Sonar OWASP Plug-in

I have done several demos to clients on Sonar. Last week, I did a Brown Bag @ Cigital on Sonar. As I was preparing the Virtual Machine which I created for Sonar, I noticed the OWASP Plug-in. I downloaded the trial version and ran analysis on a few projects.

As I was doing the demo, several of our Consultants @ Cigital had tons of questions about how this plug-in worked. Remember, Cigital helps companies improve the security of our clients most reliable applications. :)

I promised to look in detail within this plug-in to see what engine was running behind the scenes, how they mapped the OWASP Top 10 vulnerabilities and so on.

Over the last 5 years, I have used several tools for running scans on various languages. I have used tools like Coverity, IBM's AppScan Source Edition, and HP's Fortify. I was of the impression that this Plug-in was built with a powerful engine which compared to the tools I mentioned. I was really disappointed to see that it doesn't have any engine to find security vulnerabilities. The plug-in just maps rules from FindBugs, PMD and CheckStyle to the OWASP Top 10 rules.It has an XML file and you can map the rules within this file.

It gives you a false sense of security when you see the OWASP Factor Risk. The sample project I scanned using this plug-in has all the OWASP Top 10 vulnerabilities like Cross-Site Scripting, SQL Injection, Command Injection and many more. And this plug-in wasn't able to find any of these vulnerabilities. It is just a mapping of a few rules mapped to FindBugs, PMD and CheckStyle.

The idea behind this Plug-in is really great. However, if the engine can be improved behind the scenes, or if the plug-in can parse results from one of the SCR tools like Coverity, IBM's AppScan Source Edition, and HP's Fortify than there is real value to the plug-in.

You can find more details about Sonar and the OWASP Plug-in at the links provided below:

• Sonar
• OWASP Sonar Plug-in

Deleting a project from Sonar

I have been using Sonar for several years now. However, I never deleted any project. So, when one of my colleagues asked me how to delete a project from Sonar, I had to spend a few minutes looking for the same.

It is quite easy to delete a project from Sonar.Listed below are the steps to delete a project.

1. Login into Sonar as an Administrator.

2. Next, click on the project you want to delete.

3. Click on the "Project Deletion" link on the left hand side. Highlighted in red in the above image.

4. Click on the "Delete Project" button. The operation cannot be undone.

Packt Publishing Publishes 1000 Titles

I have read  and reviewed several books from Packt Publishing. I read several books and reading books from various publishers definitely brings variety.

Packt would like you to join them in celebrating this milestone with a surprise gift. Revisit Packt’s website between the 28th and 30th of September to redeem your gift, or sign up for an account with us now to receive a notification email.

Packt supports many of the Open Source projects covered by its books through a project royalty donation, which has contributed over $400,000 to Open Source projects. As part of the 1000th book celebration Packt is allocating $30,000 to share between projects and authors.

If you are interested in  reading books, go ahead and signup and get a surprise gift. It maybe a book which you always wanted to read.

Check out all the details from Packt at their website : http://www.packtpub.com/

FindBugs Custom Detector -Build Failure - com.sun.tools.javac.code.Symbol$CompletionFailure

I was working today on a plug-in for FindBugs, writing CustomDetectors for finding some security vulnerabilities. I was able to compile the project and create the plug-in in Eclipse IDE. However, when I started working on creating a basic Ant build file, the compile target failed miserably. The error I was seeing in the Eclipse IDE was:

Buildfile: C:\Users\msubbarao\workspace\FindBugs_Cigital_Plugin\build.xml

clean:

init:

compile:

    [javac] C:\Users\msubbarao\workspace\FindBugs_Cigital_Plugin\build.xml:32: warning: 'includeantruntime' was not set, defaulting to build.sysclasspath=last; set to false for repeatable builds

    [javac] Compiling 8 source files to C:\Users\msubbarao\workspace\FindBugs_Cigital_Plugin\bin

    [javac] An exception has occurred in the compiler (1.6.0_24). Please file a bug at the Java Developer Connection (http://java.sun.com/webapps/bugreport)  after checking the Bug Parade for duplicates. Include your program and the following diagnostic in your report.  Thank you.

    [javac] com.sun.tools.javac.code.Symbol$CompletionFailure: class file for javax.annotation.meta.When not found

BUILD FAILED

C:\Users\msubbarao\workspace\FindBugs_Cigital_Plugin\build.xml:32: Compile failed; see the compiler error output for details.

Total time: 1 second

A quick search on the web, and after adding the jsr305.jar to the classpath, the compilation error was gone.

Buildfile: C:\Users\msubbarao\workspace\FindBugs_Cigital_Plugin\build.xml

clean:

init:

compile:

    [javac] C:\Users\msubbarao\workspace\FindBugs_Cigital_Plugin\build.xml:32: warning: 'includeantruntime' was not set, defaulting to build.sysclasspath=last; set to false for repeatable builds

    [javac] Compiling 8 source files to C:\Users\msubbarao\workspace\FindBugs_Cigital_Plugin\bin

jar:

      [jar] Building jar: C:\Users\msubbarao\workspace\FindBugs_Cigital_Plugin\FindBugs_Cigital_Plugin.jar

     [copy] Copying 1 file to C:\dev\eclipse\plugins\edu.umd.cs.findbugs.plugin.eclipse_2.0.1.20120712\plugin

BUILD SUCCESSFUL

Total time: 1 second

For more details on FindBugs visit, FindBugs Site.

Stay tuned for detailed posts on how to write CustomDetectors for FindBugs.