Testability Patterns For Web Apps - A New OWASP Project
summary
An OWASP project defines concrete testability patterns for SAST (catalogs of ~100+ patterns per language) and a Python framework with Docker that integrates CodeQL and other tools to run measurements and discovery rules. Static analyzers hit an obstacle roughly every 20 lines in a 3,000‑repo PHP corpus (top performer every 200 lines); no PHP tool covers >50% of patterns, JavaScript ~60%. Automated rewrites of five patterns across the corpus yield 9000+ new findings, with 370 confirmed true positives from a 2,700‑sample check.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:26Testability patterns for security
- 3:12Static analysis basics
- 7:27Vulnerability example
- 11:45Creating patterns
- 15:40Patterns catalog (PHP JS Java)
- 17:06Measuring patterns in apps
- 21:01Results from 3K GitHub apps
- 26:01Call to action: join community
- 26:43Role play: project impact
- 37:27How to contribute
- 39:56Next steps: top 10 patterns
- 41:02Future directions beyond static analysis
- 41:29Q&A 1
- 42:33Q&A 2
- 44:25Q&A 3
- 46:08Q&A 4
- 48:57Q&A 5
- 50:21Q&A 6
- 51:44Q&A 7
related talks
47mWeb Developers, Beware of the Tarpits for SAST in Your Code
43mSecurity Testing Tools: Can I Touch You There?
53mStatic Analysis Saved My Code Tonight
52mApplication Security at DevOps Speed and portfolio scale
50mPractical Advanced Static Analysis
08mAutomated Security Testing for JS Apps
55mSquash Bugs with Static Analysis
39mPractical Static Analysis for Continuous Application Security