ApplicationFactory(HMODULE hRequestHandlerDll, std::wstring location, PFN_ASPNETCORE_CREATE_APPLICATION pfnAspNetCoreCreateApplication) noexcept:
         m_pfnAspNetCoreCreateApplication(pfnAspNetCoreCreateApplication),
-        m_location(location),
+        m_location(std::move(location)),
         m_hRequestHandlerDll(hRequestHandlerDll)
     {
     }
@@ -31,10 +32,10 @@ public:
     HRESULT Execute(
         _In_  IHttpServer           *pServer,
         _In_  IHttpApplication      *pHttpApplication,
-        _Out_ IAPPLICATION         **pApplication) const
+        _Outptr_ IAPPLICATION       **pApplication) const noexcept
     {
         std::array<APPLICATION_PARAMETER, 1> parameters {
-            {"InProcessExeLocation", reinterpret_cast<const void*>(m_location.data())}
+            {"InProcessExeLocation", m_location.data()}
         };
         return m_pfnAspNetCoreCreateApplication(pServer, pHttpApplication, parameters.data(), static_cast<DWORD>(parameters.size()), pApplication);
     }

src/AspNetCoreModuleV2/AspNetCore/AspNetCore.vcxproj

@@ -1,6 +1,5 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <Import Project="..\..\..\Build\Build.Settings" />
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|Win32">
       <Configuration>Debug</Configuration>
@@ -56,6 +55,7 @@
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <Import Project="..\..\..\Build\Build.Settings" />
   <ImportGroup Label="ExtensionSettings">
   </ImportGroup>
   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">

src/AspNetCoreModuleV2/AspNetCore/HandlerResolver.cpp

@@ -14,11 +14,12 @@
 #include "resources.h"
 #include "ConfigurationLoadException.h"
 #include "WebConfigConfigurationSource.h"
+#include "ModuleHelpers.h"
 
 const PCWSTR HandlerResolver::s_pwzAspnetcoreInProcessRequestHandlerName = L"aspnetcorev2_inprocess.dll";
 const PCWSTR HandlerResolver::s_pwzAspnetcoreOutOfProcessRequestHandlerName = L"aspnetcorev2_outofprocess.dll";
 
-HandlerResolver::HandlerResolver(HMODULE hModule, IHttpServer &pServer)
+HandlerResolver::HandlerResolver(HMODULE hModule, const IHttpServer &pServer)
     : m_hModule(hModule),
       m_pServer(pServer),
       m_loadedApplicationHostingModel(HOSTING_UNKNOWN)
@@ -27,11 +28,11 @@ HandlerResolver::HandlerResolver(HMODULE hModule, IHttpServer &pServer)
 }
 
 HRESULT
-HandlerResolver::LoadRequestHandlerAssembly(IHttpApplication &pApplication, ShimOptions& pConfiguration, std::unique_ptr<ApplicationFactory>& pApplicationFactory)
+HandlerResolver::LoadRequestHandlerAssembly(const IHttpApplication &pApplication, const ShimOptions& pConfiguration, std::unique_ptr<ApplicationFactory>& pApplicationFactory)
 {
-    HRESULT hr;
+    HRESULT hr = S_OK;
-    PCWSTR              pstrHandlerDllName;
+    PCWSTR pstrHandlerDllName = nullptr;
-    bool preventUnload;
+    bool preventUnload = false;
     if (pConfiguration.QueryHostingModel() == APP_HOSTING_MODEL::HOSTING_IN_PROCESS)
     {
         preventUnload = false;
@@ -76,7 +77,7 @@ HandlerResolver::LoadRequestHandlerAssembly(IHttpApplication &pApplication, Shim
             hr = FindNativeAssemblyFromHostfxr(*options.get(), pstrHandlerDllName, handlerDllPath);
             outputManager->Stop();
 
-            if (FAILED(hr) && m_hHostFxrDll != NULL)
+            if (FAILED(hr) && m_hHostFxrDll != nullptr)
             {
                 STRA content;
                 STRU struStdMsg;
@@ -119,7 +120,7 @@ HandlerResolver::LoadRequestHandlerAssembly(IHttpApplication &pApplication, Shim
         RETURN_LAST_ERROR_IF_NULL(hRequestHandlerDll);
     }
 
-    auto pfnAspNetCoreCreateApplication = reinterpret_cast<PFN_ASPNETCORE_CREATE_APPLICATION>(GetProcAddress(hRequestHandlerDll, "CreateApplication"));
+    auto pfnAspNetCoreCreateApplication = ModuleHelpers::GetKnownProcAddress<PFN_ASPNETCORE_CREATE_APPLICATION>(hRequestHandlerDll, "CreateApplication");
     RETURN_LAST_ERROR_IF_NULL(pfnAspNetCoreCreateApplication);
 
     pApplicationFactory = std::make_unique<ApplicationFactory>(hRequestHandlerDll.release(), location, pfnAspNetCoreCreateApplication);
@@ -127,7 +128,7 @@ HandlerResolver::LoadRequestHandlerAssembly(IHttpApplication &pApplication, Shim
 }
 
 HRESULT
-HandlerResolver::GetApplicationFactory(IHttpApplication &pApplication, std::unique_ptr<ApplicationFactory>& pApplicationFactory)
+HandlerResolver::GetApplicationFactory(const IHttpApplication &pApplication, std::unique_ptr<ApplicationFactory>& pApplicationFactory)
 {
     try
     {
@@ -189,7 +190,7 @@ void HandlerResolver::ResetHostingModel()
 
 HRESULT
 HandlerResolver::FindNativeAssemblyFromGlobalLocation(
-    ShimOptions& pConfiguration,
+    const ShimOptions& pConfiguration,
     PCWSTR pstrHandlerDllName,
     std::wstring& handlerDllPath
 )
@@ -225,20 +226,20 @@ HandlerResolver::FindNativeAssemblyFromGlobalLocation(
 //
 HRESULT
 HandlerResolver::FindNativeAssemblyFromHostfxr(
-    HOSTFXR_OPTIONS& hostfxrOptions,
+    const HOSTFXR_OPTIONS& hostfxrOptions,
     PCWSTR libraryName,
     std::wstring& handlerDllPath
 )
 {
     std::wstring   struNativeSearchPaths;
-    size_t         intIndex;
+    size_t         intIndex = 0;
     size_t         intPrevIndex = 0;
     DWORD          dwBufferSize = s_initialGetNativeSearchDirectoriesBufferSize;
     DWORD          dwRequiredBufferSize = 0;
 
     RETURN_LAST_ERROR_IF_NULL(m_hHostFxrDll = LoadLibraryW(hostfxrOptions.GetHostFxrLocation().c_str()));
 
-    auto pFnHostFxrSearchDirectories = reinterpret_cast<hostfxr_get_native_search_directories_fn>(GetProcAddress(m_hHostFxrDll, "hostfxr_get_native_search_directories"));
+    const auto pFnHostFxrSearchDirectories = ModuleHelpers::GetKnownProcAddress<hostfxr_get_native_search_directories_fn>(m_hHostFxrDll, "hostfxr_get_native_search_directories");
     if (pFnHostFxrSearchDirectories == nullptr)
     {
         EventLog::Error(

src/AspNetCoreModuleV2/AspNetCore/HandlerResolver.h

@@ -13,17 +13,17 @@
 class HandlerResolver
 {
 public:
-    HandlerResolver(HMODULE hModule, IHttpServer &pServer);
+    HandlerResolver(HMODULE hModule, const IHttpServer &pServer);
-    HRESULT GetApplicationFactory(IHttpApplication &pApplication, std::unique_ptr<ApplicationFactory>& pApplicationFactory);
+    HRESULT GetApplicationFactory(const IHttpApplication &pApplication, std::unique_ptr<ApplicationFactory>& pApplicationFactory);
     void ResetHostingModel();
 
 private:
-    HRESULT LoadRequestHandlerAssembly(IHttpApplication &pApplication, ShimOptions& pConfiguration, std::unique_ptr<ApplicationFactory>& pApplicationFactory);
+    HRESULT LoadRequestHandlerAssembly(const IHttpApplication &pApplication, const ShimOptions& pConfiguration, std::unique_ptr<ApplicationFactory>& pApplicationFactory);
-    HRESULT FindNativeAssemblyFromGlobalLocation(ShimOptions& pConfiguration, PCWSTR libraryName, std::wstring& handlerDllPath);
+    HRESULT FindNativeAssemblyFromGlobalLocation(const ShimOptions& pConfiguration, PCWSTR libraryName, std::wstring& handlerDllPath);
-    HRESULT FindNativeAssemblyFromHostfxr(HOSTFXR_OPTIONS& hostfxrOptions, PCWSTR libraryName, std::wstring& handlerDllPath);
+    HRESULT FindNativeAssemblyFromHostfxr(const HOSTFXR_OPTIONS& hostfxrOptions, PCWSTR libraryName, std::wstring& handlerDllPath);
 
     HMODULE m_hModule;
-    IHttpServer &m_pServer;
+    const IHttpServer &m_pServer;
 
     SRWLOCK      m_requestHandlerLoadLock {};
     std::wstring m_loadedApplicationId;

src/AspNetCoreModuleV2/AspNetCore/PollingAppOfflineApplication.cpp

@@ -44,12 +44,12 @@ PollingAppOfflineApplication::CheckAppOffline()
 }
 
 
-std::filesystem::path PollingAppOfflineApplication::GetAppOfflineLocation(IHttpApplication& pApplication)
+std::filesystem::path PollingAppOfflineApplication::GetAppOfflineLocation(const IHttpApplication& pApplication)
 {
     return std::filesystem::path(pApplication.GetApplicationPhysicalPath()) / "app_offline.htm";
 }
 
-bool PollingAppOfflineApplication::FileExists(const std::filesystem::path& path)
+bool PollingAppOfflineApplication::FileExists(const std::filesystem::path& path) noexcept
 {
     std::error_code ec;
     return is_regular_file(path, ec) || ec.value() == ERROR_SHARING_VIOLATION;

src/AspNetCoreModuleV2/AspNetCore/PollingAppOfflineApplication.h

@@ -31,8 +31,8 @@ public:
 
 protected:
     std::filesystem::path m_appOfflineLocation;
-    static std::filesystem::path GetAppOfflineLocation(IHttpApplication& pApplication);
+    static std::filesystem::path GetAppOfflineLocation(const IHttpApplication& pApplication);
-    static bool FileExists(const std::filesystem::path& path);
+    static bool FileExists(const std::filesystem::path& path) noexcept;
 private:
     static const int c_appOfflineRefreshIntervalMS = 200;
     std::string m_strAppOfflineContent;

src/AspNetCoreModuleV2/AspNetCore/ServerErrorApplication.h

@@ -17,13 +17,14 @@ public:
 
     ~ServerErrorApplication() = default;
 
-    HRESULT CreateHandler(IHttpContext * pHttpContext, IREQUEST_HANDLER ** pRequestHandler) override
+    HRESULT CreateHandler(IHttpContext *pHttpContext, IREQUEST_HANDLER ** pRequestHandler) override
     {
-        *pRequestHandler = new ServerErrorHandler(pHttpContext, m_HR);
+        auto handler = std::make_unique<ServerErrorHandler>(*pHttpContext, m_HR);
+        *pRequestHandler = handler.release();
         return S_OK;
     }
 
-    HRESULT OnAppOfflineFound() override { return S_OK; }
+    HRESULT OnAppOfflineFound() noexcept override { return S_OK; }
 private:
     HRESULT m_HR;
 };

src/AspNetCoreModuleV2/AspNetCore/ServerErrorHandler.h

@@ -7,17 +7,17 @@
 class ServerErrorHandler : public REQUEST_HANDLER
 {
 public:
-    ServerErrorHandler(IHttpContext* pContext, HRESULT hr) : m_pContext(pContext), m_HR(hr)
+    ServerErrorHandler(IHttpContext &pContext, HRESULT hr) : m_pContext(pContext), m_HR(hr)
     {
     }
 
     REQUEST_NOTIFICATION_STATUS OnExecuteRequestHandler() override
     {
-        m_pContext->GetResponse()->SetStatus(500, "Internal Server Error", 0, m_HR);
+        m_pContext.GetResponse()->SetStatus(500, "Internal Server Error", 0, m_HR);
         return RQ_NOTIFICATION_FINISH_REQUEST;
     }
 
 private:
-    IHttpContext * m_pContext;
+    IHttpContext &m_pContext;
     HRESULT m_HR;
 };

src/AspNetCoreModuleV2/AspNetCore/ShimOptions.h

@@ -18,37 +18,37 @@ class ShimOptions: NonCopyable
 {
 public:
     const std::wstring&
-    QueryProcessPath() const
+    QueryProcessPath() const noexcept
     {
         return m_strProcessPath;
     }
 
     const std::wstring&
-    QueryArguments() const
+    QueryArguments() const noexcept
     {
         return m_strArguments;
     }
 
     APP_HOSTING_MODEL
-    QueryHostingModel() const
+    QueryHostingModel() const noexcept
     {
         return m_hostingModel;
     }
 
     const std::wstring&
-    QueryHandlerVersion() const
+    QueryHandlerVersion() const noexcept
     {
         return m_strHandlerVersion;
     }
 
     BOOL
-    QueryStdoutLogEnabled() const
+    QueryStdoutLogEnabled() const noexcept
     {
         return m_fStdoutLogEnabled;
     }
 
     const std::wstring&
-    QueryStdoutLogFile() const
+    QueryStdoutLogFile() const noexcept
     {
         return m_struStdoutLogFile;
     }

src/AspNetCoreModuleV2/AspNetCore/applicationinfo.cpp

@@ -13,14 +13,9 @@
 #include "ServerErrorApplication.h"
 #include "AppOfflineApplication.h"
 
-APPLICATION_INFO::~APPLICATION_INFO()
-{
-    ShutDownApplication(/* fServerInitiated */ false);
-}
-
 HRESULT
 APPLICATION_INFO::GetOrCreateApplication(
-    IHttpContext *pHttpContext,
+    IHttpContext& pHttpContext,
     std::unique_ptr<IAPPLICATION, IAPPLICATION_DELETER>& pApplication
 )
 {
@@ -28,7 +23,7 @@ APPLICATION_INFO::GetOrCreateApplication(
 
     SRWExclusiveLock lock(m_applicationLock);
 
-    auto& httpApplication = *pHttpContext->GetApplication();
+    auto& httpApplication = *pHttpContext.GetApplication();
 
     if (m_pApplication != nullptr)
     {
@@ -51,7 +46,10 @@ APPLICATION_INFO::GetOrCreateApplication(
     if (AppOfflineApplication::ShouldBeStarted(httpApplication))
     {
         LOG_INFO(L"Detected app_offline file, creating polling application");
+        #pragma warning( push )
+        #pragma warning ( disable : 26409 ) // Disable "Avoid using new", using custom deleter here
         m_pApplication.reset(new AppOfflineApplication(httpApplication));
+        #pragma warning( pop )
     }
     else
     {
@@ -77,8 +75,11 @@ Finished:
             ASPNETCORE_EVENT_ADD_APPLICATION_ERROR_MSG,
             httpApplication.GetApplicationId(),
             hr);
-
+        
+        #pragma warning( push )
+        #pragma warning ( disable : 26409 ) // Disable "Avoid using new", using custom deleter here
         m_pApplication.reset(new ServerErrorApplication(httpApplication, hr));
+        #pragma warning( pop )
     }
 
     if (m_pApplication)

src/AspNetCoreModuleV2/AspNetCore/applicationinfo.h

@@ -12,7 +12,7 @@
 
 extern BOOL     g_fRecycleProcessCalled;
 
-class APPLICATION_INFO
+class APPLICATION_INFO: NonCopyable
 {
 public:
 
@@ -29,16 +29,16 @@ public:
         InitializeSRWLock(&m_applicationLock);
     }
 
-    ~APPLICATION_INFO();
+    ~APPLICATION_INFO() = default;
 
-    std::wstring&
+    const std::wstring&
-    QueryApplicationInfoKey()
+    QueryApplicationInfoKey() const noexcept
     {
         return m_strInfoKey;
     }
 
-    std::wstring&
+    const std::wstring&
-    QueryConfigPath()
+    QueryConfigPath() const noexcept
     {
         return m_strConfigPath;
     }
@@ -48,7 +48,7 @@ public:
 
     HRESULT
     GetOrCreateApplication(
-        IHttpContext *pHttpContext,
+        IHttpContext& pHttpContext,
         std::unique_ptr<IAPPLICATION, IAPPLICATION_DELETER>& pApplication
     );
 

src/AspNetCoreModuleV2/AspNetCore/applicationmanager.cpp

@@ -11,9 +11,6 @@
 
 extern BOOL         g_fInShutdown;
 
-// The application manager is a singleton across ANCM.
-APPLICATION_MANAGER* APPLICATION_MANAGER::sm_pApplicationManager = NULL;
-
 //
 // Retrieves the application info from the application manager
 // Will create the application info if it isn't initalized

src/AspNetCoreModuleV2/AspNetCore/applicationmanager.h

@@ -19,25 +19,6 @@ class APPLICATION_MANAGER
 {
 public:
 
-    static
-    APPLICATION_MANAGER*
-    GetInstance()
-    {
-        assert(sm_pApplicationManager);
-        return sm_pApplicationManager;
-    }
-
-    static
-    VOID
-    Cleanup()
-    {
-        if(sm_pApplicationManager != NULL)
-        {
-            delete sm_pApplicationManager;
-            sm_pApplicationManager = NULL;
-        }
-    }
-
     HRESULT
     GetOrCreateApplicationInfo(
         _In_ IHttpContext& pHttpContext,
@@ -51,16 +32,7 @@ public:
 
     VOID
     ShutDown();
-
+    
-    static HRESULT StaticInitialize(HMODULE hModule, IHttpServer& pHttpServer)
-    {
-        assert(!sm_pApplicationManager);
-        sm_pApplicationManager = new APPLICATION_MANAGER(hModule, pHttpServer);
-        return S_OK;
-    }
-
-
-private:
     APPLICATION_MANAGER(HMODULE hModule, IHttpServer& pHttpServer) :
                             m_pApplicationInfoHash(NULL),
                             m_fDebugInitialize(FALSE),
@@ -70,8 +42,9 @@ private:
         InitializeSRWLock(&m_srwLock);
     }
 
+private:
+
     std::unordered_map<std::wstring, std::shared_ptr<APPLICATION_INFO>>      m_pApplicationInfoHash;
-    static APPLICATION_MANAGER *sm_pApplicationManager;
     SRWLOCK                     m_srwLock {};
     BOOL                        m_fDebugInitialize;
     IHttpServer                &m_pHttpServer;

src/AspNetCoreModuleV2/AspNetCore/dllmain.cpp

@@ -13,7 +13,7 @@
 
 DECLARE_DEBUG_PRINT_OBJECT("aspnetcorev2.dll");
 
-HANDLE              g_hEventLog = NULL;
+HANDLE              g_hEventLog = nullptr;
 BOOL                g_fRecycleProcessCalled = FALSE;
 BOOL                g_fInShutdown = FALSE;
 HINSTANCE           g_hServerModule;
@@ -21,14 +21,14 @@ HINSTANCE           g_hServerModule;
 VOID
 StaticCleanup()
 {
-    APPLICATION_MANAGER::Cleanup();
+    if (g_hEventLog != nullptr)
-    if (g_hEventLog != NULL)
     {
         DeregisterEventSource(g_hEventLog);
-        g_hEventLog = NULL;
+        g_hEventLog = nullptr;
     }
 
     DebugStop();
+    ALLOC_CACHE_HANDLER::StaticTerminate();
 }
 
 BOOL WINAPI DllMain(HMODULE hModule,
@@ -41,11 +41,14 @@ BOOL WINAPI DllMain(HMODULE hModule,
     switch (ul_reason_for_call)
     {
     case DLL_PROCESS_ATTACH:
+        
+        ALLOC_CACHE_HANDLER::StaticInitialize();
         g_hServerModule = hModule;
         DisableThreadLibraryCalls(hModule);
         DebugInitialize(hModule);
         break;
     case DLL_PROCESS_DETACH:
+
         // IIS can cause dll detach to occur before we receive global notifications
         // For example, when we switch the bitness of the worker process,
         // this is a bug in IIS. To try to avoid AVs, we will set a global flag
@@ -85,21 +88,18 @@ HRESULT
 
 --*/
 {
-    HRESULT                             hr = S_OK;
+    HKEY                                hKey {};
-    HKEY                                hKey;
     BOOL                                fDisableANCM = FALSE;
-    ASPNET_CORE_PROXY_MODULE_FACTORY *  pFactory = NULL;
-    ASPNET_CORE_GLOBAL_MODULE *         pGlobalModule = NULL;
 
     UNREFERENCED_PARAMETER(dwServerVersion);
 
     if (pHttpServer->IsCommandLineLaunch())
     {
-        g_hEventLog = RegisterEventSource(NULL, ASPNETCORE_IISEXPRESS_EVENT_PROVIDER);
+        g_hEventLog = RegisterEventSource(nullptr, ASPNETCORE_IISEXPRESS_EVENT_PROVIDER);
     }
     else
     {
-        g_hEventLog = RegisterEventSource(NULL, ASPNETCORE_EVENT_PROVIDER);
+        g_hEventLog = RegisterEventSource(nullptr, ASPNETCORE_EVENT_PROVIDER);
     }
 
     // check whether the feature is disabled due to security reason
@@ -109,14 +109,14 @@ HRESULT
         KEY_READ,
         &hKey) == NO_ERROR)
     {
-        DWORD dwType;
+        DWORD dwType = 0;
-        DWORD dwData;
+        DWORD dwData = 0;
         DWORD cbData;
 
         cbData = sizeof(dwData);
         if ((RegQueryValueEx(hKey,
             L"DisableANCM",
-            NULL,
+            nullptr,
             &dwType,
             (LPBYTE)&dwData,
             &cbData) == NO_ERROR) &&
@@ -136,7 +136,7 @@ HRESULT
             ASPNETCORE_EVENT_MODULE_DISABLED_MSG);
         // this will return 500 error to client
         // as we did not register the module
-        goto Finished;
+        return S_OK;
     }
 
     //
@@ -144,43 +144,22 @@ HRESULT
     // The ASPNET_CORE_PROXY_MODULE_FACTORY::Terminate method will clean any
     // static object initialized.
     //
-    pFactory = new ASPNET_CORE_PROXY_MODULE_FACTORY;
+    
+    auto applicationManager = std::make_shared<APPLICATION_MANAGER>(g_hServerModule, *pHttpServer);
+    auto moduleFactory = std::make_unique<ASPNET_CORE_PROXY_MODULE_FACTORY>(applicationManager);
 
-    FINISHED_IF_FAILED(pModuleInfo->SetRequestNotifications(
+    RETURN_IF_FAILED(pModuleInfo->SetRequestNotifications(
-                                  pFactory,
+                                  moduleFactory.release(),
                                   RQ_EXECUTE_REQUEST_HANDLER,
                                   0));
+;
+    auto pGlobalModule = std::make_unique<ASPNET_CORE_GLOBAL_MODULE>(std::move(applicationManager));
 
-    pFactory = NULL;
+    RETURN_IF_FAILED(pModuleInfo->SetGlobalNotifications(
-
+                                     pGlobalModule.release(),
-    FINISHED_IF_FAILED(APPLICATION_MANAGER::StaticInitialize(g_hServerModule, *pHttpServer));
-
-    pGlobalModule = NULL;
-
-    pGlobalModule = new ASPNET_CORE_GLOBAL_MODULE(APPLICATION_MANAGER::GetInstance());
-
-    FINISHED_IF_FAILED(pModuleInfo->SetGlobalNotifications(
-                                     pGlobalModule,
                                      GL_CONFIGURATION_CHANGE | // Configuration change trigers IIS application stop
                                      GL_STOP_LISTENING));   // worker process stop or recycle
-
+    
-    pGlobalModule = NULL;
+    return S_OK;
-
-    FINISHED_IF_FAILED(ALLOC_CACHE_HANDLER::StaticInitialize());
-
-Finished:
-    if (pGlobalModule != NULL)
-    {
-        delete pGlobalModule;
-        pGlobalModule = NULL;
-    }
-
-    if (pFactory != NULL)
-    {
-        pFactory->Terminate();
-        pFactory = NULL;
-    }
-
-    return hr;
 }
 CATCH_RETURN()

src/AspNetCoreModuleV2/AspNetCore/globalmodule.cpp

@@ -5,10 +5,9 @@
 
 extern BOOL         g_fInShutdown;
 
-ASPNET_CORE_GLOBAL_MODULE::ASPNET_CORE_GLOBAL_MODULE(
+ASPNET_CORE_GLOBAL_MODULE::ASPNET_CORE_GLOBAL_MODULE(std::shared_ptr<APPLICATION_MANAGER> pApplicationManager) noexcept
-    APPLICATION_MANAGER* pApplicationManager)
+    :m_pApplicationManager(std::move(pApplicationManager))
 {
-    m_pApplicationManager = pApplicationManager;
 }
 
 //
@@ -30,11 +29,8 @@ ASPNET_CORE_GLOBAL_MODULE::OnGlobalStopListening(
         return GL_NOTIFICATION_CONTINUE;
     }
 
-    DBG_ASSERT(m_pApplicationManager);
-    // we should let application manager to shutdown all allication
-    // and dereference it as some requests may still reference to application manager
     m_pApplicationManager->ShutDown();
-    m_pApplicationManager = NULL;
+    m_pApplicationManager = nullptr;
 
     // Return processing to the pipeline.
     return GL_NOTIFICATION_CONTINUE;
@@ -59,13 +55,13 @@ ASPNET_CORE_GLOBAL_MODULE::OnGlobalConfigurationChange(
     LOG_INFOF(L"ASPNET_CORE_GLOBAL_MODULE::OnGlobalConfigurationChange '%ls'", pwszChangePath);
 
     // Test for an error.
-    if (NULL != pwszChangePath &&
+    if (nullptr != pwszChangePath &&
         _wcsicmp(pwszChangePath, L"MACHINE") != 0 &&
         _wcsicmp(pwszChangePath, L"MACHINE/WEBROOT") != 0)
     {
-        if (m_pApplicationManager != NULL)
+        if (m_pApplicationManager)
         {
-            m_pApplicationManager->RecycleApplicationFromManager(pwszChangePath);
+            m_pApplicationManager->RecycleApplicationFromManager(pwszChangePath);   
         }
     }
 

src/AspNetCoreModuleV2/AspNetCore/globalmodule.h

@@ -5,20 +5,18 @@
 
 #include "applicationmanager.h"
 
-class ASPNET_CORE_GLOBAL_MODULE : public CGlobalModule
+class ASPNET_CORE_GLOBAL_MODULE : NonCopyable, public CGlobalModule
 {
 
 public:
 
     ASPNET_CORE_GLOBAL_MODULE(
-        APPLICATION_MANAGER* pApplicationManager
+        std::shared_ptr<APPLICATION_MANAGER> pApplicationManager
-    );
+    ) noexcept;
 
-    ~ASPNET_CORE_GLOBAL_MODULE()
+    virtual ~ASPNET_CORE_GLOBAL_MODULE() = default;
-    {
-    }
 
-    VOID Terminate()
+    VOID Terminate() override
     {
         LOG_INFO(L"ASPNET_CORE_GLOBAL_MODULE::Terminate");
         // Remove the class from memory.
@@ -28,13 +26,13 @@ public:
     GLOBAL_NOTIFICATION_STATUS
     OnGlobalStopListening(
         _In_ IGlobalStopListeningProvider * pProvider
-    );
+    ) override;
 
     GLOBAL_NOTIFICATION_STATUS
     OnGlobalConfigurationChange(
         _In_ IGlobalConfigurationChangeProvider * pProvider
-    );
+    ) override;
 
 private:
-    APPLICATION_MANAGER * m_pApplicationManager;
+    std::shared_ptr<APPLICATION_MANAGER> m_pApplicationManager;
 };

src/AspNetCoreModuleV2/AspNetCore/proxymodule.cpp

@@ -5,31 +5,40 @@
 
 #include "applicationmanager.h"
 #include "applicationinfo.h"
-#include "acache.h"
 #include "exceptions.h"
 
 extern BOOL         g_fInShutdown;
 
 __override
+
+ASPNET_CORE_PROXY_MODULE_FACTORY::ASPNET_CORE_PROXY_MODULE_FACTORY(std::shared_ptr<APPLICATION_MANAGER> applicationManager) noexcept
+    :m_pApplicationManager(std::move(applicationManager))
+{
+}
+
 HRESULT
 ASPNET_CORE_PROXY_MODULE_FACTORY::GetHttpModule(
     CHttpModule **      ppModule,
     IModuleAllocator *  pAllocator
 )
 {
-    try
+    
+    #pragma warning( push )
+    #pragma warning ( disable : 26409 ) // Disable "Avoid using new"
+    *ppModule = new (pAllocator) ASPNET_CORE_PROXY_MODULE(m_pApplicationManager);
+    #pragma warning( push )
+    if (*ppModule == nullptr)
     {
-        *ppModule = THROW_IF_NULL_ALLOC(new (pAllocator) ASPNET_CORE_PROXY_MODULE());;
+        return E_OUTOFMEMORY;
-        return S_OK;
     }
-    CATCH_RETURN();
+    return S_OK;
 }
 
 __override
 VOID
 ASPNET_CORE_PROXY_MODULE_FACTORY::Terminate(
     VOID
-)
+) noexcept
 /*++
 
 Routine description:
@@ -46,12 +55,13 @@ Return value:
 
 --*/
 {
-    ALLOC_CACHE_HANDLER::StaticTerminate();
     delete this;
 }
 
-ASPNET_CORE_PROXY_MODULE::ASPNET_CORE_PROXY_MODULE(
+ASPNET_CORE_PROXY_MODULE::ASPNET_CORE_PROXY_MODULE(std::shared_ptr<APPLICATION_MANAGER> applicationManager) noexcept 
-) : m_pApplicationInfo(nullptr), m_pHandler(nullptr)
+    : m_pApplicationManager(std::move(applicationManager)),
+      m_pApplicationInfo(nullptr),
+      m_pHandler(nullptr)
 {
 }
 
@@ -64,6 +74,7 @@ ASPNET_CORE_PROXY_MODULE::OnExecuteRequestHandler(
 {
     HRESULT hr = S_OK;
     REQUEST_NOTIFICATION_STATUS retVal = RQ_NOTIFICATION_CONTINUE;
+
     try
     {
 
@@ -72,14 +83,12 @@ ASPNET_CORE_PROXY_MODULE::OnExecuteRequestHandler(
             FINISHED(HRESULT_FROM_WIN32(ERROR_SERVER_SHUTDOWN_IN_PROGRESS));
         }
 
-        auto pApplicationManager = APPLICATION_MANAGER::GetInstance();
+        FINISHED_IF_FAILED(m_pApplicationManager->GetOrCreateApplicationInfo(
-
-        FINISHED_IF_FAILED(pApplicationManager->GetOrCreateApplicationInfo(
             *pHttpContext,
             m_pApplicationInfo));
 
         std::unique_ptr<IAPPLICATION, IAPPLICATION_DELETER> pApplication;
-        FINISHED_IF_FAILED(m_pApplicationInfo->GetOrCreateApplication(pHttpContext, pApplication));
+        FINISHED_IF_FAILED(m_pApplicationInfo->GetOrCreateApplication(*pHttpContext, pApplication));
 
         IREQUEST_HANDLER* pHandler;
         // Create RequestHandler and process the request
@@ -94,7 +103,7 @@ ASPNET_CORE_PROXY_MODULE::OnExecuteRequestHandler(
     }
 
 Finished:
-    if (LOG_IF_FAILED(hr))
+    if (FAILED(LOG_IF_FAILED(hr)))
     {
         retVal = RQ_NOTIFICATION_FINISH_REQUEST;
         if (hr == HRESULT_FROM_WIN32(ERROR_SERVER_SHUTDOWN_IN_PROGRESS))

src/AspNetCoreModuleV2/AspNetCore/proxymodule.h

@@ -6,14 +6,15 @@
 #include <memory>
 #include "applicationinfo.h"
 #include "irequesthandler.h"
+#include "applicationmanager.h"
 
 extern HTTP_MODULE_ID   g_pModuleId;
 
-class ASPNET_CORE_PROXY_MODULE : public CHttpModule
+class ASPNET_CORE_PROXY_MODULE : NonCopyable, public CHttpModule
 {
  public:
 
-     ASPNET_CORE_PROXY_MODULE();
+     ASPNET_CORE_PROXY_MODULE(std::shared_ptr<APPLICATION_MANAGER> applicationManager) noexcept;
 
     ~ASPNET_CORE_PROXY_MODULE() = default;
 
@@ -33,7 +34,7 @@ class ASPNET_CORE_PROXY_MODULE : public CHttpModule
     OnExecuteRequestHandler(
         IHttpContext *          pHttpContext,
         IHttpEventProvider *    pProvider
-    );
+    ) override;
 
     __override
     REQUEST_NOTIFICATION_STATUS
@@ -43,22 +44,29 @@ class ASPNET_CORE_PROXY_MODULE : public CHttpModule
         BOOL                    fPostNotification,
         IHttpEventProvider *    pProvider,
         IHttpCompletionInfo *   pCompletionInfo
-    );
+    ) override;
 
  private:
+    std::shared_ptr<APPLICATION_MANAGER> m_pApplicationManager;
     std::shared_ptr<APPLICATION_INFO> m_pApplicationInfo;
-    std::unique_ptr<IREQUEST_HANDLER, IREQUEST_HANDLER_DELETER>  m_pHandler;
+    std::unique_ptr<IREQUEST_HANDLER, IREQUEST_HANDLER_DELETER> m_pHandler;
 };
 
-class ASPNET_CORE_PROXY_MODULE_FACTORY : public IHttpModuleFactory
+class ASPNET_CORE_PROXY_MODULE_FACTORY : NonCopyable, public IHttpModuleFactory
 {
  public:
+    ASPNET_CORE_PROXY_MODULE_FACTORY(std::shared_ptr<APPLICATION_MANAGER> applicationManager) noexcept;
+    virtual ~ASPNET_CORE_PROXY_MODULE_FACTORY() = default;
+
     HRESULT
     GetHttpModule(
         CHttpModule **      ppModule,
         IModuleAllocator *  pAllocator
-    );
+    ) override;
 
     VOID
-    Terminate();
+    Terminate() noexcept override;
+    
+ private:
+    std::shared_ptr<APPLICATION_MANAGER> m_pApplicationManager;
 };

src/AspNetCoreModuleV2/CommonLib/EventLog.cpp

@@ -50,7 +50,7 @@ EventLog::LogEventF(
     _In_ WORD    dwEventInfoType,
     _In_ DWORD   dwEventId,
     _In_ LPCWSTR pstrMsg,
-    va_list argsList
+    _In_ va_list argsList
 )
 {
     STACK_STRU ( strEventMsg, 256 );

src/AspNetCoreModuleV2/CommonLib/EventLog.h

@@ -5,6 +5,18 @@
 
 #include "resources.h"
 
+#define _va_start(ap, x) \
+    __pragma(warning(push)) \
+    __pragma(warning(disable:26481 26492)) /*Don't use pointer arithmetic. Don't use const_cast to cast away const.*/ \
+    va_start(ap, x) \
+    __pragma(warning(pop))
+
+#define _va_end(args) \
+    __pragma(warning(push)) \
+    __pragma(warning(disable:26477)) /*Use 'nullptr' rather than 0 or NULL*/ \
+    va_end(args) \
+    __pragma(warning(pop))
+
 class EventLog
 {
 public:
@@ -16,9 +28,9 @@ public:
         ...)
     {
        va_list args;
-       va_start(args, pstrMsg);
+       _va_start(args, pstrMsg);
        LogEventF(EVENTLOG_ERROR_TYPE, dwEventId, pstrMsg, args);
-       va_end(args);
+       _va_end(args);
     }
 
     static
@@ -29,9 +41,9 @@ public:
         ...)
     {
        va_list args;
-       va_start(args, pstrMsg);
+       _va_start(args, pstrMsg);
        LogEventF(EVENTLOG_INFORMATION_TYPE, dwEventId, pstrMsg, args);
-       va_end(args);
+       _va_end(args);
     }
 
     static
@@ -42,9 +54,9 @@ public:
         ...)
     {
        va_list args;
-       va_start(args, pstrMsg);
+       _va_start(args, pstrMsg);
        LogEventF(EVENTLOG_WARNING_TYPE, dwEventId, pstrMsg, args);
-       va_end(args);
+       _va_end(args);
     }
 
 private:

src/AspNetCoreModuleV2/CommonLib/FileOutputManager.cpp

@@ -174,7 +174,7 @@ FileOutputManager::Stop()
 
     if (li.LowPart == 0 || li.HighPart > 0)
     {
-        RETURN_IF_FAILED(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
+        RETURN_HR(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
     }
 
     dwFilePointer = SetFilePointer(m_hLogFileHandle, 0, NULL, FILE_BEGIN);

src/AspNetCoreModuleV2/CommonLib/HandleWrapper.h

@@ -10,37 +10,41 @@ struct InvalidHandleTraits
 {
     using HandleType = HANDLE;
     static const HANDLE DefaultHandle;
-    static void Close(HANDLE handle) { CloseHandle(handle); }
+    static void Close(HANDLE handle) noexcept { CloseHandle(handle); }
 };
 
 struct NullHandleTraits
 {
     using HandleType = HANDLE;
-    static constexpr HANDLE DefaultHandle = NULL;
+    static constexpr HANDLE DefaultHandle = nullptr;
-    static void Close(HANDLE handle) { CloseHandle(handle); }
+    static void Close(HANDLE handle) noexcept { CloseHandle(handle); }
 };
 
 struct FindFileHandleTraits
 {
     using HandleType = HANDLE;
     static const HANDLE DefaultHandle;
-    static void Close(HANDLE handle) { FindClose(handle); }
+    static void Close(HANDLE handle) noexcept { FindClose(handle); }
 };
 
 struct ModuleHandleTraits
 {
     using HandleType = HMODULE;
-    static constexpr HMODULE DefaultHandle = NULL;
+    static constexpr HMODULE DefaultHandle = nullptr;
-    static void Close(HMODULE handle) { FreeModule(handle); }
+    static void Close(HMODULE handle) noexcept { FreeModule(handle); }
 };
 
+// Code analysis doesn't like nullptr usages via traits
+#pragma warning( push )
+#pragma warning ( disable : 26477 ) // disable  Use 'nullptr' rather than 0 or NULL (es.47).
+
 template<typename traits>
 class HandleWrapper
 {
 public:
     using HandleType = typename traits::HandleType;
 
-    HandleWrapper(HandleType handle = traits::DefaultHandle) : m_handle(handle) { }
+    HandleWrapper(HandleType handle = traits::DefaultHandle) noexcept : m_handle(handle) { }
     ~HandleWrapper()
     {
         if (m_handle != traits::DefaultHandle)
@@ -49,15 +53,15 @@ public:
         }
     }
 
-    operator HandleType() { return m_handle; }
+    operator HandleType() noexcept { return m_handle; }
-    HandleWrapper& operator =(HandleType value)
+    HandleWrapper& operator =(HandleType value) noexcept
     {
         DBG_ASSERT(m_handle == traits::DefaultHandle);
         m_handle = value;
         return *this;
     }
 
-    HandleType* operator&() { return &m_handle; }
+    HandleType* operator&() noexcept { return &m_handle; }
 
     HandleType release() noexcept
     {
@@ -69,3 +73,5 @@ public:
 private:
     HandleType m_handle;
 };
+
+#pragma warning( pop )

src/AspNetCoreModuleV2/CommonLib/IOutputManager.h

@@ -14,7 +14,7 @@ public:
     Start() = 0;
 
     virtual
-    ~IOutputManager() {};
+    ~IOutputManager() = default;
 
     virtual
     bool

src/AspNetCoreModuleV2/CommonLib/ModuleHelpers.h

@@ -14,7 +14,26 @@ public:
     void IncrementCurrentModuleRefCount(HandleWrapper<ModuleHandleTraits> &handle)
     {
         WCHAR path[MAX_PATH];
-        THROW_LAST_ERROR_IF(!GetModuleFileName(g_hModule, path, sizeof(path)));
+        
+#pragma warning( push )
+#pragma warning ( disable : 26485 ) // Calling WinAPI causes expected array to pointer decay
+
+        THROW_LAST_ERROR_IF(!GetModuleFileName(g_hModule, path, MAX_PATH));
         THROW_LAST_ERROR_IF(!GetModuleHandleEx(0, path, &handle));
+
+#pragma warning( pop )
+    }
+
+    template<typename Func>
+    static
+    Func GetKnownProcAddress(HMODULE hModule, LPCSTR lpProcName) {
+        
+#pragma warning( push )
+#pragma warning ( disable : 26490 ) // Disable Don't use reinterpret_cast 
+        auto proc = reinterpret_cast<Func>(GetProcAddress(hModule, lpProcName));
+#pragma warning( pop )
+
+        THROW_LAST_ERROR_IF (!proc);
+        return proc;
     }
 };

src/AspNetCoreModuleV2/CommonLib/NonCopyable.h

@@ -6,6 +6,6 @@
 class NonCopyable {
 public:
   NonCopyable() = default;
-  NonCopyable(const NonCopyable&) = default;
+  NonCopyable(const NonCopyable&) = delete;
-  NonCopyable& operator=(const NonCopyable&) = default;
+  NonCopyable& operator=(const NonCopyable&) = delete;
 };

src/AspNetCoreModuleV2/CommonLib/ResultException.h

@@ -0,0 +1,19 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+#pragma once
+
+class ResultException: public std::runtime_error
+{
+public:
+    ResultException(HRESULT hr, LOCATION_ARGUMENTS_ONLY) :
+        runtime_error(format("HRESULT 0x%x returned at " LOCATION_FORMAT, hr, LOCATION_CALL_ONLY)),
+        m_hr(hr)
+    {
+    }
+
+    HRESULT GetResult() const noexcept { return m_hr; }
+
+private:
+    HRESULT m_hr;
+};

src/AspNetCoreModuleV2/CommonLib/StdWrapper.cpp

@@ -78,14 +78,14 @@ StdWrapper::StartRedirection()
 
     if (fileDescriptor == -1)
     {
-        RETURN_IF_FAILED(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
+        RETURN_HR(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
     }
 
     m_redirectedFile = _fdopen(fileDescriptor, "w");
 
     if (m_redirectedFile == nullptr)
     {
-        RETURN_IF_FAILED(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
+        RETURN_HR(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
     }
 
     // Set stdout/stderr to the newly created file.
@@ -93,13 +93,13 @@ StdWrapper::StartRedirection()
 
     if (dup2Result != 0)
     {
-        RETURN_IF_FAILED(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
+        RETURN_HR(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
     }
 
     // Removes buffering from the output
     if (setvbuf(m_stdStream, nullptr, _IONBF, 0) != 0)
     {
-        RETURN_IF_FAILED(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
+        RETURN_HR(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
     }
 
     return S_OK;
@@ -117,7 +117,7 @@ StdWrapper::StopRedirection() const
     FILE * file = _fdopen(m_previousFileDescriptor, "w");
     if (file == nullptr)
     {
-        RETURN_IF_FAILED(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
+        RETURN_HR(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
     }
 
     RETURN_LAST_ERROR_IF(!SetStdHandle(m_stdHandleNumber, reinterpret_cast<HANDLE>(_get_osfhandle(m_previousFileDescriptor))));
@@ -131,17 +131,17 @@ StdWrapper::StopRedirection() const
     const auto dup2Result = _dup2(_fileno(file), _fileno(m_stdStream));
     if (dup2Result != 0)
     {
-        RETURN_IF_FAILED(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
+        RETURN_HR(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
     }
 
     if (setvbuf(m_stdStream, nullptr, _IONBF, 0) != 0)
     {
-        RETURN_IF_FAILED(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
+        RETURN_HR(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
     }
 
     if (fclose(m_redirectedFile) != 0)
     {
-        RETURN_IF_FAILED(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
+        RETURN_HR(HRESULT_FROM_WIN32(ERROR_FILE_INVALID));
     }
 
     return S_OK;

src/AspNetCoreModuleV2/CommonLib/StringHelpers.h

@@ -15,19 +15,33 @@ template<typename ... Args>
 [[nodiscard]]
 std::wstring format(const std::wstring& format, Args ... args)
 {
-    const size_t size = swprintf(nullptr, 0, format.c_str(), args ...) + 1; // Extra char for '\0'
+    std::wstring result;
-    std::unique_ptr<wchar_t[]> formattedBuffer(new wchar_t[size]);
+    if (!format.empty())
-    swprintf(formattedBuffer.get(), size, format.c_str(), args ... );
+    {
-    return std::wstring(formattedBuffer.get(), formattedBuffer.get() + size - 1);
+        const size_t size = swprintf(nullptr, 0, format.c_str(), args ...); // Extra char for '\0'
+        result.resize(size + 1);
+        if (swprintf(result.data(), result.size(), format.c_str(), args ... ) == -1)
+        {
+            throw std::system_error(std::error_code(errno, std::system_category()));
+        }
+    }
+    return result;
 }
 
 template<typename ... Args>
 [[nodiscard]]
 std::string format(const std::string& format, Args ... args)
 {
-    const size_t size = snprintf(nullptr, 0, format.c_str(), args ...) + 1; // Extra char for '\0'
+    std::string result;
-    std::unique_ptr<char[]> formattedBuffer(new char[size]);
+    if (!format.empty())
-    snprintf(formattedBuffer.get(), size, format.c_str(), args ... );
+    {
-    return std::string(formattedBuffer.get(), formattedBuffer.get() + size - 1);
+        const size_t size = snprintf(nullptr, 0, format.c_str(), args ...); // Extra char for '\0'
+        result.resize(size + 1);
+        if (snprintf(result.data(), result.size(), format.c_str(), args ... ) == -1)
+        {
+            throw std::system_error(std::error_code(errno, std::system_category()));
+        }
+    }
+    return result;
 }
 

src/AspNetCoreModuleV2/CommonLib/WebConfigConfigurationSource.h

@@ -9,7 +9,7 @@
 class WebConfigConfigurationSource: public ConfigurationSource
 {
 public:
-    WebConfigConfigurationSource(IAppHostAdminManager *pAdminManager, IHttpApplication &pHttpApplication)
+    WebConfigConfigurationSource(IAppHostAdminManager *pAdminManager, const IHttpApplication &pHttpApplication) noexcept
         : m_manager(pAdminManager),
           m_application(pHttpApplication)
     {
@@ -19,5 +19,5 @@ public:
 
 private:
     CComPtr<IAppHostAdminManager> m_manager;
-    IHttpApplication &m_application;
+    const IHttpApplication &m_application;
 };

src/AspNetCoreModuleV2/CommonLib/application.h

@@ -58,7 +58,7 @@ public:
     }
 
     VOID
-    ReferenceApplication() override
+    ReferenceApplication() noexcept override
     {
         DBG_ASSERT(m_cRefs > 0);
 
@@ -66,7 +66,7 @@ public:
     }
 
     VOID
-    DereferenceApplication() override
+    DereferenceApplication() noexcept override
     {
         DBG_ASSERT(m_cRefs > 0);
 
@@ -77,25 +77,25 @@ public:
     }
 
     const std::wstring&
-    QueryApplicationId() const
+    QueryApplicationId() const noexcept
     {
         return m_applicationId;
     }
 
     const std::wstring&
-    QueryApplicationPhysicalPath() const
+    QueryApplicationPhysicalPath() const noexcept
     {
         return m_applicationPhysicalPath;
     }
 
     const std::wstring&
-    QueryApplicationVirtualPath() const
+    QueryApplicationVirtualPath() const noexcept
     {
         return m_applicationVirtualPath;
     }
 
     const std::wstring&
-    QueryConfigPath() const
+    QueryConfigPath() const noexcept
     {
         return m_applicationConfigPath;
     }

src/AspNetCoreModuleV2/CommonLib/exceptions.h

@@ -31,20 +31,36 @@
 #define OBSERVE_CAUGHT_EXCEPTION()                              CaughtExceptionHResult(LOCATION_INFO);
 #define RETURN_CAUGHT_EXCEPTION()                               return CaughtExceptionHResult(LOCATION_INFO);
 
-#define RETURN_HR(hr)                                           do { HRESULT __hrRet = hr; if (FAILED(__hrRet)) { LogHResultFailed(LOCATION_INFO, __hrRet); } return __hrRet; } while (0, 0)
+#define _CHECK_FAILED(expr)                                     __pragma(warning(push)) \
+    __pragma(warning(disable:4127)) /*disable condition is const warning*/ \
+    FAILED(expr) \
+    __pragma(warning(pop))
+
+#define _HR_RET(hr)                                             __pragma(warning(push)) \
+    __pragma(warning(disable:26498)) /*disable constexpr warning */ \
+    const HRESULT __hrRet = hr; \
+    __pragma(warning(pop))
+
+#define RETURN_HR(hr)                                           do { _HR_RET(hr); if (_CHECK_FAILED(__hrRet)) { LogHResultFailed(LOCATION_INFO, __hrRet); } return __hrRet; } while (0, 0)
 #define RETURN_LAST_ERROR()                                     do { return LogLastError(LOCATION_INFO); } while (0, 0)
-#define RETURN_IF_FAILED(hr)                                    do { HRESULT __hrRet = hr; if (FAILED(__hrRet)) { LogHResultFailed(LOCATION_INFO, __hrRet); return __hrRet; }} while (0, 0)
+#define RETURN_IF_FAILED(hr)                                    do { _HR_RET(hr); if (FAILED(__hrRet)) { LogHResultFailed(LOCATION_INFO, __hrRet); return __hrRet; }} while (0, 0)
 #define RETURN_LAST_ERROR_IF(condition)                         do { if (condition) { return LogLastError(LOCATION_INFO); }} while (0, 0)
 #define RETURN_LAST_ERROR_IF_NULL(ptr)                          do { if ((ptr) == nullptr) { return LogLastError(LOCATION_INFO); }} while (0, 0)
 
-#define FINISHED(hrr)                                           do { HRESULT __hrRet = hrr; LogHResultFailed(LOCATION_INFO, __hrRet); hr = __hrRet; goto Finished; } while (0, 0)
+#define _GOTO_FINISHED()                                        __pragma(warning(push)) \
-#define FINISHED_IF_FAILED(hrr)                                 do { HRESULT __hrRet = hrr; if (FAILED(__hrRet)) { LogHResultFailed(LOCATION_INFO, __hrRet); hr = __hrRet; goto Finished; }} while (0, 0)
+    __pragma(warning(disable:26438)) /*disable avoid goto warning*/ \
-#define FINISHED_IF_NULL_ALLOC(ptr)                             do { if ((ptr) == nullptr) { hr = LogHResultFailed(LOCATION_INFO, E_OUTOFMEMORY); goto Finished; }} while (0, 0)
+    goto Finished \
-#define FINISHED_LAST_ERROR_IF(condition)                       do { if (condition) { hr = LogLastError(LOCATION_INFO); goto Finished; }} while (0, 0)
+    __pragma(warning(pop))
-#define FINISHED_LAST_ERROR_IF_NULL(ptr)                        do { if ((ptr) == nullptr) { hr = LogLastError(LOCATION_INFO); goto Finished; }} while (0, 0)
+
+
+#define FINISHED(hrr)                                           do { _HR_RET(hrr); if (_CHECK_FAILED(__hrRet)) { LogHResultFailed(LOCATION_INFO, __hrRet); } hr = __hrRet; _GOTO_FINISHED(); } while (0, 0) 
+#define FINISHED_IF_FAILED(hrr)                                 do { _HR_RET(hrr); if (FAILED(__hrRet)) { LogHResultFailed(LOCATION_INFO, __hrRet); hr = __hrRet; _GOTO_FINISHED(); }} while (0, 0)
+#define FINISHED_IF_NULL_ALLOC(ptr)                             do { if ((ptr) == nullptr) { hr = LogHResultFailed(LOCATION_INFO, E_OUTOFMEMORY); _GOTO_FINISHED(); }} while (0, 0)
+#define FINISHED_LAST_ERROR_IF(condition)                       do { if (condition) { hr = LogLastError(LOCATION_INFO); _GOTO_FINISHED(); }} while (0, 0)
+#define FINISHED_LAST_ERROR_IF_NULL(ptr)                        do { if ((ptr) == nullptr) { hr = LogLastError(LOCATION_INFO); _GOTO_FINISHED(); }} while (0, 0)
 
 #define THROW_LAST_ERROR()                                      do { ThrowResultException(LOCATION_INFO, LogLastError(LOCATION_INFO)); } while (0, 0)
-#define THROW_IF_FAILED(hr)                                     do { HRESULT __hrRet = hr; if (FAILED(__hrRet)) { ThrowResultException(LOCATION_INFO, __hrRet); }} while (0, 0)
+#define THROW_IF_FAILED(hr)                                     do { _HR_RET(hr); if (FAILED(__hrRet)) { ThrowResultException(LOCATION_INFO, __hrRet); }} while (0, 0)
 #define THROW_LAST_ERROR_IF(condition)                          do { if (condition) { ThrowResultException(LOCATION_INFO, LogLastError(LOCATION_INFO)); }} while (0, 0)
 #define THROW_LAST_ERROR_IF_NULL(ptr)                           do { if ((ptr) == nullptr) { ThrowResultException(LOCATION_INFO, LogLastError(LOCATION_INFO)); }} while (0, 0)
 
@@ -57,21 +73,24 @@
 #define SUCCEEDED_LOG(hr)                                       SUCCEEDED(LOG_IF_FAILED(hr))
 #define FAILED_LOG(hr)                                          FAILED(LOG_IF_FAILED(hr))
 
-
 class ResultException: public std::runtime_error
 {
 public:
-    explicit ResultException(HRESULT hr, LOCATION_ARGUMENTS_ONLY) :
+    ResultException(HRESULT hr, LOCATION_ARGUMENTS_ONLY) :
         runtime_error(format("HRESULT 0x%x returned at " LOCATION_FORMAT, hr, LOCATION_CALL_ONLY)),
         m_hr(hr)
     {
     }
 
-    HRESULT GetResult() const { return m_hr; }
+    HRESULT GetResult() const noexcept { return m_hr; }
 
 private:
-    HRESULT m_hr;
+    
+#pragma warning( push )
+#pragma warning ( disable : 26495 ) // bug in CA: m_hr is reported as uninitialized
+    const HRESULT m_hr = S_OK;
 };
+#pragma warning( pop )
 
  __declspec(noinline) inline VOID ReportUntypedException(LOCATION_ARGUMENTS_ONLY)
 {
@@ -98,7 +117,7 @@ private:
     return condition;
 }
 
- __declspec(noinline) inline VOID ReportException(LOCATION_ARGUMENTS std::exception& exception)
+ __declspec(noinline) inline VOID ReportException(LOCATION_ARGUMENTS const std::exception& exception)
 {
     DebugPrintf(ASPNETCORE_DEBUG_FLAG_ERROR, "Exception '%s' caught at " LOCATION_FORMAT, exception.what(), LOCATION_CALL_ONLY);
 }
@@ -122,12 +141,12 @@ __declspec(noinline) inline HRESULT CaughtExceptionHResult(LOCATION_ARGUMENTS_ON
     {
         return E_OUTOFMEMORY;
     }
-    catch (ResultException& exception)
+    catch (const ResultException& exception)
     {
         ReportException(LOCATION_CALL exception);
         return exception.GetResult();
     }
-    catch (std::exception& exception)
+    catch (const std::exception& exception)
     {
         ReportException(LOCATION_CALL exception);
         return HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION);
@@ -154,7 +173,7 @@ template <typename PointerT> auto Throw_IfNullAlloc(PointerT pointer)
     }
     return pointer;
 }
-__declspec(noinline) inline std::wstring GetUnexpectedExceptionMessage(std::runtime_error& ex)
+__declspec(noinline) inline std::wstring GetUnexpectedExceptionMessage(const std::runtime_error& ex)
 {
     return format(L"Unexpected exception: %S", ex.what());
 }

src/AspNetCoreModuleV2/CommonLib/fx_ver.h

@@ -13,15 +13,15 @@ struct fx_ver_t
     fx_ver_t(int major, int minor, int patch, const std::wstring& pre);
     fx_ver_t(int major, int minor, int patch, const std::wstring& pre, const std::wstring& build);
 
-    int get_major() const { return m_major; }
+    int get_major() const noexcept { return m_major; }
-    int get_minor() const { return m_minor; }
+    int get_minor() const noexcept { return m_minor; }
-    int get_patch() const { return m_patch; }
+    int get_patch() const noexcept { return m_patch; }
 
-    void set_major(int m) { m_major = m; }
+    void set_major(int m) noexcept { m_major = m; }
-    void set_minor(int m) { m_minor = m; }
+    void set_minor(int m) noexcept { m_minor = m; }
-    void set_patch(int p) { m_patch = p; }
+    void set_patch(int p) noexcept { m_patch = p; }
 
-    bool is_prerelease() const { return !m_pre.empty(); }
+    bool is_prerelease() const noexcept { return !m_pre.empty(); }
 
     std::wstring as_str() const;
 

src/AspNetCoreModuleV2/CommonLib/hostfxroptions.h

@@ -17,7 +17,7 @@ public:
         std::filesystem::path dotnetExeLocation,
         std::filesystem::path hostFxrLocation,
         std::vector<std::wstring> arguments
-        )
+        ) noexcept
     :   m_dotnetExeLocation(std::move(dotnetExeLocation)),
         m_hostFxrLocation(std::move(hostFxrLocation)),
         m_arguments(std::move(arguments))
@@ -27,7 +27,7 @@ public:
     GetArguments(DWORD &hostfxrArgc, std::unique_ptr<PCWSTR[]> &hostfxrArgv) const
     {
         hostfxrArgc = static_cast<DWORD>(m_arguments.size());
-        hostfxrArgv = std::unique_ptr<PCWSTR[]>(new PCWSTR[hostfxrArgc]);
+        hostfxrArgv = std::make_unique<PCWSTR[]>(hostfxrArgc);
         for (DWORD i = 0; i < hostfxrArgc; ++i)
         {
             hostfxrArgv[i] = m_arguments[i].c_str();
@@ -35,13 +35,13 @@ public:
     }
 
     const std::filesystem::path&
-    GetHostFxrLocation() const
+    GetHostFxrLocation() const noexcept
     {
         return m_hostFxrLocation;
     }
 
     const std::filesystem::path&
-    GetDotnetExeLocation() const
+    GetDotnetExeLocation() const noexcept
     {
         return m_dotnetExeLocation;
     }

src/AspNetCoreModuleV2/CommonLib/iapplication.h

@@ -44,7 +44,7 @@ public:
     HRESULT
     CreateHandler(
         _In_  IHttpContext       *pHttpContext,
-        _Out_ IREQUEST_HANDLER  **pRequestHandler) = 0;
+        _Outptr_ IREQUEST_HANDLER  **pRequestHandler) = 0;
 };
 
 struct IAPPLICATION_DELETER

src/AspNetCoreModuleV2/CommonLib/requesthandler.h

@@ -14,13 +14,13 @@ class REQUEST_HANDLER: public virtual IREQUEST_HANDLER
 
 public:
     VOID
-    ReferenceRequestHandler() override
+    ReferenceRequestHandler() noexcept override 
     {
         InterlockedIncrement(&m_cRefs);
     }
 
     VOID
-    DereferenceRequestHandler() override
+    DereferenceRequestHandler() noexcept override
     {
         DBG_ASSERT(m_cRefs != 0);
 

src/AspNetCoreModuleV2/DefaultRules.ruleset

@@ -0,0 +1,432 @@
+<?xml version="1.0" encoding="utf-8"?>
+<RuleSet Name="DefaultRules" ToolsVersion="15.0">
+  <Include Path="allrules.ruleset" Action="Default" />
+  <Rules AnalyzerId="Microsoft.Analyzers.NativeCodeAnalysis" RuleNamespace="Microsoft.Rules.Native">
+    <Rule Id="C26100" Action="Error" />
+    <Rule Id="C26101" Action="Error" />
+    <Rule Id="C26105" Action="Error" />
+    <Rule Id="C26110" Action="Error" />
+    <Rule Id="C26111" Action="Error" />
+    <Rule Id="C26112" Action="Error" />
+    <Rule Id="C26115" Action="Error" />
+    <Rule Id="C26116" Action="Error" />
+    <Rule Id="C26117" Action="Error" />
+    <Rule Id="C26130" Action="Error" />
+    <Rule Id="C26135" Action="Error" />
+    <Rule Id="C26140" Action="Error" />
+    <Rule Id="C26160" Action="Error" />
+    <Rule Id="C26165" Action="Error" />
+    <Rule Id="C26166" Action="Error" />
+    <Rule Id="C26167" Action="Error" />
+    <Rule Id="C26400" Action="Error" />
+    <Rule Id="C26401" Action="Error" />
+    <Rule Id="C26402" Action="Error" />
+    <Rule Id="C26403" Action="Error" />
+    <Rule Id="C26404" Action="Error" />
+    <Rule Id="C26405" Action="Error" />
+    <Rule Id="C26406" Action="Error" />
+    <Rule Id="C26407" Action="Error" />
+    <Rule Id="C26408" Action="Error" />
+    <Rule Id="C26409" Action="Error" />
+    <Rule Id="C26410" Action="Error" />
+    <Rule Id="C26411" Action="Error" />
+    <Rule Id="C26414" Action="Error" />
+    <Rule Id="C26415" Action="Error" />
+    <Rule Id="C26416" Action="Error" />
+    <Rule Id="C26417" Action="Error" />
+    <Rule Id="C26418" Action="Error" />
+    <Rule Id="C26426" Action="Error" />
+    <Rule Id="C26427" Action="Error" />
+    <Rule Id="C26429" Action="None" />
+    <Rule Id="C26430" Action="Error" />
+    <Rule Id="C26431" Action="Error" />
+    <Rule Id="C26432" Action="None" />
+    <Rule Id="C26433" Action="Error" />
+    <Rule Id="C26434" Action="Error" />
+    <Rule Id="C26435" Action="Error" />
+    <Rule Id="C26436" Action="Error" />
+    <Rule Id="C26437" Action="Error" />
+    <Rule Id="C26438" Action="Error" />
+    <Rule Id="C26439" Action="Error" />
+    <Rule Id="C26440" Action="Error" />
+    <Rule Id="C26441" Action="Error" />
+    <Rule Id="C26443" Action="Error" />
+    <Rule Id="C26444" Action="Error" />
+    <Rule Id="C26445" Action="Error" />
+    <Rule Id="C26446" Action="None" />
+    <Rule Id="C26447" Action="Error" />
+    <Rule Id="C26448" Action="None" />
+    <Rule Id="C26449" Action="Error" />
+    <Rule Id="C26450" Action="Error" />
+    <Rule Id="C26451" Action="Error" />
+    <Rule Id="C26452" Action="Error" />
+    <Rule Id="C26453" Action="Error" />
+    <Rule Id="C26454" Action="Error" />
+    <Rule Id="C26459" Action="Error" />
+    <Rule Id="C26460" Action="Error" />
+    <Rule Id="C26461" Action="Error" />
+    <Rule Id="C26462" Action="Error" />
+    <Rule Id="C26463" Action="Error" />
+    <Rule Id="C26464" Action="Error" />
+    <Rule Id="C26465" Action="Error" />
+    <Rule Id="C26466" Action="Error" />
+    <Rule Id="C26471" Action="Error" />
+    <Rule Id="C26472" Action="None" />
+    <Rule Id="C26473" Action="Error" />
+    <Rule Id="C26474" Action="Error" />
+    <Rule Id="C26475" Action="Error" />
+    <Rule Id="C26476" Action="Error" />
+    <Rule Id="C26477" Action="Error" />
+    <Rule Id="C26481" Action="Error" />
+    <Rule Id="C26482" Action="Error" />
+    <Rule Id="C26483" Action="Error" />
+    <Rule Id="C26485" Action="Error" />
+    <Rule Id="C26486" Action="None" />
+    <Rule Id="C26487" Action="Error" />
+    <Rule Id="C26489" Action="None" />
+    <Rule Id="C26490" Action="Error" />
+    <Rule Id="C26491" Action="Error" />
+    <Rule Id="C26492" Action="Error" />
+    <Rule Id="C26493" Action="Error" />
+    <Rule Id="C26494" Action="Error" />
+    <Rule Id="C26495" Action="Error" />
+    <Rule Id="C26496" Action="Error" />
+    <Rule Id="C26497" Action="Error" />
+    <Rule Id="C26498" Action="Error" />
+    <Rule Id="C28020" Action="Error" />
+    <Rule Id="C28021" Action="Error" />
+    <Rule Id="C28022" Action="Error" />
+    <Rule Id="C28023" Action="Error" />
+    <Rule Id="C28024" Action="Error" />
+    <Rule Id="C28039" Action="Error" />
+    <Rule Id="C28101" Action="Error" />
+    <Rule Id="C28103" Action="Error" />
+    <Rule Id="C28104" Action="Error" />
+    <Rule Id="C28105" Action="Error" />
+    <Rule Id="C28106" Action="Error" />
+    <Rule Id="C28107" Action="Error" />
+    <Rule Id="C28108" Action="Error" />
+    <Rule Id="C28109" Action="Error" />
+    <Rule Id="C28110" Action="Error" />
+    <Rule Id="C28111" Action="Error" />
+    <Rule Id="C28112" Action="Error" />
+    <Rule Id="C28113" Action="Error" />
+    <Rule Id="C28114" Action="Error" />
+    <Rule Id="C28120" Action="Error" />
+    <Rule Id="C28121" Action="Error" />
+    <Rule Id="C28122" Action="Error" />
+    <Rule Id="C28123" Action="Error" />
+    <Rule Id="C28124" Action="Error" />
+    <Rule Id="C28125" Action="Error" />
+    <Rule Id="C28126" Action="Error" />
+    <Rule Id="C28127" Action="Error" />
+    <Rule Id="C28128" Action="Error" />
+    <Rule Id="C28129" Action="Error" />
+    <Rule Id="C28131" Action="Error" />
+    <Rule Id="C28132" Action="Error" />
+    <Rule Id="C28133" Action="Error" />
+    <Rule Id="C28134" Action="Error" />
+    <Rule Id="C28135" Action="Error" />
+    <Rule Id="C28137" Action="Error" />
+    <Rule Id="C28138" Action="Error" />
+    <Rule Id="C28141" Action="Error" />
+    <Rule Id="C28143" Action="Error" />
+    <Rule Id="C28144" Action="Error" />
+    <Rule Id="C28145" Action="Error" />
+    <Rule Id="C28146" Action="Error" />
+    <Rule Id="C28147" Action="Error" />
+    <Rule Id="C28150" Action="Error" />
+    <Rule Id="C28151" Action="Error" />
+    <Rule Id="C28152" Action="Error" />
+    <Rule Id="C28153" Action="Error" />
+    <Rule Id="C28156" Action="Error" />
+    <Rule Id="C28157" Action="Error" />
+    <Rule Id="C28158" Action="Error" />
+    <Rule Id="C28159" Action="Error" />
+    <Rule Id="C28160" Action="Error" />
+    <Rule Id="C28161" Action="Error" />
+    <Rule Id="C28162" Action="Error" />
+    <Rule Id="C28163" Action="Error" />
+    <Rule Id="C28164" Action="Error" />
+    <Rule Id="C28165" Action="Error" />
+    <Rule Id="C28166" Action="Error" />
+    <Rule Id="C28167" Action="Error" />
+    <Rule Id="C28168" Action="Error" />
+    <Rule Id="C28169" Action="Error" />
+    <Rule Id="C28170" Action="Error" />
+    <Rule Id="C28171" Action="Error" />
+    <Rule Id="C28172" Action="Error" />
+    <Rule Id="C28173" Action="Error" />
+    <Rule Id="C28175" Action="Error" />
+    <Rule Id="C28176" Action="Error" />
+    <Rule Id="C28182" Action="Error" />
+    <Rule Id="C28183" Action="Error" />
+    <Rule Id="C28193" Action="Error" />
+    <Rule Id="C28194" Action="Error" />
+    <Rule Id="C28195" Action="Error" />
+    <Rule Id="C28196" Action="Error" />
+    <Rule Id="C28197" Action="Error" />
+    <Rule Id="C28198" Action="Error" />
+    <Rule Id="C28199" Action="Error" />
+    <Rule Id="C28202" Action="Error" />
+    <Rule Id="C28203" Action="Error" />
+    <Rule Id="C28204" Action="Error" />
+    <Rule Id="C28205" Action="Error" />
+    <Rule Id="C28206" Action="Error" />
+    <Rule Id="C28207" Action="Error" />
+    <Rule Id="C28208" Action="Error" />
+    <Rule Id="C28209" Action="Error" />
+    <Rule Id="C28210" Action="Error" />
+    <Rule Id="C28211" Action="Error" />
+    <Rule Id="C28212" Action="Error" />
+    <Rule Id="C28213" Action="Error" />
+    <Rule Id="C28214" Action="Error" />
+    <Rule Id="C28215" Action="Error" />
+    <Rule Id="C28216" Action="Error" />
+    <Rule Id="C28217" Action="Error" />
+    <Rule Id="C28218" Action="Error" />
+    <Rule Id="C28219" Action="Error" />
+    <Rule Id="C28220" Action="Error" />
+    <Rule Id="C28221" Action="Error" />
+    <Rule Id="C28222" Action="Error" />
+    <Rule Id="C28223" Action="Error" />
+    <Rule Id="C28224" Action="Error" />
+    <Rule Id="C28225" Action="Error" />
+    <Rule Id="C28226" Action="Error" />
+    <Rule Id="C28227" Action="Error" />
+    <Rule Id="C28228" Action="Error" />
+    <Rule Id="C28229" Action="Error" />
+    <Rule Id="C28230" Action="Error" />
+    <Rule Id="C28231" Action="Error" />
+    <Rule Id="C28232" Action="Error" />
+    <Rule Id="C28233" Action="Error" />
+    <Rule Id="C28234" Action="Error" />
+    <Rule Id="C28235" Action="Error" />
+    <Rule Id="C28236" Action="Error" />
+    <Rule Id="C28237" Action="Error" />
+    <Rule Id="C28238" Action="Error" />
+    <Rule Id="C28239" Action="Error" />
+    <Rule Id="C28240" Action="Error" />
+    <Rule Id="C28241" Action="Error" />
+    <Rule Id="C28243" Action="Error" />
+    <Rule Id="C28244" Action="Error" />
+    <Rule Id="C28245" Action="Error" />
+    <Rule Id="C28246" Action="Error" />
+    <Rule Id="C28250" Action="Error" />
+    <Rule Id="C28251" Action="Error" />
+    <Rule Id="C28252" Action="Error" />
+    <Rule Id="C28253" Action="Error" />
+    <Rule Id="C28254" Action="Error" />
+    <Rule Id="C28260" Action="Error" />
+    <Rule Id="C28262" Action="Error" />
+    <Rule Id="C28263" Action="Error" />
+    <Rule Id="C28266" Action="Error" />
+    <Rule Id="C28267" Action="Error" />
+    <Rule Id="C28272" Action="Error" />
+    <Rule Id="C28273" Action="Error" />
+    <Rule Id="C28275" Action="Error" />
+    <Rule Id="C28278" Action="Error" />
+    <Rule Id="C28279" Action="Error" />
+    <Rule Id="C28280" Action="Error" />
+    <Rule Id="C28282" Action="Error" />
+    <Rule Id="C28283" Action="Error" />
+    <Rule Id="C28284" Action="Error" />
+    <Rule Id="C28285" Action="Error" />
+    <Rule Id="C28286" Action="Error" />
+    <Rule Id="C28287" Action="Error" />
+    <Rule Id="C28288" Action="Error" />
+    <Rule Id="C28289" Action="Error" />
+    <Rule Id="C28290" Action="Error" />
+    <Rule Id="C28291" Action="Error" />
+    <Rule Id="C28300" Action="Error" />
+    <Rule Id="C28301" Action="Error" />
+    <Rule Id="C28302" Action="Error" />
+    <Rule Id="C28303" Action="Error" />
+    <Rule Id="C28304" Action="Error" />
+    <Rule Id="C28305" Action="Error" />
+    <Rule Id="C28306" Action="Error" />
+    <Rule Id="C28307" Action="Error" />
+    <Rule Id="C28308" Action="Error" />
+    <Rule Id="C28309" Action="Error" />
+    <Rule Id="C28350" Action="Error" />
+    <Rule Id="C28351" Action="Error" />
+    <Rule Id="C28601" Action="Error" />
+    <Rule Id="C28602" Action="Error" />
+    <Rule Id="C28604" Action="Error" />
+    <Rule Id="C28615" Action="Error" />
+    <Rule Id="C28616" Action="Error" />
+    <Rule Id="C28617" Action="Error" />
+    <Rule Id="C28623" Action="Error" />
+    <Rule Id="C28624" Action="Error" />
+    <Rule Id="C28625" Action="Error" />
+    <Rule Id="C28636" Action="Error" />
+    <Rule Id="C28637" Action="Error" />
+    <Rule Id="C28638" Action="Error" />
+    <Rule Id="C28639" Action="Error" />
+    <Rule Id="C28640" Action="Error" />
+    <Rule Id="C28645" Action="Error" />
+    <Rule Id="C28648" Action="Error" />
+    <Rule Id="C28649" Action="Error" />
+    <Rule Id="C28650" Action="Error" />
+    <Rule Id="C28714" Action="Error" />
+    <Rule Id="C28715" Action="Error" />
+    <Rule Id="C28716" Action="Error" />
+    <Rule Id="C28717" Action="Error" />
+    <Rule Id="C28719" Action="Error" />
+    <Rule Id="C28720" Action="Error" />
+    <Rule Id="C28721" Action="Error" />
+    <Rule Id="C28726" Action="Error" />
+    <Rule Id="C28727" Action="Error" />
+    <Rule Id="C28730" Action="Error" />
+    <Rule Id="C28735" Action="Error" />
+    <Rule Id="C28736" Action="Error" />
+    <Rule Id="C28750" Action="Error" />
+    <Rule Id="C28751" Action="Error" />
+    <Rule Id="C6001" Action="Error" />
+    <Rule Id="C6011" Action="Error" />
+    <Rule Id="C6014" Action="Error" />
+    <Rule Id="C6029" Action="Error" />
+    <Rule Id="C6031" Action="Error" />
+    <Rule Id="C6053" Action="Error" />
+    <Rule Id="C6054" Action="Error" />
+    <Rule Id="C6059" Action="Error" />
+    <Rule Id="C6063" Action="Error" />
+    <Rule Id="C6064" Action="Error" />
+    <Rule Id="C6066" Action="Error" />
+    <Rule Id="C6067" Action="Error" />
+    <Rule Id="C6101" Action="Error" />
+    <Rule Id="C6200" Action="Error" />
+    <Rule Id="C6201" Action="Error" />
+    <Rule Id="C6211" Action="Error" />
+    <Rule Id="C6214" Action="Error" />
+    <Rule Id="C6215" Action="Error" />
+    <Rule Id="C6216" Action="Error" />
+    <Rule Id="C6217" Action="Error" />
+    <Rule Id="C6219" Action="Error" />
+    <Rule Id="C6220" Action="Error" />
+    <Rule Id="C6221" Action="Error" />
+    <Rule Id="C6225" Action="Error" />
+    <Rule Id="C6226" Action="Error" />
+    <Rule Id="C6230" Action="Error" />
+    <Rule Id="C6235" Action="Error" />
+    <Rule Id="C6236" Action="Error" />
+    <Rule Id="C6237" Action="Error" />
+    <Rule Id="C6239" Action="Error" />
+    <Rule Id="C6240" Action="Error" />
+    <Rule Id="C6242" Action="Error" />
+    <Rule Id="C6244" Action="Error" />
+    <Rule Id="C6246" Action="Error" />
+    <Rule Id="C6248" Action="Error" />
+    <Rule Id="C6250" Action="Error" />
+    <Rule Id="C6255" Action="Error" />
+    <Rule Id="C6258" Action="Error" />
+    <Rule Id="C6259" Action="Error" />
+    <Rule Id="C6260" Action="Error" />
+    <Rule Id="C6262" Action="Error" />
+    <Rule Id="C6263" Action="Error" />
+    <Rule Id="C6268" Action="Error" />
+    <Rule Id="C6269" Action="Error" />
+    <Rule Id="C6270" Action="Error" />
+    <Rule Id="C6271" Action="Error" />
+    <Rule Id="C6272" Action="Error" />
+    <Rule Id="C6273" Action="Error" />
+    <Rule Id="C6274" Action="Error" />
+    <Rule Id="C6276" Action="Error" />
+    <Rule Id="C6277" Action="Error" />
+    <Rule Id="C6278" Action="Error" />
+    <Rule Id="C6279" Action="Error" />
+    <Rule Id="C6280" Action="Error" />
+    <Rule Id="C6281" Action="Error" />
+    <Rule Id="C6282" Action="Error" />
+    <Rule Id="C6283" Action="Error" />
+    <Rule Id="C6284" Action="Error" />
+    <Rule Id="C6285" Action="Error" />
+    <Rule Id="C6286" Action="Error" />
+    <Rule Id="C6287" Action="Error" />
+    <Rule Id="C6288" Action="Error" />
+    <Rule Id="C6289" Action="Error" />
+    <Rule Id="C6290" Action="Error" />
+    <Rule Id="C6291" Action="Error" />
+    <Rule Id="C6292" Action="Error" />
+    <Rule Id="C6293" Action="Error" />
+    <Rule Id="C6294" Action="Error" />
+    <Rule Id="C6295" Action="Error" />
+    <Rule Id="C6296" Action="Error" />
+    <Rule Id="C6297" Action="Error" />
+    <Rule Id="C6298" Action="Error" />
+    <Rule Id="C6299" Action="Error" />
+    <Rule Id="C6302" Action="Error" />
+    <Rule Id="C6303" Action="Error" />
+    <Rule Id="C6305" Action="Error" />
+    <Rule Id="C6306" Action="Error" />
+    <Rule Id="C6308" Action="Error" />
+    <Rule Id="C6310" Action="Error" />
+    <Rule Id="C6312" Action="Error" />
+    <Rule Id="C6313" Action="Error" />
+    <Rule Id="C6314" Action="Error" />
+    <Rule Id="C6315" Action="Error" />
+    <Rule Id="C6316" Action="Error" />
+    <Rule Id="C6317" Action="Error" />
+    <Rule Id="C6318" Action="Error" />
+    <Rule Id="C6319" Action="Error" />
+    <Rule Id="C6320" Action="Error" />
+    <Rule Id="C6322" Action="Error" />
+    <Rule Id="C6323" Action="Error" />
+    <Rule Id="C6324" Action="Error" />
+    <Rule Id="C6326" Action="Error" />
+    <Rule Id="C6328" Action="Error" />
+    <Rule Id="C6329" Action="Error" />
+    <Rule Id="C6330" Action="Error" />
+    <Rule Id="C6331" Action="Error" />
+    <Rule Id="C6332" Action="Error" />
+    <Rule Id="C6333" Action="Error" />
+    <Rule Id="C6334" Action="Error" />
+    <Rule Id="C6335" Action="Error" />
+    <Rule Id="C6336" Action="Error" />
+    <Rule Id="C6340" Action="Error" />
+    <Rule Id="C6381" Action="Error" />
+    <Rule Id="C6383" Action="Error" />
+    <Rule Id="C6384" Action="Error" />
+    <Rule Id="C6385" Action="Error" />
+    <Rule Id="C6386" Action="Error" />
+    <Rule Id="C6387" Action="Error" />
+    <Rule Id="C6388" Action="Error" />
+    <Rule Id="C6400" Action="Error" />
+    <Rule Id="C6401" Action="Error" />
+    <Rule Id="C6411" Action="Error" />
+    <Rule Id="C6412" Action="Error" />
+    <Rule Id="C6500" Action="Error" />
+    <Rule Id="C6501" Action="Error" />
+    <Rule Id="C6503" Action="Error" />
+    <Rule Id="C6504" Action="Error" />
+    <Rule Id="C6505" Action="Error" />
+    <Rule Id="C6506" Action="Error" />
+    <Rule Id="C6508" Action="Error" />
+    <Rule Id="C6509" Action="Error" />
+    <Rule Id="C6510" Action="Error" />
+    <Rule Id="C6511" Action="Error" />
+    <Rule Id="C6513" Action="Error" />
+    <Rule Id="C6514" Action="Error" />
+    <Rule Id="C6515" Action="Error" />
+    <Rule Id="C6516" Action="Error" />
+    <Rule Id="C6517" Action="Error" />
+    <Rule Id="C6518" Action="Error" />
+    <Rule Id="C6522" Action="Error" />
+    <Rule Id="C6525" Action="Error" />
+    <Rule Id="C6527" Action="Error" />
+    <Rule Id="C6530" Action="Error" />
+    <Rule Id="C6540" Action="Error" />
+    <Rule Id="C6551" Action="Error" />
+    <Rule Id="C6552" Action="Error" />
+    <Rule Id="C6701" Action="Error" />
+    <Rule Id="C6702" Action="Error" />
+    <Rule Id="C6703" Action="Error" />
+    <Rule Id="C6704" Action="Error" />
+    <Rule Id="C6705" Action="Error" />
+    <Rule Id="C6706" Action="Error" />
+    <Rule Id="C6707" Action="Error" />
+    <Rule Id="C6993" Action="Error" />
+    <Rule Id="C6995" Action="Error" />
+    <Rule Id="C6997" Action="Error" />
+  </Rules>
+</RuleSet>

src/AspNetCoreModuleV2/IISLib/acache.cpp

@@ -3,6 +3,9 @@
 
 #include "precomp.h"
 
+#pragma warning( push )
+#pragma warning ( disable : ALL_CODE_ANALYSIS_WARNINGS )
+
 LONG    ALLOC_CACHE_HANDLER::sm_nFillPattern = 0xACA50000;
 HANDLE  ALLOC_CACHE_HANDLER::sm_hHeap;
 
@@ -440,4 +443,6 @@ Finished:
     }
 
     return fRet;
-}
+}
+
+#pragma warning( pop )

src/AspNetCoreModuleV2/IISLib/buffer.h

@@ -4,7 +4,10 @@
 #pragma once
 
 #include <crtdbg.h>
+#include <CodeAnalysis/Warnings.h>
 
+#pragma warning( push )
+#pragma warning ( disable : ALL_CODE_ANALYSIS_WARNINGS )
 
 //
 // BUFFER_T class shouldn't be used directly. Use BUFFER specialization class instead.
@@ -269,3 +272,5 @@ C_ASSERT( sizeof(VOID*) <= sizeof(ULONGLONG) );
 
 #define INLINE_BUFFER_INIT( _name )     \
     _name( (BYTE*)__aqw##_name, sizeof( __aqw##_name ) )
+
+#pragma warning( pop )

src/AspNetCoreModuleV2/IISLib/multisz.h

@@ -6,6 +6,10 @@
 
 #include "stringu.h"
 #include "ntassert.h"
+#include <CodeAnalysis/Warnings.h>
+
+#pragma warning( push )
+#pragma warning ( disable : ALL_CODE_ANALYSIS_WARNINGS )
 
 /*++
   class MULTISZ:
@@ -221,5 +225,6 @@ SplitCommaDelimitedString(
     MULTISZ *                   pmszList
 );
 
-#endif // !_MULTISZ_HXX_
+#pragma warning( pop )
 
+#endif // !_MULTISZ_HXX_

src/AspNetCoreModuleV2/IISLib/percpu.h

@@ -3,6 +3,9 @@
 
 #pragma once
 
+#pragma warning( push )
+#pragma warning ( disable : 26451 )
+
 template<typename T>
 class PER_CPU
 {
@@ -302,4 +305,6 @@ Return:
     *pCacheLineSize = SYSTEM_CACHE_ALIGNMENT_SIZE;
 
     return S_OK;
-}
+}
+
+#pragma warning( pop )

src/AspNetCoreModuleV2/IISLib/stringa.h

@@ -7,6 +7,10 @@
 #include "macros.h"
 #include <strsafe.h>
 
+
+#pragma warning( push )
+#pragma warning ( disable : ALL_CODE_ANALYSIS_WARNINGS )
+
 class STRA
 {
 
@@ -513,3 +517,5 @@ CHAR* InitHelper(__out CHAR (&psz)[size])
                                 STRA  name;
 
 #define INLINE_STRA_INIT(name) name(InitHelper(__ach##name), sizeof(__ach##name))
+
+#pragma warning( pop )

src/AspNetCoreModuleV2/IISLib/stringu.cpp

@@ -1,10 +1,12 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the MIT License. See License.txt in the project root for license information.
 
-#pragma warning (disable : 4267)
 
 #include "precomp.h"
 
+#pragma warning( push )
+#pragma warning ( disable : 4267 ALL_CODE_ANALYSIS_WARNINGS )
+
 STRU::STRU(
     VOID
 ) : m_cchLen( 0 )
@@ -1199,25 +1201,17 @@ STRU::ExpandEnvironmentVariables(
     __out STRU *                  pstrExpandedString
     )
 /*++
-
 Routine Description:
-
     Expand the environment variables in a string
-
 Arguments:
-
     pszString - String with environment variables to expand
     pstrExpandedString - Receives expanded string on success
-
 Return Value:
-
     HRESULT
-
 --*/
 {
     HRESULT                 hr              = S_OK;
     DWORD                   cchNewSize      = 0;
-
     if ( pszString == NULL ||
          pstrExpandedString == NULL )
     {
@@ -1225,7 +1219,6 @@ Return Value:
         hr = HRESULT_FROM_WIN32( ERROR_INVALID_PARAMETER );
         goto Exit;
     }
-
     cchNewSize = ExpandEnvironmentStrings( pszString,
                                            pstrExpandedString->QueryStr(),
                                            pstrExpandedString->QuerySizeCCH() );
@@ -1234,7 +1227,6 @@ Return Value:
         hr = HRESULT_FROM_WIN32( GetLastError() );
         goto Exit;
     }
-
     if ( cchNewSize > pstrExpandedString->QuerySizeCCH() )
     {
         hr = pstrExpandedString->Resize(
@@ -1244,13 +1236,11 @@ Return Value:
         {
             goto Exit;
         }
-
         cchNewSize = ExpandEnvironmentStrings(
             pszString,
             pstrExpandedString->QueryStr(),
             pstrExpandedString->QuerySizeCCH()
             );
-
         if ( cchNewSize == 0 ||
              cchNewSize > pstrExpandedString->QuerySizeCCH() )
         {
@@ -1258,14 +1248,10 @@ Return Value:
             goto Exit;
         }
     }
-
     pstrExpandedString->SyncWithBuffer();
-
     hr = S_OK;
-
 Exit:
-
     return hr;
 }
 
-#pragma warning(default:4267)
+#pragma warning( pop )

src/AspNetCoreModuleV2/IISLib/stringu.h

@@ -4,8 +4,12 @@
 #pragma once
 
 #include "buffer.h"
+#include <CodeAnalysis/Warnings.h>
 #include <strsafe.h>
 
+#pragma warning( push )
+#pragma warning ( disable : ALL_CODE_ANALYSIS_WARNINGS )
+
 class STRU
 {
 
@@ -349,13 +353,12 @@ public:
         __in PCWSTR pwszFormatString,
         va_list     argsList
     );
-
+    
     static
     HRESULT  ExpandEnvironmentVariables(
         __in PCWSTR                  pszString,
         __out STRU *                 pstrExpandedString
     );
-
 private:
 
     //
@@ -425,3 +428,4 @@ MakePathCanonicalizationProof(
     IN PCWSTR               pszName,
     OUT STRU *              pstrPath
 );
+#pragma warning( pop )

src/AspNetCoreModuleV2/InProcessRequestHandler/managedexports.cpp

@@ -184,7 +184,7 @@ http_get_application_properties(
         return E_FAIL;
     }
 
-    auto pConfiguration = pInProcessApplication->QueryConfig();
+    const auto& pConfiguration = pInProcessApplication->QueryConfig();
 
     pIISCofigurationData->pInProcessApplication = pInProcessApplication;
     pIISCofigurationData->pwzFullApplicationPath = SysAllocString(pInProcessApplication->QueryApplicationPhysicalPath().c_str());

src/AspNetCoreModuleV2/RequestHandlerLib/AppOfflineTrackingApplication.cpp

@@ -38,7 +38,7 @@ HRESULT AppOfflineTrackingApplication::StartMonitoringAppOflineImpl()
 {
     if (m_fileWatcher)
     {
-        RETURN_IF_FAILED(E_UNEXPECTED);
+        RETURN_HR(E_UNEXPECTED);
     }
 
     m_fileWatcher = std::make_unique<FILE_WATCHER>();