Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but I'm decided to try any tool that allow me to reduce the work need to review such a large amount of code.

I tested RATS, but it only looks for a very small and limited number of vulnerabilities.

share|improve this question

closed as off-topic by Jens Erat, Xander, schroeder, RoraΖ, Terry Chia Jan 26 '15 at 14:27

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

CERT has create a CERT Perl Secure Coding Standard and there's been discussion of having Perl::Critic have a set of policies that match their standard. As far as I know, nothing's been done yet. Here's the start of the discussion on the Perl::Critic dev mailing list.

share|improve this answer

Try "Perl::Critic". I haven't used it yet but i came across the answer of a similar question in the below link:

link to the Perl::Critic details:

share|improve this answer
A permanent link to Perl::Critic that isn't tied to a specific version is – Andy Lester Dec 21 '12 at 6:33
Perl::Critic mostly deals with the way you write your code. A huge legacy app would fail this miserably. There are IDEs like Komodo that have Critic support built-in, like syntax checking. it will squiggle things it deems wrong, depending on its configuration. But many of the default rules aren't very security-relevant. It's more a question of coding style really. A typical application would be to have a standard set of rules and let your git/svn check against these in a pre-commit hook. – simbabque Feb 27 '13 at 9:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.