Difference between revisions of "Project Information:template Teachable Static Analysis Workbench"

From OWASP
Jump to: navigation, search
Line 17: Line 17:
 
  |-
 
  |-
 
  | style="width:15%; background:#7B8ABD" align="center"|'''Email Contacts'''
 
  | style="width:15%; background:#7B8ABD" align="center"|'''Email Contacts'''
  | style="width:14%; background:#cccccc" align="center"|Project Leader<br>[mailto:ddk@cs.msu.su '''Dmitry Kozlov''']<br>[mailto:igor.konnov@gmail.com '''Igor Konnov''']
+
  | style="width:14%; background:#cccccc" align="center"|Project Leader<br>[mailto:ddk(at)cs.msu.su '''Dmitry Kozlov''']<br>[mailto:igor.konnov(at)gmail.com '''Igor Konnov''']
 
  | style="width:14%; background:#cccccc" align="center"|Project Contributors<br>(if applicable)<br>[mailto:to(at)change '''Name&Email''']
 
  | style="width:14%; background:#cccccc" align="center"|Project Contributors<br>(if applicable)<br>[mailto:to(at)change '''Name&Email''']
 
  | style="width:14%; background:#cccccc" align="center"|[https://lists.owasp.org/mailman/listinfo/owasp-teachable-static-analysis-workbench '''Mailing List/Subscribe''']<br>
 
  | style="width:14%; background:#cccccc" align="center"|[https://lists.owasp.org/mailman/listinfo/owasp-teachable-static-analysis-workbench '''Mailing List/Subscribe''']<br>

Revision as of 02:47, 8 September 2008

PROJECT IDENTIFICATION
Project Name OWASP Teachable Static Analysis Workbench Project
Short Project Description The research will be intended to answer the following questions:
  • Can we integrate existing open source static analysis tools (OWASP and third-party) to work altogether? We plan analysis to cover the following tools: LAPSE, Orizon, ESAPI, FindBugs.
  • How static analysis workbench can be taught by security analyst?
  • How static analysis workbench can support web-applications built using MVC frameworks?

Workbench prototype will be Java-based Eclipse plug-in which aim is to help security analyst/code reviewer validation of web application. At prototype step we suggest to analyze J2EE Web tier applications build on Java Servlets, JSP (without business logic in it) and one MVC framework (Apache Struts). We plan workbench prototype to have the following functionality:

  • Input validation vulnerabilities analysis: identification of web application entry points (aka attack surface in P024), call graph for each entry point (see “Packages -> Classes -> Methods -> callsites” in P023), identification of data validation routines, teachable taint analysis.
  • Authentification and access control analysis: identification of code related to access control and it’s analysis.
  • Pattern-based code analysis.
  • Teachability: analyst indicates security-related code (sources of tainted data, sensitive sinks, input validation and sanitizing functions, access control code, etc.) and workbench automatically recomputes possible vulnerabilities list. The second idea is to spread knowledge gathered from analyst to other web applications.
Email Contacts Project Leader
Dmitry Kozlov
Igor Konnov
Project Contributors
(if applicable)
Name&Email
Mailing List/Subscribe

Mailing List/Use

First Reviewer
Alex Fry
Profile
Second Reviewer
Michael Coates
OWASP Board Member
(if applicable)
Name&Email
PROJECT MAIN LINKS
SPONSORS & GUIDELINES
Sponsor - OWASP Summer of Code 2008 Sponsored Project/Guidelines/Roadmap
ASSESSMENT AND REVIEW PROCESS
Review/Reviewer Author's Self Evaluation
(applicable for Alpha Quality & further)
First Reviewer
(applicable for Alpha Quality & further)
Second Reviewer
(applicable for Beta Quality & further)
OWASP Board Member
(applicable just for Release Quality)
50% Review Objectives & Deliveries reached?
Yes
---------
See&Edit:50% Review/Self-Evaluation (A)
Objectives & Deliveries reached?
Yes/No (To update)
---------
See&Edit: 50% Review/1st Reviewer (C)
Objectives & Deliveries reached?
Yes/No (To update)
---------
See&Edit: 50%Review/2nd Reviewer (E)
X
Final Review Objectives & Deliveries reached?
Yes/No (To update)
---------
Which status has been reached?
Season of Code - (To update)
---------
See&Edit: Final Review/SelfEvaluation (B)
Objectives & Deliveries reached?
Yes/No (To update)
---------
Which status has been reached?
Season of Code - (To update)
---------
See&Edit: Final Review/1st Reviewer (D)
Objectives & Deliveries reached?
Yes/No (To update)
---------
Which status has been reached?
Season of Code - (To update)
---------
See&Edit: Final Review/2nd Reviewer (F)
X