Code Scanning代碼掃描相關標準
這篇文章主要列出幾個 Coding Standard業界的標準,
並且說明實務上常見的 Top 10是那些
Java Secure Code Standard
–CWE
–Java Secure Coding Guidelines by Oracle
http://www.oracle.com/technetwork/java/seccodeguide-139067.html
C/C++ Secure Code Standard
–CWE
–NASA: Power of Ten: Rules for Developing Safety-Critical Code
實務十大C++代碼問題
Checker | Percent | Severity |
FUNCRET.IMPLICIT | 36.66% | 2 |
MLK.MIGHT | 6.20% | 2 |
NPD.FUNC.MUST | 4.62% | 1 |
NPD.CHECK.MIGHT | 4.15% | 1 |
ABV.GENERAL | 3.94% | 1 |
RH.LEAK | 3.54% | 1 |
MLK.MUST | 2.03% | 2 |
SV.RVT.RETVAL_NOTTESTED | 2.02% | 4 |
NPD.FUNC.MIGHT | 1.98% | 1 |
CL.FFM.ASSIGN | 1.95% | 3 |
十大 C# 常見問題
Checker | Percent | Severity |
CS.RLK | 50.13 | 2 |
CS.UNCHECKED.CAST | 13.38 | 2 |
CS.LOOP.STR.CONCAT | 8.18 | 4 |
CS.UNCHECKED.LOOPITER.CAST | 5.85 | 2 |
CS.NRE.FUNC.MIGHT | 4.91 | 2 |
CS.NRE.FUNC.MUST | 2.42 | 2 |
CS.SQL.INJECT.LOCAL | 2.26 | 2 |
CS.HIDDEN.MEMBER.PARAM.CLASS | 1.62 | 3 |
CS.WRONG.CAST.MIGHT | 1.52 | 2 |
CS.HIDDEN.MEMBER.LOCAL.CLASS | 1.45 | 3 |
十大Java常見問題
Checker | Percent | Severity |
NPE.RET.UTIL | 11.41 | 1 |
NPE.RET | 10.22 | 1 |
JD.VNU.NULL | 10.07 | 4 |
JD.VNU | 8.23 | 4 |
EXC.BROADTHROWS | 8.09 | 4 |
NPE.CONST | 5.78 | 1 |
SV.SERIAL.NOWRITE | 3.98 | 4 |
SV.SERIAL.NOREAD | 3.96 | 4 |
SV.UMC.THREADS | 3.84 | 4 |
ECC.EMPTY | 3.63 | 4 |