Can SonarQube be used as a Static Application Security Testing (SAST) tool?

user_6847755 0
Viewed 12258

I'm looking for a Static Application Security Testing (SAST) tool and I can't afford the commercial products (eg. Checkmarx).

SonarQube is a great static code analysis tool but I notice that there is only a few rules of the "Vulnerabilities" type ("Vulnerabilities" equals "Security", am I right?).

I plan to extend some custom plugins including a lot of vulnerabilities rules (maybe hundreds of rules for C/C++, Java, and other languages that SonarQube supports).

Is that a practicable way to make SonarQube a "Checkmarx like" tool? Or is SonarQube suitable for static security testing? (I'm not sure if Sonar Scanner is suitable for scanning security problems)

Thanks a lot!

security-testing sonarqube-scan sonarqube static-analysis code-analysis
3 Answers

There is a separate SAST tool released by OWASP team named "OWASP SonarQube". This is developed using the sonarqube tool, but as a SAST tool.

This tool can be integrated with your project build same as the SonarQube integration. So if you are familiar with SonarQube, it will be a straightforward move.

user_25811280

I don't know *heckmarx but if you only filter for vulnerabilities you may only see 33 rules. If you however filter for different standards like SANS, SWE, CERT and the like there are many more: https://www.sonarsource.com/products/codeanalyzers/sonarjava/rules.html#CERT

Also you can add findbugs with the secbugs plugin which has over 125 securitys bug pattern... You may have to deactivate the redundant, though (and it is only for java...)

user_23115280

I would like to to draw your attention to the PVS-Studio tool. It is orientated not only on the code quality control (search code smells), but also on the search of real errors and potential vulnerabilities. Here is the list, showing a сonsistency between PVS-Studio and CWE diagnostics. Soon it will be available to work in CWE code mode in the PVS-Studio interface. It is planned for the next PVS-Studio 6.20 release.

PVS-Studio is a tool for bug detection in the source code of programs, written in C, C++, and C#. It works in Windows and Linux environment. Another pleasant addition is the ability to integrate PVS-Studio with SonarQube.

user_77723560
Related