find-sec-bugs | SpotBugs plugin for security audits | Code Analyzer library

by find-sec-bugs Java Version: version-1.12.0 License: LGPL-3.0

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | find-sec-bugs Summary

find-sec-bugs is a Java library typically used in Code Quality, Code Analyzer applications. find-sec-bugs has build file available, it has a Weak Copyleft License and it has high support. However find-sec-bugs has 62 bugs and it has 109 vulnerabilities. You can download it from GitHub, Maven.

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

Support

Quality

Security

License

Reuse

Support

find-sec-bugs has a highly active ecosystem.

It has 2073 star(s) with 458 fork(s). There are 90 watchers for this library.

It had no major release in the last 12 months.

There are 84 open issues and 324 have been closed. On average issues are closed in 103 days. There are 3 open pull requests and 0 closed requests.

It has a negative sentiment in the developer community.

The latest version of find-sec-bugs is version-1.12.0

Quality

find-sec-bugs has 62 bugs (36 blocker, 1 critical, 17 major, 8 minor) and 4101 code smells.

Security

find-sec-bugs has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

find-sec-bugs code analysis shows 109 unresolved vulnerabilities (82 blocker, 23 critical, 4 major, 0 minor).

There are 93 security hotspots that need review.

License

find-sec-bugs is licensed under the LGPL-3.0 License. This license is Weak Copyleft.

Weak Copyleft licenses have some restrictions, but you can use them in commercial projects.

Reuse

find-sec-bugs releases are available to install and integrate.

Deployable package is available in Maven.

Build file is available. You can build the component from source.

find-sec-bugs saves you 50658 person hours of effort in developing the same functionality from scratch.

It has 58838 lines of code, 3985 functions and 1186 files.

It has low code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed find-sec-bugs and discovered the below as its top functions. This is intended to give you an instant insight into find-sec-bugs implemented functionality, and help decide if they suit your requirements.

Analyzes a method invocation
Get the sinks for a given invoke instruction
Get the number of arguments in an InvokeInstruction
Check all sinks for a method invocation
Overrides the visitor to look for classes that are known to be static
Looks to see if this method has multiple external calls
Overrides the visitor to look for the method calls to get the value of the stack
Looks for the hash function that looks for the given algorithm
Initializes the initial state of a TaintFrame
Checks if a slot is tainted by a parameter
Overrides the visitor to look for new schema methods
Overrides the visitor to collect null values
Overrides the visitor to look for calls to parse XML
Overrides the visitor to check for validators
Returns the injectable parameters of the given method
Overrides the visitor to look for jspacing
Overrides the visitor to look for validations on the method
Overrides the visitor to look for methods that don t work
Compute the number of required parameters
Implements the visitor to look for localhost
Visit a load instruction
Handles a load instruction
Overrides the visitor to look for calls to xml files
Overrides the visitor to look for the parameters of a return type
Implements the visitor to look for methods that are static initializers
Load a map from the parameters

Get all kandi verified functions for this library.

find-sec-bugs Key Features

No Key Features are available at this moment for find-sec-bugs.

find-sec-bugs Examples and Code Snippets

No Code Snippets are available at this moment for find-sec-bugs.

Community Discussions

Trending Discussions on find-sec-bugs

Path traversal vulnerabilities not found at Scala code

QUESTION

Path traversal vulnerabilities not found at Scala code

Asked 2018-Dec-06 at 13:34

I have been trying to scan my code by using SonarQube + FindBugs + FindSecBugs plugins.

The idea is to detect vulnerabilities in the code, and as it says in the github project subject, it works with scala https://github.com/find-sec-bugs/find-sec-bugs

I have installed the plugin as the documentation says, and tried a few scans but nothing related to vulnerabilities in scala is coming up.

So, in order to figure out if the code was really good or there was a misconfiguration on my SonarQube settings, I went to http://find-sec-bugs.github.io/bugs.htm, I took one of the examples (Potential Path Traversal), inserted the example code and I ran the scanner again. It was not found.

The rule (Security - Potential Path Traversal (file read)) is activated in the Quality Profile, and despite it is a Java profile, it is assigned to the project, since the code in the mentioned example is Scala.

I noticed that all the rules coming from find-sec-bugs are java ones, so I'm wondering if they don't work on scala or there is something else I can do to make it work.

Thanks in advance, and let me know if you need any extra information, I'd be glad to provide you.

...

ANSWER

Answered 2018-Dec-06 at 13:34

Looks like the main reason for that to happen is that Scala bug patterns are explicitly excluded for some reasons:

Their are plenty of limitation with the SonarQube architecture regarding the multi-language support. It is closely tie to the sonar-source plugin design.

Language can't have the same extension (https://jira.sonarsource.com/browse/MMF-672)

Repository can't contains rule that apply to multiple languages. (If you would have Scala only code, the Java core rules would not be enable unless you have one Java file present)

Sensor are couple to the language definition (depends on the most popular plugin that declares it).

etc, etc..

Source: https://github.com/spotbugs/sonar-findbugs/issues/108#issuecomment-305909652

All the exclusions can be seen here: https://github.com/spotbugs/sonar-findbugs/commit/526ca6b29fae2684f86b1deba074a4be8a05b67e

Particularly, for Scala:

Source https://stackoverflow.com/questions/53600622

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install find-sec-bugs

You can download it from GitHub, Maven.
You can use find-sec-bugs like any standard Java library. Please include the the jar files in your classpath. You can also use any IDE and you can run and debug the find-sec-bugs component as you would do with any other Java program. Best practice is to use a build tool that supports dependency management such as Maven or Gradle. For Maven installation, please refer maven.apache.org. For Gradle installation, please refer gradle.org .