Kuszczyński Kajetan, Walkowski Michał
Department of Telecommunications and Teleinformatics, Wroclaw University of Science and Technology, 50-370 Wroclaw, Poland.
Sensors (Basel). 2023 Sep 19;23(18):7978. doi: 10.3390/s23187978.
The increasing complexity of web applications and systems, driven by ongoing digitalization, has made software security testing a necessary and critical activity in the software development lifecycle. This article compares the performance of open-source tools for conducting static code analysis for security purposes. Eleven different tools were evaluated in this study, scanning 16 vulnerable web applications. The selected vulnerable web applications were chosen for having the best possible documentation regarding their security vulnerabilities for obtaining reliable results. In reality, the static code analysis tools used in this paper can also be applied to other types of applications, such as embedded systems. Based on the results obtained and the conducted analysis, recommendations for the use of these types of solutions were proposed, to achieve the best possible results. The analysis of the tested tools revealed that there is no perfect tool. For example, Semgrep performed better considering applications developed using JavaScript technology but had worse results regarding applications developed using PHP technology.
在持续数字化的推动下，Web应用程序和系统日益复杂，这使得软件安全测试成为软件开发生命周期中一项必要且关键的活动。本文比较了用于安全目的进行静态代码分析的开源工具的性能。本研究评估了11种不同的工具，扫描了16个易受攻击的Web应用程序。选择这些易受攻击的Web应用程序是因为它们拥有关于其安全漏洞的尽可能完善的文档，以便获得可靠的结果。实际上，本文中使用的静态代码分析工具也可应用于其他类型的应用程序，如嵌入式系统。基于获得的结果和进行的分析，提出了使用这类解决方案的建议，以实现尽可能好的结果。对测试工具的分析表明，没有完美的工具。例如，Semgrep在考虑使用JavaScript技术开发的应用程序时表现较好，但在使用PHP技术开发的应用程序方面结果较差。
