| Summary: | automated static code analysis should include security tests | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Evelyn Hartline <evelyn> |
| Component: | Architecture, internals, and plumbing | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | dcook, emily.lamancusa |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34347 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Evelyn Hartline
2024-02-02 00:12:49 UTC
I think it's an interesting idea that we should certainly explore. I remember hearing about RATS but I don't think it's actually maintained: https://manpages.ubuntu.com/manpages/trusty/man1/rats.1.html I didn't realise until now but Perl::Critic apparently does have a "security" theme. I think this is probably the direction we should pursue. We could always develop our own Perl::Critic policies (which leverages PPI under the hood). |