Support more frameworks

[bergerbd]

Hi Bernhard,

Are there any plans on your side to further enhance lapse+ and integrate new features? E.g. lapse+ claims to be a security scanner for JEE applications but doesn't support any JEE APIs like JPA or JSF at all (servlet API seems to be the only exception).

To enhance lapse+ API support it's sufficient to add sink nodes to sinks.xml, isn't it?
E.g.
<sink id="javax.persistence.EntityManager.createQuery(String)">
<paramCount>1</paramCount>
<vulnParam>0</vulnParam>
<category>SQL Injection</category>
</sink>

However, in order to support JSF vulnerability sources, it would be necessary to parse XHTMLs in addition to Java sources as well?

Br,
nyc

[bergerbd]

My current plans are to improve code quality in the first place. Then I will have a look at new features and more frameworks. I'm thinking about integrating other taint-scanner as well. There is one in the soot project that will give you more precise results (less false warnings) and supports more frameworks. But it will consume more memory and time. And there is no graphical interface.

Supporting JSF is not easy since you have to read the bean mappings, parse the xhtml and so on. I already tried it in the soot context.