thesp0nge/owasp-orizon

Owasp Orizon is a source code static analyzer tool designed to spot security issues in Java applications.

The Owasp Orizon project

Owasp Orizon is a source code static analyzer tool designed to spot security issues in Java applications.

The history

It was a dark and stormy night in Milan, Italy. It was 2006 and I felt the need of something helping me in reviewing other people java source code. So Owasp Orizon born and grew up as security tool trying to parse Java source code, building an Abstract Syntax Tree and spot for unsafe calls in the code.

In the very beginning Owasp Orizon was a sort of enhanced grep tool. In 2008, I started supporting PHP programming language but the initial boost disappeared. After being in love with other programming languages and technolgies, eight years later, in 2016 I kickstarted the project again from scratch.

The typo

The mission

Source code contains bugs and vulnerabilities. Owasp Orizon will help either application security specialists or developersto spot vulnerabilities in their code and to create security patches.

Owasp Orizon mission is to provide people an opensource tool, helping them in reviewing:

• single Java classes
• java standalone tools packed in JAR files
• web applications packed in EAR / WAR files
• Android APK applications

An overall introduction

When you launch Owasp Orizon it will start unpkacing the target file if not a standalone .class file.

First security analysis stage is about vulnerabilities from third party libraries. Owasp Orizon will try to understand target package dependencies and than look for known security issues.

As knowledge base for third party library vulnerabilities, Owasp Orizon will support:

• vFeed.io database. Please note that we don't redistribute the database. You must go on vFeed website and purchase the license that best fits your tool usage
• CVE archive from NVD

After this stage, Owasp Orizon will perform a walkthrough on Owasp TOP 10 security risks, using Apache BCEL library to disassemble java bytecode.

Usage

More a reminder than a real doc here

java -Dlog4j.configurationFile=./log4j2.xml -jar target/owasp-orizon-1.0-SNAPSHOT.jar

The overall design

To be written

owasp-orizon's Issues

setup Continous Integration pipeline with Travis

Please use https://travis-ci.org/ to build Orizon on every commit, maybe add other services to keep high code quality and design. Willing to help with this.

You may add a bit text stating that this project is no more active

java.lang.OutOfMemoryError

Exception in thread "main" java.lang.OutOfMemoryError: GC overhead limit exceeded
at java.util.Arrays.copyOf(Arrays.java:3181)
at java.util.ArrayList.grow(ArrayList.java:261)
at java.util.ArrayList.ensureExplicitCapacity(ArrayList.java:235)
at java.util.ArrayList.ensureCapacityInternal(ArrayList.java:227)
at java.util.ArrayList.addAll(ArrayList.java:579)
at org.owasp.orizon.mirage.java.parser.Nodes.getAllTokens(Nodes.java:164)
at org.owasp.orizon.mirage.java.parser.Nodes.getAllTokens(Nodes.java:164)
at org.owasp.orizon.mirage.java.parser.Nodes.getAllTokens(Nodes.java:164)
at org.owasp.orizon.mirage.java.parser.Nodes.getAllTokens(Nodes.java:164)
at org.owasp.orizon.mirage.java.parser.Nodes.getAllTokens(Nodes.java:164)
at org.owasp.orizon.mirage.java.parser.Nodes.getAllTokens(Nodes.java:164)
at org.owasp.orizon.mirage.java.parser.Nodes.getAllTokens(Nodes.java:164)
at org.owasp.orizon.mirage.java.parser.Nodes.getAllTokens(Nodes.java:164)
at org.owasp.orizon.mirage.java.parser.Nodes.getAllTokens(Nodes.java:164)
at org.owasp.orizon.mirage.java.JavaCollector.inspect(JavaCollector.java:428)
at org.owasp.orizon.mirage.Modeler.inspect(Modeler.java:162)
at org.owasp.orizon.mirage.Mirage.start(Mirage.java:288)
at org.owasp.orizon.mirage.Mirage.process(Mirage.java:191)
at org.owasp.orizon.mirage.Mirage.exec(Mirage.java:161)
at org.owasp.orizon.Session.model(Session.java:158)
at org.owasp.orizon.SkyLine.launch(SkyLine.java:409)
at org.owasp.orizon.tools.osh.Osh.process(Osh.java:430)
at org.owasp.orizon.tools.osh.Osh.exec(Osh.java:262)
at org.owasp.orizon.tools.osh.Osh.shell(Osh.java:229)
at org.owasp.orizon.tools.osh.Osh.main(Osh.java:135)

checker framework

please consider the java checker framework that supports @tainted and @Untainted annotations and checks https://checkerframework.org/tutorial/webpages/security-error-eclipse.html