Last week, a new version of Find Security Bugs (FSB), a FindBugs extension was released. In this post, we will present the most recent improvements and some project announcements.

 

Find Security Bugs

FSB is a plugin for the FindBugs static code analysis tool. It specializes in finding security issues in code by searching for bug patterns. It can be used to scan Java Web applications, Android applications and, more recently, Scala and Groovy applications.

Since it analyzes at the bytecode level, source code is not mandatory for the analysis.

FSB can be integrated in most Java IDEs (IntelliJ, Eclipse, Android Studio, etc.) and has many continuous integration options like Jenkins or SonarQube.

 

New languages support

We are now encouraging Groovy and Scala developers to scan their applications and provide feedback. These languages may not be as prevalent as Java but they may be used in certain critical components of your business.

Two enhancements were done in the previous months:
– Added API signatures and bug patterns to support specific framework such as the Play framework.
– Built sample projects to showcase the configuration needed for Gradle, SBT and Maven.

In this first iteration, Scala developers will find rules that cover the most common injection patterns. It also has new capacity to highlight Cross-Site Scripting (XSS) in Play controllers and Twirl templates. Furthermore, all the existing rules targeting cryptography and general Java APIs will be effective if they are used in Scala code as well.

Results of a Scan in IntelliJ

 

Support for JavaServer Pages (JSP)

JSP may not be the safest templating technology available. Indeed, many modern template technologies such as Thymeleaf or client-side Angular.js handle encoding in a much safer fashion. Nevertheless, JSP is still widely used. We frequently encounter it in new code audits. Legacy applications are rarely refactored. For this reason, we needed to cover JSP.

The most likely vulnerability to be found in JSP will be XSS. It may find other types of vulnerabilities if weak buisness logic is embedded in the JSP files.

Here is a preview in SonarQube 5.6 displaying the discovery of two reflected XSS in a JSP:

JSP Coverage in Find Security Bugs (SonarQube)

OWASP Benchmark

OWASP Benchmark compares various static code analysis tools by comparing the results from various analysis samples. It covers eight vulnerability types. The benchmark focuses on evaluating the false positive rate.

In the following diagram, we can see that Find Security Bugs has an excellent coverage (96%). However, the false positive rate is slightly higher than four of the six commercial tools, which is a less good news.

 

Key Contributors

Aside from technological advances, the project is gaining momentum with additional contributors who joined this year. Notably, Tomáš Polešovský from Liferay did excellent contributions and fixes related to the taint analysis system. Also, Maxime Nadeau, an undergraduate student from École de Technologie Supérieure in Montréal, has built an excellent foundation for Scala support as part of his capstone project.

GoSecure is also a key supporter of the project. Some of the new contributions are made in the context of client mandates, while others come from vulnerability research. Both of which are funded by GoSecure. These improvements are directly integrated into the open source project.

 

Conclusion

If you are maintaining or auditing Java, Scala, Groovy or Android applications, you should test the latest version of FSB and potentially discover important vulnerabilities. If you are an existing user, you now have a list of reasons to keep your tool up to date.

GoSecure Titan® Managed Extended Detection & Response (MXDR)​

GoSecure Titan® Managed Extended Detection & Response (MXDR)​ Foundation

GoSecure Titan® Vulnerability Management as a Service (VMaaS)

GoSecure Titan® Managed Security Information & Event Monitoring (SIEM)

GoSecure Titan® Managed Perimeter Defense​ (MPD)

GoSecure Titan® Inbox Detection and Response (IDR)

GoSecure Titan® Platform

GoSecure Professional Security Services

Incident Response Services

Security Maturity Assessment

Privacy Services

PCI DSS Services

Penetration Testing Services​

Security Operations

MicrosoftLogo

GoSecure MXDR for Microsoft

Comprehensive visibility and response within your Microsoft security environment

USE CASES

Cyber Risks

Risk-Based Security Measures

Sensitive Data Security

Safeguard sensitive information

Private Equity Firms

Make informed decisions

Cybersecurity Compliance

Fulfill regulatory obligations

Cyber Insurance

A valuable risk management strategy

Ransomware

Combat ransomware with innovative security

Zero-Day Attacks

Halt zero-day exploits with advanced protection

Consolidate, Evolve & Thrive

Get ahead and win the race with the GoSecure Titan® Platform

24/7 MXDR FOUNDATION

GoSecure Titan® Endpoint Detection and Response (EDR)

GoSecure Titan® Next Generation Antivirus (NGAV)

GoSecure Titan® Network Detection and Response (NDR)

GoSecure Titan® Inbox Detection and Reponse (IDR)

GoSecure Titan® Intelligence

ABOUT GOSECURE

GoSecure is a recognized cybersecurity leader and innovator, pioneering the integration of endpoint, network, and email threat detection into a single Managed Extended Detection and Response (MXDR) service. For over 20 years, GoSecure has been helping customers better understand their security gaps and improve their organizational risk and security maturity through MXDR and Professional Services solutions delivered by one of the most trusted and skilled teams in the industry.

LATEST PRESS RELEASE

GOSECURE BLOG

SECURITY ADVISORIES

24/7 Emergency – (888)-287-5858