Hi! Is anyone aware of a tool that can scan for po...

# server

[shelbycohen]

Hi! Is anyone aware of a tool that can scan for possible security violations in Kotlin code similar to how Checkmarx works? Checkmarx has added Android Kotlin support but doesn’t support server side

[Dariusz Kuc]

Afaik there isnt one yet. Fortify supposedly have kotlin support somewhere on their roadmap but there is no eta.

[Dariusz Kuc]

Well technically fortify can do byte code scans but it didnt work that great when we tried it

[shelbycohen]

Aw okay, thanks for the info

[shelbycohen]

@Dariusz Kuc I found this https://arturbosch.github.io/detekt/ but it isn’t exactly what we are looking for

[Dariusz Kuc]

detekt is more like findbugs

[Dariusz Kuc]

It is not security oriented

[shelbycohen]

Yeah, I saw you could write custom rulesets but not what we are looking for

[Dariusz Kuc]

Btw detekt is highly recommended

[shelbycohen]

@Dariusz Kuc Have you heard of https://www.sonarsource.com/products/codeanalyzers/sonarkotlin.html

[Dariusz Kuc]

Sonar is great

[Dariusz Kuc]

It combines info from multiple different sources in nice ui

[Dariusz Kuc]

But again it is not security oriented

[Dariusz Kuc]

You could use sonar to keep track of trends so you could see how your code evolves

[shelbycohen]

It does say in the description: “Based on our own Kotlin analyzer, it can find bugs, security vulnerabilities and code smells”

[Dariusz Kuc]

eg unit test coverage, code complexity, detekt violatioms etc

[Dariusz Kuc]

Well detekt also has some security rules

[Dariusz Kuc]

Our security folks wouldnt sign on it

[shelbycohen]

☹️

[Dariusz Kuc]

I guess if more folks show interest in it maybe fortify will get to implementing the support

[Dariusz Kuc]

In the meantime you might have to do manual security reviews

[shelbycohen]

Checkmarx has it on their roadmap for Q1 2020 so if people show more interest in that also it will help 🙂

[Malena Ebert]

I am a developer at RIPS (https://ripstech.com). Kotlin support is on our roadmap. (Currently we support Java and PHP, JS and C# will be next.)

[jaguililla]

I guess this tool does it: http://find-sec-bugs.github.io

[shelbycohen]

@Malena Ebert Do you have an estimated date?

[shelbycohen]

@jaguililla Have you used that for Kotlin?

[jaguililla]

Not myself, but at my company they are evaluating it

[shelbycohen]

Oh cool! Let me know what their evaluation is when you know

[jaguililla]

👍

[Dariusz Kuc]

@shelbycohen looks like https://www.veracode.com/ might be a viable option

[shelbycohen]

Thank you!