Source Code Analysis Tools - daniel-qa/Information-Security GitHub Wiki
https://owasp.org/www-community/Source_Code_Analysis_Tools
Source code analysis tools, also known as Static Application Security Testing (SAST) Tools, can help analyze source code or compiled versions of code to help find security flaws.
Sonarqube
是一個開源的代碼品質管理系統
ref : https://blog.csdn.net/WangYouJin321/article/details/127880214
- 直接安裝
安裝方式
SonarQube 支援跨平台，安裝方式也相單簡單，至官方 GitHub 專案位置下載並解壓縮後，執行啟動指令檔即可運作起來。
# on linux
bin/linux-x86-64/sonar.sh start
# on macOS
bin/macosx-universal-64/sonar.sh start
# on Windows
bin\windows-x86-64\StartSonar.bat
接著，使用瀏覽器連接至
http://localhost:9000/ 即可進入使用。
insider
- 免費版輸出資訊太少
# Check the correct release for your environment
$ wget https://github.com/insidersec/insider/releases/download/2.1.0/insider_2.1.0_linux_x86_64.tar.gz
$ tar -xf insider_2.1.0_linux_x86_64.tar.gz
$ chmod +x insider
$ ./insider --tech javascript --target <projectfolder>
- EX
./insider --tech javascript --target sokradeo