Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but I'm decided to try any tool that allow me to reduce the work need to review such a large amount of code.

I tested RATS, but it only looks for a very small and limited number of vulnerabilities.

share|improve this question
add comment

2 Answers

Try "Perl::Critic". I haven't used it yet but i came across the answer of a similar question in the below link:

http://stackoverflow.com/questions/1149447/perl-code-security-scanner-other-than-rats-must-be-static

link to the Perl::Critic details: http://search.cpan.org/~thaljef/Perl-Critic-1.118/lib/Perl/Critic.pm

share|improve this answer
    
A permanent link to Perl::Critic that isn't tied to a specific version is search.cpan.org/dist/Perl-Critic –  Andy Lester Dec 21 '12 at 6:33
    
Perl::Critic mostly deals with the way you write your code. A huge legacy app would fail this miserably. There are IDEs like Komodo that have Critic support built-in, like syntax checking. it will squiggle things it deems wrong, depending on its configuration. But many of the default rules aren't very security-relevant. It's more a question of coding style really. A typical application would be to have a standard set of rules and let your git/svn check against these in a pre-commit hook. –  simbabque Feb 27 '13 at 9:19
add comment

CERT has create a CERT Perl Secure Coding Standard and there's been discussion of having Perl::Critic have a set of policies that match their standard. As far as I know, nothing's been done yet. Here's the start of the discussion on the Perl::Critic dev mailing list.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.