This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Static Code Analysis"
From OWASP
| Line 29: | Line 29: | ||
===RIPS PHP Static Code Analysis Tool=== | ===RIPS PHP Static Code Analysis Tool=== | ||
| − | [[File:Rips.jpg]] | + | [[File:Rips.jpg|400px|thum|]] |
| − | === | + | ===OWASP LAPSE+ Static Code Analysis Tool=== |
| − | + | [[File:LapsePlusScreenshot.png|400px|thum|]] | |
== Tools == | == Tools == | ||
Revision as of 13:59, 5 January 2012
This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.
Every Control should follow this template.
This is a control. To view all control, please see the Control Category page.
Last revision (mm/dd/yy): 01/5/2012
Description
Static Code Analysis is usually performed as part of a Code Review and is carried out at the Implementation phase of a Security Development Lifecycle (SDL). Static Code Analysis commonly refers to the running of Static Code Analysis tools that attempt to highlight possible vulnerabilities within source code by using techniques such as Flow Control and/or Pattern Matching.
Risk Factors
- Talk about the factors that this control affects
- What effect does this countermeasure have on the attack or vulnerability?
- Does this control reduce the technical or business impact?
Difficulty to Implement
- Discuss the typical difficulty of implementing this control, emphasizing the factors that make it easier or harder
- Steer clear of language/platform specific information here
Examples
RIPS PHP Static Code Analysis Tool
OWASP LAPSE+ Static Code Analysis Tool
Tools
Open Source/Free
- OWASP LAPSE (Java)
- PMD (Java)
- FlawFinder (C/C++)
- Microsoft FxCop (.NET)
- Splint (C)
- FindBugs (Java)
- RIPS (PHP)
- Agnitio (Objective-C, C#, Java & Android)
Commercial
Related Attacks
Related Vulnerabilities
Related Controls
