Bug 35984 - automated static code analysis should include security tests
Summary: automated static code analysis should include security tests
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-02 00:12 UTC by Evelyn Hartline
Modified: 2024-04-04 14:43 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Evelyn Hartline 2024-02-02 00:12:49 UTC
A few libraries have asked recently if, prior to production/during the development lifecycle, automated source code analysis tools are used to test for security flaws specifically. Typically these questions are in relation to processes like renewing cybersecurity insurance or initial discovery by a potential partner library's security/IT department.

Perlcritic seems to be currently used, but as far as I can tell it appears the tests are for enforcing the coding standard. 

Using an automated tool to look for security flaws will be a beneficial addition to the project, so I'd like to at least start the discussion here. 

OWASP has an informational page for further reading: https://owasp.org/www-community/controls/Static_Code_Analysis