Software Testing Solutions
Secure coding analysis tool
Secure Coding Analysis Tool - Sparrow
Sparrow is a static analysis tool that detects security vulnerabilities in source code during the early stages of software development.
It identifies security weaknesses accurately and quickly through a wide range of advanced analysis techniques.
-
Support for Multiple Languages
Supports more than 20 programming languages, including Java, JSP, C/C++, C#, Python, Swift, ASP(.NET), ABAP, Objective-C, and more.
-
Web-Based Centralized Management
Visually presents linkage information for source code related to security weaknesses.
-
Fast and Accurate Analysis
Analyzes MVC structures, related files, and multi-level function call relationships.
During re-analysis, only added, modified, or related files are analyzed to minimize analysis time.
-
Issue Navigator
Provides an issue navigator that traces the process from the root cause of a vulnerability to its point of occurrence.
Key Features
Dashboard and Statistics
- View analysis frequency, detected issues, risk levels, project status, and more
- Provides historical and trend data for analysis results over specific periods
- Offers statistical data by project, user, and inspection category
Customized User Reports
- Editable report items such as project summary information, analyzed file details, and analysis results by risk level
- Reports available in HWP, Word, Excel, and PDF formats
Analysis Result History Management
- Automatically distinguishes newly detected results
- Automatically identifies the status of previously detected results when source code lines change
- Prevents misuse through a request/approval process for exception handling of detected results
Intelligent Application
- Provides detailed descriptions, examples, and remediation methods for detected results
- Centralized editing supported through an integrated editor
- Offers real code modification examples via Active Suggestion
- Provides impact analysis that shows relationships among affected files
Integration with Other Systems
- Integrates with source code version control systems for controlled transfers
- Supports automation by linking with build management tools (CI) and issue tracking systems (ITS)
Diagnostic Items
Security vulnerabilities in source code are analyzed based on the 47 security weaknesses defined by the Ministry of the Interior and Safety (MOIS),
OWASP TOP 10, and other standards.
- 47 Security Weaknesses by the Ministry of the Interior and Safety
- Secure Coding Guide(2012.09)
- NIS (National Intelligence Service) Vulnerability List
- Electronic Financial Supervisory Regulations
- MISRA C/C++
- BSSC C/C++ 2000
- HIC C++ and others
- CWE (CWE 658 List CWE 659 List CWE 660 List)
- OWASP
- CERT C/C++, Java
Purchase and Maintenance Procedure