Add rules for Vert.X
- Ngôn ngữ chính
- CodeQL
- Star
- 10.1k
- Fork
- 2.1k
- Merge trung bình
- 2 ngày 15 giờ
- Pull request đã merge (30 ngày)
- 141
Mô tả
# Task Description
We would like to see specialized rules for the [Vert.x](https://vertx.io/) Java framework. This is a popular Eclipse framework [hosted on Github](https://github.com/vert-x3/) with over 13000 followers (as of now).
Based on our research, it appears Checkmarx is the only SAST tool that has rules for Vert.X, targetting Kotlin.
Our codebase is written in Java and heavily dependent on Vert.X. We are already using GHAS for scanning our private repositories (in GHES). We would like to not need to use several different tools such as Fortify, Checkmarx, Mend, etc for the job.
It would be great, it we could see the same support in CodeQL.
# Task List
The following tasks will have to be carried out:
* [ ] Collect a list of common security issues in Vert.X
* [ ] Implement rules for them
* [ ] Add tests
* [ ] Update the documentation
# Useful Links
* [Vert.X: Github Org](https://github.com/vert-x3/)
* [Vert.X: Website](https://vertx.io/)
* [Vert.X: Writing Secure Vert.X webapps](https://vertx.io/blog/writing-secure-vert-x-web-apps/)
* [Vert.X: Things to keep in mind concerning CSRF attacks"](https://vertx.io/blog/eclipse-vert-x-CSRF-concerns/)
* [Vert.X: #security chat channel on Discord](https://discord.com/channels/751380286071242794/751398225105125376)
* [Checkmarx: Supported Code Languages And Frameworks](https://checkmarx.com/resource/documents/en/34965-46283-supported-code-languages-and-frameworks-for-9-5-0.html)
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.