crossingtud/CogniCrypt - Static Spplication Security Testing
CogniCrypt takes rules written in the specification language CrySL as input, and performs a static analysis based on the specification of the rules.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| basePath | Path to relate paths in the analyzed jar and the source tree. Class \"com.example\" is searched for at \"basePath/com/example\". | — | — |
| rulesDir | Path to rules (in CrySL source code format) | — | rules_98e04be6/JavaCryptographicArchitecture/src/ |
| appPath | Path to the JAR of the application to be analyzed | yes | — |
| cg | Selection of call graph for analysis (possible values are CHA, SPARK, SPARKLIB) | — | — |
| sootPath | Absolute path of the whole project | — | — |
| identifier | Identifier for labeling output files | — | — |
| reportPath | Directory Location for cryptoanalysis reports | — | — |
| reportFormat | The format of the report. Possible values are CMD, TXT, SARIF, CSV and CSV_SUMMARY. Multiple formats should be split with a comma (e.g. CMD,TXT,CSV). Running this action will also implicitly enable the output as GitHub Annotations. | — | — |
| visualization | Enables the visualization, but also requires reportPath option to be set | — | — |
| ignoreSections | Names of packages, classes and methods to be ignored during the analysis. This input expects path to a file containing one name per line. For example, 'de.example.testClass' ignores the class 'testClass', 'de.example.exampleClass.exampleMethod ignores the method 'exampleMethod' in 'exampleClass', and 'de.example.*' ignores all classes and methods in the package 'example'. Using this option may increase the analysis performance. Note that constructors are methods that can be specified with '<init>'. | — | — |
| sparseStrategy | Strategy to sparsify Boomerang queries. Possible values are NONE, TYPE_BASED, and ALIAS_AWARE (default NONE) | — | — |
| timeout | Timeout for seeds in milliseconds. If a seed exceeds this value, CryptoAnalysis aborts the typestate and extract parameter analysis and continues with the results computed so far. (default 10000) | — | — |
Outputs
no outputs