github / github/codeql

Add rules for Vert.X

未關閉
#12,844 5 則留言 4 個 reaction 已指派 0 人 在 GitHub 檢視
question
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

# Task Description

We would like to see specialized rules for the [Vert.x](https://vertx.io/) Java framework. This is a popular Eclipse framework [hosted on Github](https://github.com/vert-x3/) with over 13000 followers (as of now).

Based on our research, it appears Checkmarx is the only SAST tool that has rules for Vert.X, targetting Kotlin.

Our codebase is written in Java and heavily dependent on Vert.X. We are already using GHAS for scanning our private repositories (in GHES). We would like to not need to use several different tools such as Fortify, Checkmarx, Mend, etc for the job.

It would be great, it we could see the same support in CodeQL.

# Task List

The following tasks will have to be carried out:
* [ ] Collect a list of common security issues in Vert.X
* [ ] Implement rules for them
* [ ] Add tests
* [ ] Update the documentation

# Useful Links

* [Vert.X: Github Org](https://github.com/vert-x3/)
* [Vert.X: Website](https://vertx.io/)
* [Vert.X: Writing Secure Vert.X webapps](https://vertx.io/blog/writing-secure-vert-x-web-apps/)
* [Vert.X: Things to keep in mind concerning CSRF attacks"](https://vertx.io/blog/eclipse-vert-x-CSRF-concerns/)
* [Vert.X: #security chat channel on Discord](https://discord.com/channels/751380286071242794/751398225105125376)
* [Checkmarx: Supported Code Languages And Frameworks](https://checkmarx.com/resource/documents/en/34965-46283-supported-code-languages-and-frameworks-for-9-5-0.html)

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。