Can SonarQube be used as a Static Application Security Testing (SAST) tool?

sonarqube code-analysis static-analysis sonarqube-scan security-testing
DogJunior picture DogJunior · Nov 24, 2017 · Viewed 8.6k times · Source

I'm looking for a Static Application Security Testing (SAST) tool and I can't afford the commercial products (eg. Checkmarx).

SonarQube is a great static code analysis tool but I notice that there is only a few rules of the "Vulnerabilities" type ("Vulnerabilities" equals "Security", am I right?).

I plan to extend some custom plugins including a lot of vulnerabilities rules (maybe hundreds of rules for C/C++, Java, and other languages that SonarQube supports).

Is that a practicable way to make SonarQube a "Checkmarx like" tool? Or is SonarQube suitable for static security testing? (I'm not sure if Sonar Scanner is suitable for scanning security problems)

Thanks a lot!

Answer

lkamal picture lkamal · Oct 8, 2019

There is a separate SAST tool released by OWASP team named "OWASP SonarQube". This is developed using the sonarqube tool, but as a SAST tool.

This tool can be integrated with your project build same as the SonarQube integration. So if you are familiar with SonarQube, it will be a straightforward move.

Related questions

Either log or rethrow this exception

Possible duplicate of Sonar complaining about logging and rethrowing the exception. This is my code in a class: try { this.processDeepLinkData(data); } catch (final Exception e) { // Error while parsing data // Nothing we can do Logger.error(TAG, "Exception thrown on …

Read More
SonarQube Exclude a directory

I am trying to exclude a directory from being analyzed by Sonar. I have the following properties defined in my sonar-project.properties file: sonar.sources=src/java sonar.exclusions=src/java/test/****/*.java The directory structure I have is: src/…

Read More
Turning Sonar off for certain code

Is it possible to turn off sonar (www.sonarsource.org) measurements for specific blocks of code, which one doesn't want to be measured? An example is the "Preserve Stack Trace" warning which Findbugs outputs. When leaving the server, I might …

Read More