SAST and Sensibility: A Rubyist’s Guide to Static...
summary
Compares concrete detections: RuboCop flags eval and YAML.load but RuboCop misses SQLi in the demo; Brakeman finds SQL and some command injection within a file and Brakeman is Rails-focused; OpenGrep (SimGrep fork) catches many taint flows but community rules skip cross-file cases; CodeQL finds cross-file taint by building a code database (slow, cacheable). Recommends a fast editor/git-hook tool plus a deep CI analyzer, and shows which vulnerabilities each tool actually finds or misses (SQLi, XSS, deserialization, command injection).
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:10Product security at GitHub
- 2:17Static analysis for Ruby
- 3:42Sense and security balance
- 5:28Ruby vulnerabilities at scale
- 6:52Mass assignment and XSS risks
- 8:37Insecure deserialization and SQLi
- 10:22Command injection in Ruby
- 11:48Static analysis vs testing
- 13:50Static analysis primitives
- 16:40SAST tools for Ruby
- 19:47Tool detection comparison
- 23:42Choosing tools based on developer experience
- 24:43SAST integration strategies
- 26:50Local testing with GitHub Actions
- 27:31Q&A
related talks
26mSecurity Automation For GraphQL
39mPractical Static Analysis for Continuous Application Security
54mSecure Programming with Ruby on Rails
49m"The SAST and the furious"
27mSquashing Security Bugs with Rubocop
54mA Shock to the System Static Analysis for Real AppSec
51mThe great SAST dissonance: how to please every... (Claudio Merloni, Romain Gaucher)
36mEffective SAST: Secure Code Analysis in the CI/CD