github / github/codeql

Add rules for Vert.X

Offen
#12,844 5 Kommentare 4 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
question
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

# Task Description

We would like to see specialized rules for the [Vert.x](https://vertx.io/) Java framework. This is a popular Eclipse framework [hosted on Github](https://github.com/vert-x3/) with over 13000 followers (as of now).

Based on our research, it appears Checkmarx is the only SAST tool that has rules for Vert.X, targetting Kotlin.

Our codebase is written in Java and heavily dependent on Vert.X. We are already using GHAS for scanning our private repositories (in GHES). We would like to not need to use several different tools such as Fortify, Checkmarx, Mend, etc for the job.

It would be great, it we could see the same support in CodeQL.

# Task List

The following tasks will have to be carried out:
* [ ] Collect a list of common security issues in Vert.X
* [ ] Implement rules for them
* [ ] Add tests
* [ ] Update the documentation

# Useful Links

* [Vert.X: Github Org](https://github.com/vert-x3/)
* [Vert.X: Website](https://vertx.io/)
* [Vert.X: Writing Secure Vert.X webapps](https://vertx.io/blog/writing-secure-vert-x-web-apps/)
* [Vert.X: Things to keep in mind concerning CSRF attacks"](https://vertx.io/blog/eclipse-vert-x-CSRF-concerns/)
* [Vert.X: #security chat channel on Discord](https://discord.com/channels/751380286071242794/751398225105125376)
* [Checkmarx: Supported Code Languages And Frameworks](https://checkmarx.com/resource/documents/en/34965-46283-supported-code-languages-and-frameworks-for-9-5-0.html)

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.