Project Information:template Teachable Static Analysis Workbench - Revision history

Paulo Coimbra at 15:58, 26 January 2009

2009-01-26T15:58:43Z

Paulo Coimbra at 17:50, 14 January 2009

2009-01-14T17:50:34Z

Paulo Coimbra at 17:49, 14 January 2009

2009-01-14T17:49:51Z

Paulo Coimbra at 17:48, 14 January 2009

2009-01-14T17:48:20Z

Paulo Coimbra: Undo revision 51186 by Paulo Coimbra (Talk)

2009-01-14T17:32:42Z

Undo revision 51186 by Paulo Coimbra (Talk)

Paulo Coimbra at 17:31, 14 January 2009

2009-01-14T17:31:56Z

Paulo Coimbra at 17:02, 14 January 2009

2009-01-14T17:02:21Z

Paulo Coimbra at 17:01, 14 January 2009

2009-01-14T17:01:33Z

Paulo Coimbra at 16:59, 14 January 2009

2009-01-14T16:59:37Z

Paulo Coimbra at 18:27, 27 November 2008

2008-11-27T18:27:44Z

@@ Line 17: / Line 17: @@
   |-
   | style="width:15%; background:#7B8ABD" align="center"|'''Key Project Information'''
-  | style="width:14%; background:#cccccc" align="center"|Project Leader<br>[[:User:Ddk|Dmitry Kozlov]]<br>[mailto:igor.konnov(at)gmail.com '''Igor Konnov''']
+  | style="width:14%; background:#cccccc" align="center"|Project Leader<br>[[:User:Ddk|'''Dmitry Kozlov''']]<br>[mailto:igor.konnov(at)gmail.com '''Igor Konnov''']
   | style="width:14%; background:#cccccc" align="center"|Project Contributors<br>(if applicable)
   | style="width:14%; background:#cccccc" align="center"|Mailing List<br>[https://lists.owasp.org/mailman/listinfo/owasp-teachable-static-analysis-workbench '''Subscribe here''']<br>[mailto:owasp-teachable-static-analysis-workbench(at)lists.owasp.org '''Use here''']

@@ Line 30: / Line 30: @@
   ! align="center" style="background:#7B8ABD; color:white"|<font color="black">'''Related Projects'''
   |-
-  | style="width:29%; background:#cccccc" align="center"| '''[[:Category:OWASP_Project_Assessment#Beta_Quality_Tools_Criteria|Beta Quality]]'''<br>[[:Teachable Static Analysis Workbench - Assessment Frame|Please see here for complete information.]]
+  | style="width:29%; background:#cccccc" align="center"| '''[[:Category:OWASP_Project_Assessment#Beta_Quality_Tool_Criteria|Beta Quality]]'''<br>[[:Teachable Static Analysis Workbench - Assessment Frame|Please see here for complete information.]]
   | style="width:42%; background:#cccccc" align="center"|
 http://code.google.com/p/teachablesa/<br>[https://www.owasp.org/images/6/69/Teachable_static_analysis_workbench.pptx PowerPoint Presentation]

@@ Line 30: / Line 30: @@
   ! align="center" style="background:#7B8ABD; color:white"|<font color="black">'''Related Projects'''
   |-
-  | style="width:29%; background:#cccccc" align="center"| '''[[:Category:OWASP_Project_Assessment#Beta_Quality_Documentation_Criteria|Beta Quality]]'''<br>[[:Teachable Static Analysis Workbench - Assessment Frame|Please see here for complete information.]]
+  | style="width:29%; background:#cccccc" align="center"| '''[[:Category:OWASP_Project_Assessment#Beta_Quality_Tools_Criteria|Beta Quality]]'''<br>[[:Teachable Static Analysis Workbench - Assessment Frame|Please see here for complete information.]]
   | style="width:42%; background:#cccccc" align="center"|
 http://code.google.com/p/teachablesa/<br>[https://www.owasp.org/images/6/69/Teachable_static_analysis_workbench.pptx PowerPoint Presentation]

@@ Line 35: / Line 35: @@
   | style="width:29%; background:#cccccc" align="center"|
 If any, add link here
   |}

@@ Line 79: / Line 79: @@
   | style="width:50%; background:#cccccc" align="center"|[[OWASP Summer of Code 2008|Sponsor - '''OWASP Summer of Code 2008''']]
   | style="width:50%; background:#cccccc" align="center"|[[OWASP Summer of Code 2008 Applications - Need Futher Clarifications#Teachable Static Analysis Workbench|'''Sponsored Project/Guidelines/Roadmap''']]
   |}

@@ Line 19: / Line 19: @@
   | style="width:14%; background:#cccccc" align="center"|Project Leader<br>[[:User:Ddk|Dmitry Kozlov]]<br>[mailto:igor.konnov(at)gmail.com '''Igor Konnov''']
   | style="width:14%; background:#cccccc" align="center"|Project Contributors<br>(if applicable)
-  | style="width:14%; background:#cccccc" align="center"|Mailing List<br>[https://lists.owasp.org/mailman/listinfo/owasp-teachable-static-analysis-workbench '''Subscribe here''']<br>[mailto:owasp-teachable-static-analysis-workbench(at)lists.owasp.org '''/Use here''']
+  | style="width:14%; background:#cccccc" align="center"|Mailing List<br>[https://lists.owasp.org/mailman/listinfo/owasp-teachable-static-analysis-workbench '''Subscribe here''']<br>[mailto:owasp-teachable-static-analysis-workbench(at)lists.owasp.org '''Use here''']
   | style="width:14%; background:#cccccc" align="center"|License<br>[http://www.gnu.org/licenses/old-licenses/gpl-2.0.html '''GNU General Public License v2''']
-| style="width:14%; background:#cccccc" align="center"|Project Type<br>[[:Category:OWASP_Project#Alpha_Status_Projects|'''Tool''']]
+| style="width:14%; background:#cccccc" align="center"|Project Type<br>[[:Category:OWASP_Project#Beta_Status_Projects|'''Tool''']]
   | style="width:15%; background:#cccccc" align="center"|Sponsors<br>[[OWASP Summer of Code 2008|'''OWASP SoC 08''']]
   |}

← Older revision		Revision as of 16:59, 14 January 2009
Line 1:		Line 1:
		+	{\| style="width:100%" border="0" align="center"
		+	! colspan="8" align="center" style="background:#4058A0; color:white"\|<font color="white">'''PROJECT IDENTIFICATION'''
		+	\|-
		+	\| style="width:15%; background:#7B8ABD" align="center"\|'''Project Name'''
		+	\| colspan="7" style="width:85%; background:#cccccc" align="left"\|<font color="black">'''OWASP Teachable Static Analysis Workbench Project'''
		+	\|-
		+	\| style="width:15%; background:#7B8ABD" align="center"\| '''Short Project Description'''
		+	\| colspan="6" style="width:85%; background:#cccccc" align="left"\|The research will be intended to answer the following questions:
		+	* Can we integrate existing open source static analysis tools (OWASP and third-party) to work altogether? We plan analysis to cover the following tools: LAPSE, Orizon, ESAPI, FindBugs.
		+	* How static analysis workbench can be taught by security analyst?
		+	* How static analysis workbench can support web-applications built using MVC frameworks?
		+	Workbench prototype will be Java-based Eclipse plug-in which aim is to help security analyst/code reviewer validation of web application. At prototype step we suggest to analyze J2EE Web tier applications build on Java Servlets, JSP (without business logic in it) and one MVC framework (Apache Struts). We plan workbench prototype to have the following functionality:
		+	* Input validation vulnerabilities analysis: identification of web application entry points (aka attack surface in P024), call graph for each entry point (see “Packages -> Classes -> Methods -> callsites” in P023), identification of data validation routines, teachable taint analysis.
		+	* Authentification and access control analysis: identification of code related to access control and it’s analysis.
		+	* Pattern-based code analysis.
		+	* Teachability: analyst indicates security-related code (sources of tainted data, sensitive sinks, input validation and sanitizing functions, access control code, etc.) and workbench automatically recomputes possible vulnerabilities list. The second idea is to spread knowledge gathered from analyst to other web applications.
		+	\|-
		+	\| style="width:15%; background:#7B8ABD" align="center"\|'''Key Project Information'''
		+	\| style="width:14%; background:#cccccc" align="center"\|Project Leader<br>[[:User:Ddk\|Dmitry Kozlov]]<br>[mailto:igor.konnov(at)gmail.com '''Igor Konnov''']
		+	\| style="width:14%; background:#cccccc" align="center"\|Project Contributors<br>(if applicable)
		+	\| style="width:14%; background:#cccccc" align="center"\|Mailing List<br>[https://lists.owasp.org/mailman/listinfo/owasp-teachable-static-analysis-workbench '''Subscribe here''']<br>[mailto:owasp-teachable-static-analysis-workbench(at)lists.owasp.org '''/Use here''']
		+	\| style="width:14%; background:#cccccc" align="center"\|License<br>[http://creativecommons.org/licenses/by-sa/3.0/ '''Creative Commons Attribution Share Alike 3.0''']
		+	\| style="width:14%; background:#cccccc" align="center"\|Project Type<br>[[:Category:OWASP_Project#Alpha_Status_Projects\|'''Tool''']]
		+	\| style="width:15%; background:#cccccc" align="center"\|Sponsors<br>[[OWASP Summer of Code 2008\|'''OWASP SoC 08''']]
		+	\|}
		+
		+	{\| style="width:100%" border="0" align="center"
		+	! align="center" style="background:#7B8ABD; color:white"\|<font color="black">'''Release Status'''
		+	! align="center" style="background:#7B8ABD; color:white"\|<font color="black">'''Main Links'''
		+	! align="center" style="background:#7B8ABD; color:white"\|<font color="black">'''Related Projects'''
		+	\|-
		+	\| style="width:29%; background:#cccccc" align="center"\| '''[[:Category:OWASP_Project_Assessment#Beta_Quality_Documentation_Criteria\|Beta Quality]]'''<br>[[:Teachable Static Analysis Workbench - Assessment Frame\|Please see here for complete information.]]
		+	\| style="width:42%; background:#cccccc" align="center"\|
		+	http://code.google.com/p/teachablesa/<br>[https://www.owasp.org/images/6/69/Teachable_static_analysis_workbench.pptx PowerPoint Presentation]
		+	\| style="width:29%; background:#cccccc" align="center"\|
		+	If any, add link here
		+	\|}
		+
		+
		+
		+
		+
	{\| style="width:100%" border="0" align="center"		{\| style="width:100%" border="0" align="center"
	! colspan="7" align="center" style="background:#4058A0; color:white"\|<font color="white">'''PROJECT IDENTIFICATION'''		! colspan="7" align="center" style="background:#4058A0; color:white"\|<font color="white">'''PROJECT IDENTIFICATION'''

@@ Line 30: / Line 30: @@
   | style="width:100%; background:#cccccc" align="center"|
 * http://code.google.com/p/teachablesa/
   |}
 {| style="width:100%" border="0" align="center"