Find Security Bugs: the open-source Java static analysis tool

Last week, a new version of Find Security Bugs (FSB), a FindBugs extension was released. In this post, we will present the most recent improvements and some project announcements.

Find Security Bugs

FSB is a plugin for the FindBugs static code analysis tool. It specializes in finding security issues in code by searching for bug patterns. It can be used to scan Java Web applications, Android applications and, more recently, Scala and Groovy applications.

Since it analyzes at the bytecode level, source code is not mandatory for the analysis.

FSB can be integrated in most Java IDEs (IntelliJ, Eclipse, Android Studio, etc.) and has many continuous integration options like Jenkins or SonarQube.

New languages support

We are now encouraging Groovy and Scala developers to scan their applications and provide feedback. These languages may not be as prevalent as Java but they may be used in certain critical components of your business.

Two enhancements were done in the previous months:
– Added API signatures and bug patterns to support specific framework such as the Play framework.
– Built sample projects to showcase the configuration needed for Gradle, SBT and Maven.

In this first iteration, Scala developers will find rules that cover the most common injection patterns. It also has new capacity to highlight Cross-Site Scripting (XSS) in Play controllers and Twirl templates. Furthermore, all the existing rules targeting cryptography and general Java APIs will be effective if they are used in Scala code as well.

Support for JavaServer Pages (JSP)

JSP may not be the safest templating technology available. Indeed, many modern template technologies such as Thymeleaf or client-side Angular.js handle encoding in a much safer fashion. Nevertheless, JSP is still widely used. We frequently encounter it in new code audits. Legacy applications are rarely refactored. For this reason, we needed to cover JSP.

The most likely vulnerability to be found in JSP will be XSS. It may find other types of vulnerabilities if weak buisness logic is embedded in the JSP files.

Here is a preview in SonarQube 5.6 displaying the discovery of two reflected XSS in a JSP:

OWASP Benchmark

OWASP Benchmark compares various static code analysis tools by comparing the results from various analysis samples. It covers eight vulnerability types. The benchmark focuses on evaluating the false positive rate.

In the following diagram, we can see that Find Security Bugs has an excellent coverage (96%). However, the false positive rate is slightly higher than four of the six commercial tools, which is a less good news.

Key Contributors

Aside from technological advances, the project is gaining momentum with additional contributors who joined this year. Notably, Tomáš Polešovský from Liferay did excellent contributions and fixes related to the taint analysis system. Also, Maxime Nadeau, an undergraduate student from École de Technologie Supérieure in Montréal, has built an excellent foundation for Scala support as part of his capstone project.

GoSecure is also a key supporter of the project. Some of the new contributions are made in the context of client mandates, while others come from vulnerability research. Both of which are funded by GoSecure. These improvements are directly integrated into the open source project.

Conclusion

If you are maintaining or auditing Java, Scala, Groovy or Android applications, you should test the latest version of FSB and potentially discover important vulnerabilities. If you are an existing user, you now have a list of reasons to keep your tool up to date.