StaticAnalysisTools.md

Rust Static Analysis Tools

Tools - Work-in-Progress...

• cargo-audit

  • https://lib.rs/crates/cargo-audit
  • https://github.com/rustsec/rustsec
    • https://github.com/rustsec/rustsec/blob/main/cargo-audit/README.md
  • https://rustsec.org/

• libdiffuzz

  • https://github.com/Shnatsel/libdiffuzz

Ideas backlog - to research/review

• https://users.rust-lang.org/t/security-scanning-opportunities/94309

• https://analysis-tools.dev/tool/clippy

• https://github.com/osirislab/awesome-rust-security

• https://insights.sei.cmu.edu/blog/rust-vulnerability-analysis-and-maturity-challenges/

• https://owasp.org/www-community/Source_Code_Analysis_Tools

• https://github.com/rust-secure-code/projects

• https://analysis-tools.dev/tag/rust

• https://www.nist.gov/itl/ssd/software-quality-group/source-code-security-analyzers

• https://insights.sei.cmu.edu/blog/rust-software-security-a-current-state-assessment/

• https://internals.rust-lang.org/t/security-enhancement-scorecard-github-action/17963

• https://rustsec.org/

• https://crates.io/crates/rust-code-analysis

• https://www.sonarsource.com/products/sonarqube/

• https://community.sonarsource.com/t/rust-code-analysis-using-plugin-community-rust/60220

• https://docs.snyk.io/getting-started/supported-languages-and-frameworks/rust

• https://soos.io/products/sca

• https://news.ycombinator.com/item?id=39770908

• https://litchipi.github.io/infosec/2023/01/24/git-code-audit-viewed-as-rust-programmer.html

• https://shnatsel.medium.com/how-ive-found-vulnerability-in-a-popular-rust-crate-and-you-can-too-3db081a67fb

• https://stackoverflow.com/questions/62476559/dependabot-snyk-tool-like-for-rust-and-or-elixir-languages

• https://sourceforge.net/software/static-code-analysis/integrates-with-rust-language/

• https://www.reddit.com/r/rust/comments/ufwryc/rust_code_quality_and_vulnerability_scan_tool/

• https://github.blog/2022-06-06-github-brings-supply-chain-security-features-to-the-rust-community/

• SEI Carnegie Mellon University

  • YouTube: Understanding Vulnerabilities in the Rust Programming Language
    • "While the memory safety and security features of the Rust programming language can be effective in many situations, Rust’s compiler is very particular on what constitutes good software design practices. Whenever design assumptions disagree with real-world data and assumptions, there is the possibility of security vulnerabilities–and malicious software that can take advantage of those vulnerabilities. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), David Svoboda and Garret Wassermann, researchers with the SEI's CERT Division, explore tools for understanding vulnerabilities in Rust whether the original source code is available or not. These tools are important for understanding malicious software where source code is often unavailable, as well as commenting on possible directions in which tools and automated code analysis can improve."