2

I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others were more focused on code quality tools. Am I missing something here or there are no open-source initiatives/projects/tools available for this purpose?

  • This seems quite broad - there are many types of security bug, and the techniques for each are different. As written at the moment, it could also come across as looking for software recommendations, which would be out of scope. Provide some more details on what you're looking for specifically, and, ideally, what you've already tried. – Matthew Nov 23 '15 at 10:39
  • @Matthew edited to include SQL Injection and XSS. Also I do not want any product recommendation here, a simple answer like "Yes" or "No" with proper reasoning will do. If yes, how to approach this problem. – Krishna Pandey Nov 23 '15 at 10:50
  • Did you try FindSecurityBugs? Because it works on class files, there's a decent chance it will work with Scala. In general, open source static analysers are basic. If you need this, there's always the commercial options like Veracode and Checkmarx. – paj28 Nov 23 '15 at 11:33
  • 1
    I agree with trying FindSecBugs - it's the closest as far as opensource goes, and does have one or two scala-specific checks. Of the commercial, I think Semmle has scala support, but I don't know if they're security focused. I'm the author of Scala Linter, and could add some new checks if you have some very specific ideas of what to look for. – HairyFotr Nov 23 '15 at 15:05
  • I went across these pages before posting this question. 1)blog.gdssecurity.com/labs/2014/9/23/… 2) stackoverflow.com/questions/22617713/… Both pointed to more false positives in case of using Findbugs. PS: I am using Find Security Bugs plugin for analyzing java code. – Krishna Pandey Nov 23 '15 at 15:28
2

Codacy (an automated code review platform) has been deploying Scala security patterns.

There's a blog post with the first 9 patterns and if you head to the patterns list in the documentation you can filter for security to check the other ones out (more will be coming out soon).

The way Codacy works is you log into the platform, point it to your git repository and it analyses each of your commits, letting you know whether you created/fixed any issues (be them coding style/performance/complexity/security/etc). There's also an on-premises version.

Codacy gives you the full flexibility to customize the rules you use and even create your own.

It's free for Open Source projects.

  • Can you paraphrase that link in case the webpage disappears? – Ohnana Dec 18 '15 at 19:48
  • 1
    I visited the site and it looks promising. I will look more into how many and what kind of security patterns are available. Thanks. – Krishna Pandey Dec 19 '15 at 9:06
-1

If there are common design patterns like php's <?=$_GET['blah']?> then you could easily write some regular expressions to detect them with a grep based tool like graudit or VisualCodeGrepper. For some deeper analysis however you would most likely need to write a token or AST parser and apply taint tracking. The wikipedia static analysis page may be a good starting point: https://en.wikipedia.org/wiki/Static_program_analysis

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.