The Owasp Orizon Framework - Revision history

Ari Elias-Bachrach: spelling only

2010-10-21T18:58:19Z

spelling only

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T17:01:13Z

Added navigation to facilitate sequential reading online

KirstenS: /* Reference */

2009-05-22T13:07:43Z

‎Reference

KirstenS: /* Reference */

2009-05-22T13:07:10Z

‎Reference

KirstenS: /* Reference */

2009-05-22T13:06:59Z

‎Reference

KirstenS: /* The Translation Factory */

2009-01-15T22:36:48Z

‎The Translation Factory

KirstenS: /* The Owasp Orizon Architecture */

2009-01-15T22:29:59Z

‎The Owasp Orizon Architecture

KirstenS: /* Introduction */

2009-01-15T21:54:41Z

‎Introduction

KirstenS: /* Introduction */

2009-01-15T21:54:26Z

‎Introduction

Thesp0nge: /* Statistical gathering */

2008-09-08T15:13:21Z

‎Statistical gathering

@@ Line 16: / Line 16: @@
 On the other side, these tools don't share the most valuable point among them: the security knowledge. All these tools have their own security library, containing a lot of checks, without sharing such knowledge.
-In 2006, the Owasp Orizon project wass born to provide a common underlying layer to all opensource projects concerning static analysis.
+In 2006, the Owasp Orizon project was born to provide a common underlying layer to all opensource projects concerning static analysis.
 Orizon project includes:
@@ Line 306: / Line 306: @@
   '''        return true;
   '''    } catch (IOException e) {
-  '''        return log.fatal("an exception occured while translate " + in + ": " +e.getLocalizedMessage());
+  '''        return log.fatal("an exception occurred while translate " + in + ": " +e.getLocalizedMessage());
   '''    }
   ''' }
@@ Line 330: / Line 330: @@
   '''    } catch (UnsupportedEncodingException e) {
   '''    } catch (IOException e) {
-  '''        ret = log.error("an exception occured: " + e.getMessage());
+  '''        ret = log.error("an exception occurred: " + e.getMessage());
   '''    }
   '''    ret = true;

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
-[[Category:OWASP Code Review Project]]
+  | useprev=PrevLink | prev=Code Auditor Workbench Tool | lblprev=
 == Introduction ==
@@ Line 344: / Line 348: @@
 You can drop also a line to Orizon author: [mailto:thesp0nge@owasp.org thesp0nge@owasp.org]
   '''foo'''

@@ Line 337: / Line 337: @@
 To anyone interested in Owasp Orizon framework, you can use the following links:
-* main page @ Owasp: [[::Category:OWASP_Orizon_Project]]
+* main page @ Owasp: [[::Category:OWASP_Orizon_Project|OWASP Orizon Project]]
 * main site @ SourceForge: [http://orizon.sourceforge.net http://orizon.sourceforge.net]
 * blog: [http://orizon.sourceforget.net/blog http://orizon.sourceforge.net/blog]

@@ Line 337: / Line 337: @@
 To anyone interested in Owasp Orizon framework, you can use the following links:
-* main page @ Owasp: [{::Category:OWASP_Orizon_Project]]
+* main page @ Owasp: [[::Category:OWASP_Orizon_Project]]
 * main site @ SourceForge: [http://orizon.sourceforge.net http://orizon.sourceforge.net]
 * blog: [http://orizon.sourceforget.net/blog http://orizon.sourceforge.net/blog]

@@ Line 337: / Line 337: @@
 To anyone interested in Owasp Orizon framework, you can use the following links:
-* main page @ Owasp: [http://www.owasp.org/index.php/Category:OWASP_Orizon_Project http://www.owasp.org/index.php/Category:OWASP_Orizon_Project]
+* main page @ Owasp: [{::Category:OWASP_Orizon_Project]]
 * main site @ SourceForge: [http://orizon.sourceforge.net http://orizon.sourceforge.net]
 * blog: [http://orizon.sourceforget.net/blog http://orizon.sourceforge.net/blog]

@@ Line 187: / Line 187: @@
 === The Translation Factory ===
 One of the Owasp Orizon goals is to be independent from the source language being analyzed. This means that Owasp Orizon will support:
 * Java
 * C, C++
 * C#
-* perl
+* Perl
 * ...
 Such support is granted using an intermediate file format to describe the source code and used to apply the security checks. Such format is XML language.
 * an XML file containing statistical information
 * an XML file containing variables tracking information
@@ Line 201: / Line 202: @@
 * an XML file containing call graph (global analysis)
-As the time this document is written (Owasp Orizon v1.0pre1, September 2008) only Java programming language is supported, however other programming language will follow soon.
+At the time this document is written (Owasp Orizon v1.0pre1, September 2008), only the Java programming language is supported, however other programming language will follow soon.
   ''' /**
@@ Line 225: / Line 227: @@
   '''   }
 Scan method is an abstract method defined in org.owasp.orizon.translator.DefaultTranslator class and declared as the following:
   ''' public abstract boolean scan(String in);
 Every class implementing DefaultTranslator must implement how to scan the source file and build ASTs in this method.
   ''' public abstract boolean statService(String in, String out);
@@ Line 237: / Line 241: @@
   ''' public abstract boolean controlFlowService(String in, String out);
 All these methods are called in the translator() method, the one implemented directly from DefaultTranslator class.
   ''' public final boolean translate(String in, String out, int service) {
@@ Line 259: / Line 263: @@
   ''' }
-So, when from a language specific translator is prompted for translate() method, this recalls the language specific service methods.
+So, when a language specific translator is prompted for translate() method, this recalls the language specific service methods.
-Every translator contains as private field a language specific scanner containing ASTs to be used in input file generation.
+Every translator contains as private field, a language specific scanner containing ASTs to be used in input file generation.
 Consider org.owasp.orizon.translator.java.JavaTranslator class, it is declared as follows:
   ''' public class JavaTranslator extends DefaultTranslator {
@@ Line 270: / Line 274: @@
   '''   ...
-JavaScanner is a class from org.owasp.orizon.translator.java package and it uses Sun JDK 6 Compiler API to scan a java file creating in memory ASTs.
+JavaScanner is a class from org.owasp.orizon.translator.java package and it uses Sun JDK 6 Compiler API to scan a Java file creating in memory ASTs. Trees are created in scan() method, implemented for Java source language as follow:
   ''' public final boolean scan(String in) {
@@ Line 303: / Line 306: @@
   ''' }
-==== Statistical gathering ====
+===Statistical Gathering ===
-To implement statistic information gathering, DefaultTranslator abstract method statService() must be implemented. In the following example, the method is the JavaTranslator's one.
+To implement statistic information gathering, DefaultTranslator abstract method statService() must be implemented. In the following example, the method is the JavaTranslator's. Statistics information is stored in the JavaScanner object itself and retrieved by getStats() method.
   ''' public final boolean statService(String in, String out) {
@@ Line 331: / Line 333: @@
   '''    return ret;
   ''' }
 == Reference ==

@@ Line 20: / Line 20: @@
 == The Owasp Orizon Architecture ==
 In the following picture, the Owasp Orizon version 1.0 architecture is shown. As you may see, the framework is organized in engines that perform tasks over the source code and a block of tools that are deployed out of the box in order to use the APIs in a real world static analysis.
 [[Image:Owasp_Orizon_Architecture_v1.0.png|400px|The Owasp Orizon v1.0 architecture]]
-With all such elements, a developer can be scared to use the framework, that's why a special entity called SkyLine was created. Before going further into SkyLine analysis, it's very important to understand all the elements Orizon is made of.
+With all such elements, a developer can be scared to use the framework; that's why a special entity called SkyLine was created. Before going further into SkyLine analysis, it's very important to understand all the elements Orizon is made of.
 === Your personal butler: the SkyLine class ===
-Named '''core''' in the architectural picture, SkyLine object is one of the most valuable news into Orizon version 1.0.
+Named '''core''' in the architectural picture, the SkyLine object is one of the most valuable services in Orizon version 1.0.
-The idea behind SkyLine is simple: the Orizon architecture becomes wider, regular developers may be scared about understanding a lot of APIs in order to build their security tool, so we can help them providing a "per service" support.
+Using SkyLine object, developers can request services from the Orizon framework waiting for their accomplishment.
-Using SkyLine object, developers can ask services to Orizon framework waiting for their accomplishment.
+The main SkyLine input is:
   '''public boolean launch(String service)'''
 Passing the requested service as string parameter, the calling program will receive a boolean true return value if the service can be accomplished or a false value otherwise.
   '''private int goodService(String service) {
@@ Line 55: / Line 55: @@
   '''}
 The secondary feature introduced in this first major framework release is the support for command line option given to the user.
-If the calling program passes command line option to Orizon framework using SkyLine, the framework will be tuned accordingly to the given values.
+This example will explain better:
   '''public static void main(String[] args) {
   '''   String fileName = "";
@@ Line 67: / Line 68: @@
   '''   SkyLine skyLine = new SkyLine(args);
-That's all folks! Internally, the SkyLine constructor when it creates a code review session, it uses the values it was able to understand from command line.
+That's all folks! Internally, the SkyLine constructor, when it creates a code review session,  uses the values it was able to understand from command line.
   ''' -o orizon_key=value
 or the long format
@@ Line 90: / Line 92: @@
 === Give me something to remind: the Session class ===
-Another big news introduced in Owasp Orizon version 1.0 is the code review session concept.
+Another big feature introduced in Owasp Orizon version 1.0 is the code review session concept. One of the missing features in earlier versions was the capability to track the state of the code review process.
 One of the missing features in earlier versions was the capability to track the state of the code review process.
-A Session class instance contains all the properties specified using SkyLine and it is their owner giving access to properties upon request. It contains all a SessionInfo array containing information about each files being reviewed.
+Ideally, a user tool will never call Session directly, but it must use SkyLine as interface. Of course anyone is free to override this suggestion.
-Ideally a user tool will never call Session directly but it must use SkyLine as interface, of course anyone is free to override this suggestion.
+Looking at the launch() method code, inside the SkyLine class, you can look how session instance is prompted to execute services.
   '''public boolean launch(String service) {
@@ Line 132: / Line 134: @@
   '''}
-Internally, Session instance will ask each SessionInfo objects to execute services.
+Internally, the Session instance will ask each SessionInfo object to execute services. Let us consider the Session class method that executes the static analysis service.
   '''/**
@@ Line 155: / Line 156: @@
   '''private SessionInfo[] sessions;
-As you may see Session object delegates service accomplishment to SessionInfo ones collecting the final results.
+As you may see, the Session object delegates service accomplishment to SessionInfo once collecting the final results.
   '''/**
   '''  * Perform a static analysis over the given file
@@ Line 183: / Line 186: @@
-=== The Translation factory ===
+=== The Translation Factory ===
 One of the Owasp Orizon goals is to be independent from the source language being analyzed. This means that Owasp Orizon will support:
 * Java
@@ Line 331: / Line 334: @@
 ==== Variable tracking gathering ====
 ==== Local analysis information gathering ====
 ==== Global analysis information gathering ====
 == Reference ==

← Older revision		Revision as of 21:54, 15 January 2009
Line 13:		Line 13:

	In 2006, the Owasp Orizon project wass born to provide a common underlying layer to all opensource projects concerning static analysis.		In 2006, the Owasp Orizon project wass born to provide a common underlying layer to all opensource projects concerning static analysis.
−

	Orizon project includes:		Orizon project includes:

@@ Line 3: / Line 3: @@
 == Introduction ==
-A lot of open source projects exist in the wild performing static code review analysis. This is good, it means that source code testing for security issues is becoming a constraint.
+A lot of open source projects exist in the wild, performing static code review analysis. This is good, it means that source code testing for security issues is becoming a constraint.
 Such tools bring a lot of valuable points:
@@ Line 10: / Line 10: @@
 * costs
-On the other side, these tools don't share the most valuable point among them: the security knowledge. All these tools have their own security library with a lot of checks contained into without sharing such knowledge.
+On the other side, these tools don't share the most valuable point among them: the security knowledge. All these tools have their own security library, containing a lot of checks, without sharing such knowledge.
 Orizon project includes:
-* a set of APIs that developers can use to build their own security tool performing static analysis
+* a set of APIs that developers can use to build their own security tool performing static analysis.
-* a security library with checks to apply to source code
+* a security library with checks to apply to source code.
-* a tool, Milk, able to static analyze a source code using Orizon Framework.
+* a tool, Milk, which is able to static analyze a source code using Orizon Framework.
 == The Owasp Orizon Architecture ==

@@ Line 301: / Line 301: @@
 ==== Statistical gathering ====
-public final boolean statService(String in, String out) {
+ ''' public final boolean statService(String in, String out) {
-		boolean ret = false;
+ '''    boolean ret = false;
+ '''
-		if (!scanned)
+ '''    if (!scanned)
-			return log.error(in + ": call scan() before asking translation...");
+ '''       return log.error(in + ": call scan() before asking translation...");
-		log.debug(". Entering statService(): collecting stats for: " + in);
+ '''    log.debug(". Entering statService(): collecting stats for: " + in);
-		try {
+ '''    try {
-			createXmlFile(out);
+ '''        createXmlFile(out);
-			xmlInit();
+ '''        xmlInit();
-			xml("<source name=\"" + in+"\" >");
+ '''        xml("<source name=\"" + in+"\" >");
-			xml(j.getStats());
+ '''        xml(j.getStats());
-			xml("</source>");
+ '''        xml("</source>");
-			xmlEnd();
+ '''        xmlEnd();
+ '''
-		} catch (FileNotFoundException e) {
+ '''    } catch (FileNotFoundException e) {
-		} catch (UnsupportedEncodingException e) {
+ '''    } catch (UnsupportedEncodingException e) {
-		} catch (IOException e) {
+ '''    } catch (IOException e) {
-			ret = log.error("an exception occured: " + e.getMessage());
+ '''        ret = log.error("an exception occured: " + e.getMessage());
+ '''    }
-		ret = true;
+ '''    ret = true;
-		log.debug("stats written into: " + out);
+ '''    log.debug("stats written into: " + out);
-		log.debug(". Leaving statService()");
+ '''    log.debug(". Leaving statService()");
-		return ret;
+ '''    return ret;
+ ''' }
 ==== Variable tracking gathering ====