Microsoft XSSDetect

XSSDetect is a static code analysis tool that helps identify Cross-Site s cripting security flaws found within Web applications. It is able to scan compiled managed assemblies (C#, Visual Basic .NET, J#) and analyze dataflow paths from sources of user-controlled input to vulnerable outputs. It also detects whether proper encoding or filtering has been applied to the data and will ignore such "sanitized" paths

微软出的静态代码分析工具