Yasca
Yasca is a free tool that scans over source code in order to analyze and assert security vulnerabilities, quality, performance, and conformance to best practices. It leverages external open source programs, such as FindBugs, PMD, JLint, JavaScript Lint, PHPLint, Cppcheck, ClamAV, Pixy, and RATS to scan specific file types, and also contains many custom scanners developed for Yasca. It is a command-line tool that generates reports in HTML, CSV, XML, MySQL, SQLite, and other formats. It is listed as an inactive project at the well-known OWASP security project, and also in a government software security tools review at the U.S Department of Homeland Security web site.
01Languages Scanned
Yasca has at least one scanner for each of the following file types:
- .NET (VB.NET, C#, ASP.NET)
- ASP
- C/C++
- COBOL
- ColdFusion
- CSS
- HTML
- Java
- JavaScript
- Perl
- PHP
- Python
- Raw HTTP Traffic
- Visual Basic
02Yasca 2.2
Version 2.2 was released in June 2010 and included a large number of minor updates over version 2.1, most notably, natively compiled plugins on Linux, reducing the need to use Wine. Version 2.2 contains some experimental modules, including a TCP packet logger and a rule to scan those logs for sensitive information. Additional rules for this are expected in the next update.
As with prior 2.x releases, Yasca comes packaged as a core bundle, plus separately downloadable plugins. No plugins are required, but best results occur when using all of the necessary plugins.
Sources and credits
This article is adapted from the Wikipedia article “Yasca”, written by its contributors and licensed under CC BY-SA 4.0. Fathomly has changed the layout, removed citation markers, navigation and maintenance notices, and adjusted punctuation. This adapted version is shared under the same license. For references, see the original article.
Images, from Wikimedia Commons:
- Yascas Logo.png by Unknown author, Fair use
Fathomly is not affiliated with or endorsed by the Wikimedia Foundation. Spotted a problem? Tell us.