一文详解Java中主流的代码审计与漏洞检测工具使用

./sonar.sh start

<build>
    <plugins>
        <plugin>
            <groupId>org.sonarsource.scanner.maven</groupId>
            <artifactId>sonar-maven-plugin</artifactId>
            <version>3.9.1.2184</version>
        </plugin>
    </plugins>
</build>

mvn clean verify sonar:sonar \
  -Dsonar.projectKey=my-project \
  -Dsonar.host.url=http://localhost:9000 \
  -Dsonar.login=my-token

<build>
    <plugins>
        <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>findbugs-maven-plugin</artifactId>
            <version>3.0.5</version>
            <configuration>
                <effort>Max</effort>
                <threshold>Low</threshold>
            </configuration>
        </plugin>
    </plugins>
</build>

mvn findbugs:check

package cn.juwatech.checkmarx;

import com.checkmarx.sdk.api.CxClient;
import com.checkmarx.sdk.api.CxClientImpl;
import com.checkmarx.sdk.dto.ScanResults;

public class CheckmarxScan {

    public static void main(String[] args) {
        CxClient cxClient = new CxClientImpl("http://checkmarx-server-url", "username", "password");
        ScanResults results = cxClient.scanProject("project-name", "source-code-path");
        results.getFindings().forEach(finding -> {
            System.out.println("漏洞类型：" + finding.getType());
            System.out.println("文件：" + finding.getFile());
            System.out.println("行号：" + finding.getLine());
            System.out.println("描述：" + finding.getDescription());
        });
    }
}

<build>
    <plugins>
        <plugin>
            <groupId>com.github.spotbugs</groupId>
            <artifactId>spotbugs-maven-plugin</artifactId>
            <version>4.5.0</version>
            <configuration>
                <effort>Max</effort>
                <threshold>Low</threshold>
            </configuration>
        </plugin>
    </plugins>
</build>

mvn spotbugs:check