静态分析、测试工具

静态代码分析 测试工具汇总 静态代码扫描 借用一段网上的原文解释一下 这里叫静态检查 静态测试包括代码检 查 静态结构分析 代码质量度量等 它可以由人工进行 充分发挥人的逻辑思维优势 也可以借助软件工具自动进行 代码检查代码检查包括代码走查 桌面检查 代码审查等 主要检查代码和设计的一致性 代码对标准的遵循 可读性 代码的逻辑表达的正确性 代码结构的合理性等方面 可以发现违背程序编写标准的问题 程序中不安全 不明确和 模糊的部分 找出程序中不可移植部分 违背程序编程风格的问题 包括变量检查 命名 和类型审查 程序逻辑审查 程序语法检查和程序结构检查等内容 我看了一系列的静态代码扫描或者叫静态代码分析工具后 总结对工具的看法 静态代码 扫描工具 和编译器的某些功能其实是很相似的 他们也需要词法分析 语法分析 语意 分析 但和编译器不一样的是他们可以自定义各种各样的复杂的规则去对代码进行分析 以下将会列出的静态代码扫描工具 会由于实现方法 算法 分析的层次不同 功能上会 差异很大 有的可以做 SQL 注入的检查 有的则不能 当然 由于时间问题还没有对规则进 行研究 但要检查复杂的代码安全漏洞 是需要更高深分析算法的 所以有的东西应该不 是设置规则库就可以检查到的 但在安全方面的检查 一定程度上也是可以通过设置规则 进行检查的 工具名 静态扫 描语言 开 源 付 费 厂商介绍主页网址 ounec5 0 VB Net C C 和 C 还支持 Java 付 费 Ounce Labs Coveri ty Preven t C C C JAV A 付 费 Cover ity 还有其他辅 助工具 1 Coverity Thread Analyzer for Java html 2 Coverity Software Readiness Manager for Java 3 Coverity Architectu re Analyzer stake SmartR isk Analyz er C C Java 付 费 Syman tec Corpo ratio n stake SmartRisk Analyzer harnesses the power of static analysis of binary executable s C C and Java to identify categorize and prioritize security 注 在 Symantec 没有搜到此 产品 ess index jsp Ration al Purify C C Java 付 费 IBM Provides memory leak and memory corruption detection for Windows R untime http www purify PREfix micro soft 微软用的静 态分析工具 但暂时没有 找到下载 现在好像在 考虑发布中 JtextJava 付 费 paras oft 同时还有其 他静态分析 代码的产品 如 C Test 详细请查询 官网 n support jsp flawfi nder C C 开 源 用 Python 编写的 c c 程序 安全审核工 具 可以检查潜 在的安全风 险 inder Static Code Analyz er C C C JAV A 付 费 Forti fy Klocwo rk Insigh t C C Java 付 费 Klocw ork cts insight asp PolySp ace Client Serve r C C Ada 语言 付 费 MathW orks rats C C Python Perl PHP 代 码进行 安全审 核的工 具 开 源 ty resources rats jsp LAPSEJava 开 源 LAPSE stands for a Lightweigh t Analysis for Program Security in Eclipse LAPSE is designed to help with the task of auditing Java J2EE applicatio ns for common types of security vulnerabil ities found in Web applicatio ns LAPSE was developed by Benjamin Livshits as part of the Griffin Software Security Project http www owasp org index ph p Category OWASP LAPSE Projec t Fluidjava 开 源 We have explored properties including http www fluid cs cmu edu 8 080 Fluid race conditions and locking policies unique references and other programmer significan t aliasing properties effects appropriat e typing realtime threading policies and single threading policies SplintC 开 源 Unive rsity of Virgi nia Depar tment of Compu ter Scien ce 静态检测针 对 C 语言的 安全工具和 漏洞检测 http www splint org cqualC C 开 源 马里 兰大 学 轻量级的静 态扫描器 在类 Linux 系统下运行 http www cs umd edu jfoste r cqual MOPSC 开 源 berke ley 大 学 MOPS is a tool for finding security bugs in C programs and for verifying conformanc e to rules of defensive programmin g http www cs berkeley edu d aw mops BOONC 开 源 berke ley 大 学 BOON is a tool for automatica lly finding buffer overrun vulnerabil ities in C source code Buffer overruns are one of the most common types of security holes and we hope that BOON will enable http www cs berkeley edu d aw boon software developers and code auditors to improve the quality of security critical programs BLASTC 开 源 The BLAST 2 0 Team BLAST is a software model checker for C programs The goal of BLAST is to be able to check that software satisfies behavioral properties of the interfaces it uses BLAST uses counterexa mple driven automatic abstractio n refinement to construct an abstract model which is model http mtc epfl ch software tools blast checked for safety properties The abstractio n is constructe d on the fly and only to the required precision SpikeW AMP Php 开 源 for analyzing PHP programs http developer spikesource com wiki index php SpikeWAMP PixyPhp 开 源 Finding XSS and SQLI vulnerabil ities http pixybox seclab tuwien ac at pixy MikeJava 开 源 Java source code security scanner built on top of Orizon They are connected to OWASP ownload html SmatchC 开 源 OinkC 开 源 C Static Analysis Tools http www cubewano org oink Frama C C 开 源 static analyzers for the C http frama c cea fr language RTL check 开 源 RTL check is an extensible and powerful abstract interpreta tion framework for static analysis of programs from a safety and security perspectiv e http rtlcheck sourceforge n et PMDJava 开 源 PMD scans Java source code and looks for potential problems like Possible bugs empty try catch finally switch statements Dead code unused local variables parameters and private methods Suboptimal code wasteful String Str ingBuffer usage Overcompli cated expression s unnecessar y if statements for loops that could be while loops Duplicate code copied pas ted code means copied pas ted bugs FindBu gs Java 开 源 马里 兰大 学 uses static analysis to look for bugs in Java code 注意 提供 Eclipse 插 件 http findbugs sourceforge n et ITS4C C 开 源 Cigital developed ITS4 to help automate source code review for security QJ ProJava 开 源 QJ Pro is a comprehens ive software inspection tool targeted towards the software developer QJ Pro checks conformanc e to coding standards misuse of the Java language best practice conformenc e code structure and potential bugs at the earliest stages of developmen t 注意 提供 各种 IDE 插 件 JintJava 开 源 Jlint will check your Java code and find bugs inconsiste ncies and synchroniz ation problems by doing data flow analysis and building the lock graph Hammur api Java 开 源 code review system captures coding best practices and delivers them to developers fingertips It also generates consolidat ed reports for lead developers http www hammurapi biz hamm urapi biz ef xmenu hammurapi group index html architects and managers to monitor codebase quality and evolution Doctor J Java 开 源 Among what it detects misspelled words parameter and exception names o missing o misordered o misspelled Javadoc tags o invalid o misordered o missing expected arguments o invalid arguments http www incava org project s java doctorj index html o missing descriptio ns undocument ed classes methods fields parameters Depend ency Finder Java 开 源 Dependency Finder is a suite of tools for analyzing compiled Java code At the core is a powerful dependency analysis applicatio n that extracts dependency graphs and mines them for useful informatio n This applicatio n comes in many forms for your ease of use including command line tools a Swing based http depfind sourceforge ne t applicatio n a web applicatio n ready to be deployed in an applicatio n server and a set of Ant tasks Checks tyle Java 开 源 Checkstyle is a developmen t tool to help programmer s write Java code that adheres to a coding standard It automates the process of checking Java code to spare humans of this boring but important task This makes it ideal for projects that want to enforce a coding http checkstyle sourceforge net standard 注意 提供 多种 IDE 的 插件 Classy cle Java 开 源 Classyc