Giters

find-sec-bugs / find-sec-bugs

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

Home Page:https://find-sec-bugs.github.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add support for JSR305 @Detainted / @Tainted / @Untainted in the taint analysis

gehel opened this issue · comments

commented

Description

Adding support to JSR305 @Detainted / @tainted / @Untainted in the taint analysis would allow to more easily mark specific classes / methods to ignore some of the violations raised by find-sec-bugs.

For example, in the projects that I work with, we regularly have values coming from configuration files that we implicitly trust. We tend to ignore the warnings generated as false positives (with @SuppressFBWarning), but that will lead to less trust in the tools. We could use custom signatures / configuration to mark some of our own classes as trusted. Having a simple way to mark trusted classes directly in code via annotations seems simpler and helps improve the documentation of the code itself. Since JSR305 already provides annotations that match this use case, it seems like a good idea to use them.