Skip to content

docs: add OpenTaint (taint-analysis SAST) under a new "Code Security" section #2876

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
misonijnik wants to merge 1 commit into
base: main
Choose a base branch
from
+5 −1
Open

docs: add OpenTaint (taint-analysis SAST) under a new "Code Security" section #2876

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion docs/open-source-project/tools.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
title: Java 优质开源开发工具
description: Java优质开源开发工具推荐，涵盖代码质量检查、项目构建、测试框架、容器化部署等开发必备工具精选。
description: Java优质开源开发工具推荐，涵盖代码质量检查、代码安全分析、项目构建、测试框架、容器化部署等开发必备工具精选。
category: 开源项目
icon: "mdi:tools"
---
Expand All @@ -14,6 +14,10 @@ icon: "mdi:tools"
- [SpotBugs](https://github.com/spotbugs/spotbugs "spotbugs") : FindBugs 的继任者。静态分析工具，用于查找 Java 代码中的错误。
- [P3C](https://github.com/alibaba/p3c "p3c")：Alibaba Java Coding Guidelines pmd implements and IDE plugin。Eclipse 和 IDEA 上都有该插件。

## 代码安全

- [OpenTaint](https://github.com/seqra/opentaint/blob/main/docs/translations/README.zh.md "opentaint")：AI 时代的开源污点分析（Taint Analysis）引擎，面向 Java、Kotlin 和 Spring Boot 应用，可用于应用安全审计（SAST）。它基于字节码进行过程间（inter-procedural）数据流分析，追踪不可信数据在代码中的传播路径，能够检测 SQL 注入、XSS、SSRF、命令注入等 20 多种漏洞。相比传统的模式匹配工具，OpenTaint 还能建模 Spring 的依赖注入、单例 Bean 状态以及 JPA 持久化等跨类、跨请求的数据流，从而发现更深层次的安全问题。核心引擎采用 Apache 2.0 许可证，CLI 与规则集采用 MIT 许可证。官网：[opentaint.org](https://opentaint.org/)；延伸阅读：[Spring 污点分析原理](https://opentaint.org/blog/spring-analyzer/)、[结合 LLM Agent 的低成本安全扫描](https://opentaint.org/blog/appsec-agent/)。

## 项目构建

- [Maven](https://maven.apache.org/)：一个软件项目管理和理解工具。基于项目对象模型 (Project Object Model，POM) 的概念，Maven 可以从一条中心信息管理项目的构建、报告和文档。详细介绍：[Maven 核心概念总结](https://javaguide.cn/tools/maven/maven-core-concepts.html)。
Expand Down