Giter Club home page Giter Club logo

codyze's Introduction

Codyze ๐Ÿ”Ž ๐Ÿš€

build GitHub last commit GitHub

Codyze is a static code analyzer that focuses on verifying security compliance in source code, i.e. by inferring the correct use of cryptographic libraries. It operates on code property graphs and is thus able to handle non-compiling or even incomplete code fragments.

Documentation: https://www.codyze.io

Build & run Codyze

Java 11 (OpenJDK) is a prerequisite.

To build an executable version of Codyze, use the installDist task:

$ ./gradlew installDist

This will provide you with an executable Codyze installation under build/install/codyze. Change to that directory and run Codyze:

$ cd build/install/codyze
$ ./bin/codyze

Without further command line arguments, Codyze will print its command line help:

Usage: codyze (-c | -l | -t) [[--typestate=<NFA|WPDS>]] [[--analyze-includes]
              [--includes=<includesPath>[:|;<includesPath>...]] [--includes=<includesPath>[:|;
              <includesPath>...]]...] [-hV] [--no-good-findings] [-m=<path>] [-o=<file>]
              [-s=<path>] [--timeout=<minutes>]
Codyze finds security flaws in source code
  -s, --source=<path>       Source file or folder to analyze.
  -m, --mark=<path>         Load MARK policy files from folder
  -o, --output=<file>       Write results to file. Use -- for stdout.
      --timeout=<minutes>   Terminate analysis after timeout
                              Default: 120
      --no-good-findings    Disable output of "positive" findings which indicate correct
                              implementations
  -h, --help                Show this help message and exit.
  -V, --version             Print version information and exit.
Execution mode
  -c                        Start in command line mode.
  -l                        Start in language server protocol (LSP) mode.
  -t                        Start interactive console (Text-based User Interface).
Analysis settings
      --typestate=<NFA|WPDS>
                            Typestate analysis mode
                            NFA:  Non-deterministic finite automaton (faster, intraprocedural)
                            WPDS: Weighted pushdown system (slower, interprocedural)
Translation settings
      --analyze-includes    Enables parsing of include files. By default, if --includes are given,
                              the parser will resolve symbols/templates from these include, but not
                              load their parse tree.
      --includes=<includesPath>[:|;<includesPath>...]
                            Path(s) containing include files. Path must be separated by :
                              (Mac/Linux) or ; (Windows)

Please refer to https://www.codyze.io for further usage instructions.

Research & Student Work

If you are looking for an exciting thesis project or student job in the field of static analysis, we are happy to discuss possible topics. Please contact us at codyze [at] aisec.fraunhofer.de.

Support

We will continue to maintain this project for the foreseeable future on a best-effort basis. That is, if you run into any bugs or find the documentation insufficient, we encourage you to open issues or pull requests. If you are interested in support and development for commercial use, please contact us.

License

Apache License 2.0

codyze's People

Contributors

julianschuette avatar fwendland avatar oxisto avatar obraunsdorf avatar renovate-bot avatar masrepus avatar renovate[bot] avatar maximiliankaul avatar benj-zen avatar dependabot[bot] avatar

Watchers

James Cloos avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.