Search code examples
securitystatic-analysisstatic-code-analysis

SAST of Raw code is better or compile code


From secure code review(SAST) point of view which code I need to scan through automated tool? Raw code or Compile code?


Solution

  • I'd say it depends on what you want to find. Analysing compile code has a chance of finding generated code pieces and analysing them too. It might be also a bit easier, because the compiled code must be syntactically correct. To perform data flow analysis the tool would actually need to compile the code itself first. My favourite free code scanning tools (Find Security Bugs and OWASP Dependency Check) work on the binaries.

    On the other hand you can work with grep and regex on the source code. You can see all the FIXME and TODO comments and variables that might be optimized out of the binaries. One of my colleagues wrote a tool for finding security bugs based on a set of regular expressions and he is very proud of what he did. Source code analysis will also not be influenced by obfuscation of the binaries.