Consider security rules for static/dynamic code analysis

[javabeanz]

Great project guys !

I was wondering if jqassistant is capable of making software more security by creating rules specifically for security analysis. Data flow, control flow, semantic -, structural -, configuration -, and buffer analysis are a lot easier once you have a full AST. As an example, PMD has a special rule set for security : https://github.com/GDSSecurity/GDS-PMD-Security-Rules.

[obfischer]

We consider to support such analyses. But it requires to collect much more information on the source code base then we do it now.
One of the next releases will provide support for a much more detailed scan of classes. This would be the base for such analyses.
We will take your issue as feature request to support such kind of analysis.

[javabeanz]

Thanks ! I am very interested and willing to help.