github / github/codeql

Add rules for Vert.X

Ouverte
#12,844 5 commentaires 4 réactions 0 personnes assignées Voir sur GitHub
question
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

# Task Description

We would like to see specialized rules for the [Vert.x](https://vertx.io/) Java framework. This is a popular Eclipse framework [hosted on Github](https://github.com/vert-x3/) with over 13000 followers (as of now).

Based on our research, it appears Checkmarx is the only SAST tool that has rules for Vert.X, targetting Kotlin.

Our codebase is written in Java and heavily dependent on Vert.X. We are already using GHAS for scanning our private repositories (in GHES). We would like to not need to use several different tools such as Fortify, Checkmarx, Mend, etc for the job.

It would be great, it we could see the same support in CodeQL.

# Task List

The following tasks will have to be carried out:
* [ ] Collect a list of common security issues in Vert.X
* [ ] Implement rules for them
* [ ] Add tests
* [ ] Update the documentation

# Useful Links

* [Vert.X: Github Org](https://github.com/vert-x3/)
* [Vert.X: Website](https://vertx.io/)
* [Vert.X: Writing Secure Vert.X webapps](https://vertx.io/blog/writing-secure-vert-x-web-apps/)
* [Vert.X: Things to keep in mind concerning CSRF attacks"](https://vertx.io/blog/eclipse-vert-x-CSRF-concerns/)
* [Vert.X: #security chat channel on Discord](https://discord.com/channels/751380286071242794/751398225105125376)
* [Checkmarx: Supported Code Languages And Frameworks](https://checkmarx.com/resource/documents/en/34965-46283-supported-code-languages-and-frameworks-for-9-5-0.html)

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.