I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others were more focused on code quality tools. Am I missing something here or there are no open-source initiatives/projects/tools available for this purpose?

  • This seems quite broad - there are many types of security bug, and the techniques for each are different. As written at the moment, it could also come across as looking for software recommendations, which would be out of scope. Provide some more details on what you're looking for specifically, and, ideally, what you've already tried.
    – Matthew
    Commented Nov 23, 2015 at 10:39
  • @Matthew edited to include SQL Injection and XSS. Also I do not want any product recommendation here, a simple answer like "Yes" or "No" with proper reasoning will do. If yes, how to approach this problem. Commented Nov 23, 2015 at 10:50
  • Did you try FindSecurityBugs? Because it works on class files, there's a decent chance it will work with Scala. In general, open source static analysers are basic. If you need this, there's always the commercial options like Veracode and Checkmarx.
    – paj28
    Commented Nov 23, 2015 at 11:33
  • 1
    I agree with trying FindSecBugs - it's the closest as far as opensource goes, and does have one or two scala-specific checks. Of the commercial, I think Semmle has scala support, but I don't know if they're security focused. I'm the author of Scala Linter, and could add some new checks if you have some very specific ideas of what to look for.
    – HairyFotr
    Commented Nov 23, 2015 at 15:05
  • I went across these pages before posting this question. 1)blog.gdssecurity.com/labs/2014/9/23/… 2) stackoverflow.com/questions/22617713/… Both pointed to more false positives in case of using Findbugs. PS: I am using Find Security Bugs plugin for analyzing java code. Commented Nov 23, 2015 at 15:28

2 Answers 2


Codacy (an automated code review platform) has been deploying Scala security patterns.

There's a blog post with the first 9 patterns and if you head to the patterns list in the documentation you can filter for security to check the other ones out (more will be coming out soon).

The way Codacy works is you log into the platform, point it to your git repository and it analyses each of your commits, letting you know whether you created/fixed any issues (be them coding style/performance/complexity/security/etc). There's also an on-premises version.

Codacy gives you the full flexibility to customize the rules you use and even create your own.

It's free for Open Source projects.

  • Can you paraphrase that link in case the webpage disappears?
    – Ohnana
    Commented Dec 18, 2015 at 19:48
  • 1
    I visited the site and it looks promising. I will look more into how many and what kind of security patterns are available. Thanks. Commented Dec 19, 2015 at 9:06

If there are common design patterns like php's <?=$_GET['blah']?> then you could easily write some regular expressions to detect them with a grep based tool like graudit or VisualCodeGrepper. For some deeper analysis however you would most likely need to write a token or AST parser and apply taint tracking. The wikipedia static analysis page may be a good starting point: https://en.wikipedia.org/wiki/Static_program_analysis

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .