Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case?

For example: We know that open source software is usually more reliable than commercial software. So I'm wondering if it's a good idea to, instead of inspecting the open source code line by line, download the original code from the web, and compare it with the code that's been given to us. If there's no difference, we conclude that the source code is probably safe and we can skip manual code inspection.

Is this practice acceptable? Are there other strategies that can speed up source code analysis?

share|improve this question

closed as too broad by TildalWave, Eric G, Adi, rook, AviD May 4 '14 at 7:45

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

open source != secure. Haven't you heard of the heartbleed bug. Being proprietary or open source does not really guarantee anything. – Shurmajee May 3 '14 at 10:29
One thing I'd avoid if I was you is sweeping statements like "open software is usually more reliable than commercial software", it's demonstrably untrue as a general statement (i.e. there is reliable and unreliable open source and the same is true for commercial software) – Rоry McCune May 3 '14 at 13:05
@Rory McCune: Thanks for your remark, But I've read this statement in Coverity report about software analysis, take a look at the following link:… – A.B. May 4 '14 at 4:32

I'm assuming here that what you want to do is perform static analysis for the purpose of identifying security issues in the code bases you've been provided?

If that's the case there's a number of approaches you can take. Assuming that the people who are doing the reviews are not skilled application security analysts, you're going to need to rely on tools for a lot of the work, although beware the tools in this fields are seldom (if ever) point and click affairs.

Depending on the language you may find the vendor has some tools that can be used (e.g. FXCop)

Then there are open source tools like flawfinder and RATS

Lastly there are a number of commercial solutions like Checkmarx and Fortify and if you want a managed solution Veracode

Exactly how you go about it will depend on your budget (hint, the commercial tools aren't cheap), the skills you have available and the amount of time for the reviews.

share|improve this answer

Professional IDEs, like Visual Studio for Microsoft .NET development, come with extensive and automatic static code analysis features. I would suggest you run all source code through the full set of code analysis rules, which usually reveals quite a bit, also regarding security (in the case of .NET - I haven't used other code analysis frameworks). Doing all this manually would be unfeasible, unless there's a very large budget.

There are also several non-Microsoft code analysis tools for the .NET framework, e.g. JetBrains ReSharper.

If the source code is written in another language, you can find a list of tools for static code analysis on Wikipedia.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.