Has anyone seen, used or written a X++ (MS Dynamics) scanner?

Hi there, I’m rather unsure about the category, so I post this here. Pls. move if inappropriate.
We have quite a “big” app written in X++ (that’s a very heavily customized MS Dynamics) and even though it’s on the brink of EOL I still would love to scan it via SonarQube.

Point is I need to put together a risk report and unfortunately that homebrew customized X++ thingie is involved in quite many business processes.

Has anyone heard of or used a scanner for that specific language or has probably an idea on how to write a custom scanner for this language?
I do know how to code, but I’m not a crack at it, so I might need some introduction into developing such a plugin.
Thanks a lot in advance.


Hi Michael
If this language is quite widly used, I could start a work for/with you on X++.
I would need a syntax description of the language (EBNF if possible), and a huge help from you to define the specific rules you need.
If there a potential for customers ?
Thanks for your answers

Hi Didier, thanks for your answer.
Well, I’m not sure if it’s that widely used. Like Java or C#
It is the language for Microsoft Dynamics. I “think” that is widely used for sure in a contextual Microsoft environment such as ours.
I got it that MS is culling the on premise MS Dynamics installs and moves everything they have in the cloud.
If it is used there a lot more, or how many programmers actually use X++ I can’t say.

As for a description you can take a look here:
There’s also a Sytax description a bit further down on that page.

EBNF would be this: “https://docs.microsoft.com/en-us/dynamicsax-2012/developer/ebnf-overview” as far as I can determine.

As for the rules, excellent point!
I suppose mostly it would be the same as for all the languages:

  • missing coverage
  • not used definitions or branches
  • dangerous usage of data like user input or no usage of DTOs.
  • too high of a complexity.
  • TBD

As for how exactly X++ works I’m at a loss for now, but that can be changed if need be.
All I know for sure is that our programmers heavily twisted it around to realize some functionality which normally couldn’t or maybe better “shouldn’t” be possible.


It seams quite close to the C# syntax, good news I have this in my store ! Could we go ahead via skype (cruette.d)?

Hi Didier,
great news. :smiley:

Yes, we can. I can make some room on WED June 17th. When would it be convenient for you?
Thanks for putting in all that effort already.

I gote get skype first though. Most likely I’ll have to use it privately, as my company doesn’t do custom installs.