Practical Static Analysis for Continuous Application Security
summary
Claims that targeted static analysis is cheap to build and automatable: small grep-based rules or a bash/Ruby script that diffs changed files can flag a specific bug (calls to get_survey with only one arg missing user_id). Moving to AST-based checks (Ruby parser, a JS AST walker, or Bandit for Python) yields precise matches. Examples include custom Brakeman / Bandit plugins or simple scripts that exit non‑zero to fail CI; these approaches run fast and integrate with PRs.
AI-written summary · about
chapters (37)
- 0:00Intro
- 0:24Continuous Security
- 1:23Practical Static Analysis
- 1:41Why Static Analysis?
- 3:24Tool Cycle
- 8:07Enforce the Solution
- 8:54Automate Enforcement
- 9:28Continuous Integration
- 10:03Code Review
- 10:37Deployment Gate
- 11:13Separate Process
- 11:51Local Tests/Git Hook
- 13:391 - Identify a Problem
- 13:582 - Identify a Solution
- 14:31Regular Expressions
- 15:23Desired Flow
- 15:54Bash
- 16:25git diff --name-status
- 17:20Multiple Rules
- 17:37Create a Rule
- 18:05Base Rule Class class Rule
- 18:54Code to Run It
- 20:10False Positives
- 20:52False Negatives
- 21:32Compilation vs. Static Analysis Input Program Text
- 23:46S-Expressions
- 24:09Ruby (RubyParser)
- 24:51Python (Astroid) AstroidBuilder().string_build( get_survey(survey_id))
- 25:53JavaScript (Esprima)
- 26:42Bandit Custom Rule import bandit from bandit.core import test properties as test
- 28:31Bandit Custom Warning
- 28:58Brakeman Custom Check
- 29:59Brakeman Custom Warning
- 30:43Walking Esprima AST
- 32:35Walking RubyParser AST
- 33:40Summary
- 35:14Thank you
related talks
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
33mBattle Tested Application Security
50mPractical Advanced Static Analysis
54mA Shock to the System Static Analysis for Real AppSec
32mCatch Me If You can : Continuous Delivery vs. Security Assurance
32mSAST and Sensibility: A Rubyist’s Guide to Static...
27mStatic Code Analysis with Python
44mStatic analysis as an additional barrier against bugs