Code Scanning代碼掃描相關標準

Code Scanning代碼掃描相關標準

這篇文章主要列出幾個 Coding Standard業界的標準,

並且說明實務上常見的 Top 10是那些

Java Secure Code Standard

CWE

OWASP

DISA STIG

–Java Secure Coding Guidelines by Oracle

http://www.oracle.com/technetwork/java/seccodeguide-139067.html

C/C++ Secure Code Standard

MISRA

CWE

CERT Secure Coding Standard

DISA STIG

NASA: Power of Ten: Rules for Developing Safety-Critical Code

實務十大C++代碼問題

Checker Percent Severity
FUNCRET.IMPLICIT 36.66% 2
MLK.MIGHT 6.20% 2
NPD.FUNC.MUST 4.62% 1
NPD.CHECK.MIGHT 4.15% 1
ABV.GENERAL 3.94% 1
RH.LEAK 3.54% 1
MLK.MUST 2.03% 2
SV.RVT.RETVAL_NOTTESTED 2.02% 4
NPD.FUNC.MIGHT 1.98% 1
CL.FFM.ASSIGN 1.95% 3

 

十大 C# 常見問題

Checker Percent Severity
CS.RLK 50.13 2
CS.UNCHECKED.CAST 13.38 2
CS.LOOP.STR.CONCAT 8.18 4
CS.UNCHECKED.LOOPITER.CAST 5.85 2
CS.NRE.FUNC.MIGHT 4.91 2
CS.NRE.FUNC.MUST 2.42 2
CS.SQL.INJECT.LOCAL 2.26 2
CS.HIDDEN.MEMBER.PARAM.CLASS 1.62 3
CS.WRONG.CAST.MIGHT 1.52 2
CS.HIDDEN.MEMBER.LOCAL.CLASS 1.45 3

 

十大Java常見問題

Checker Percent Severity
NPE.RET.UTIL 11.41 1
NPE.RET 10.22 1
JD.VNU.NULL 10.07 4
JD.VNU 8.23 4
EXC.BROADTHROWS 8.09 4
NPE.CONST 5.78 1
SV.SERIAL.NOWRITE 3.98 4
SV.SERIAL.NOREAD 3.96 4
SV.UMC.THREADS 3.84 4
ECC.EMPTY 3.63 4

Leave a Reply

Your email address will not be published.