SAST for JavaScript: A Brief Overview of Commercial Tools

By Achim D. Brucker.

Static application security testing (SAST) is a widely used technique that helps to find security vulnerabilities in program code at an early stage in the software development life-cycle. Since a few years, JavaScript is gaining more and more popularity as an implementation language for large applications. Consequently, there is a demand for SAST tools that support JavaScript.

We report briefly on our method for evaluating SAST tools for JavaScript as well as summarize the results of our analysis.

Please cite this work as follows:
A. D. Brucker, “SAST for JavaScript: A brief overview of commercial tools,” presented at the Dagstuhl seminar 14271 “scripting languages and frameworks: Analysis and verification,” Dagstuhl, Germany, Jun. 30, 2014. Author copy: https://logicalhacking.com/publications/talk-brucker-sast-js-2014/

BibTeX
@Unpublished{ talk:brucker:sast-js:2014,
  date              = {2014-06-30},
  title             = {SAST for JavaScript: A Brief Overview of Commercial Tools},
  language          = {USenglish},
  slideshare        = {key/h8iwvMf0bcAADs},
  slideshare_width  = {595},
  slideshare_height = {485},
  venue             = {Dagstuhl, Germany},
  author            = {Achim D. Brucker},
  eventtitle        = {Dagstuhl Seminar 14271 ``Scripting Languages and Frameworks:
                       Analysis and Verification''},
  abstract          = {Static application security testing (SAST) is a widely used
                       technique that helps to find security vulnerabilities in
                       program code at an early stage in the software development
                       life-cycle. Since a few years, JavaScript is gaining more and
                       more popularity as an implementation language for large
                       applications. Consequently, there is a demand for SAST tools
                       that support JavaScript.
                       
                       We report briefly on our method for evaluating SAST tools for
                       JavaScript as well as summarize the results of our analysis.},
  areas             = {software},
  note              = {Author copy: \url{https://logicalhacking.com/publications/talk-brucker-sast-js-2014/}},
  pdf               = {https://logicalhacking.com/publications/talk-brucker-sast-js-2014/talk-brucker-sast-js-2014.pdf},
}