Can anyone recommend a good static analysis tool for Lucee? Preferably something open source if possible. I looked through the history here and I see CFLint mentioned a lot - we're using that currently, but also looking for something that goes a bit deeper. We're also looking to get some pen testing done, would love to hear about anyone you guys can recommend for that.

This seems like a job for @foundeo perhaps? (or maybe he can help guide)

yeah, checkout Fixinator it goes deeper into security than cflint: https://fixinator.app/

Thanks, will check that out

@James Vince CodeChecker is also a CLI you can run against your code. it's pretty simple-- just a bunch of regex based rules to check for certain syntax or use of potentially dangerous functions/tags

Re pentesting, our people just picked a vendor for test about to happen, one we haven't used before, which they're impressed with so far. It's Tec Refresh. They haven't actually done the thing yet, that's next week. Not sure when we'll get results back, and I'm nnot on a pro account here, so this thread may scroll away, but if it doesn't, and you remind me,I can say how it actually went.

@Dave Merrill Do you know if it's an actual human poking your site for holes or if they just point an off-the-shelf scanner at your site and send you a PDF export of what it finds?

Yes, humans, that's one of their big pluses. They've also been very responsive and reasonable, according to the folks dealing with them. (Who is not me.)

Sweet

Thanks guys, I'll look into those as well. I appreciate all of the suggestions!

We had to get rid of our pen testers as they kept finding things which was really annoying! 😛

LOL Alias that reminds me of the pm at a place I used to work at who would specifically make it so I was not one of the people doing QA on their work because my superpower was breaking things.

I'm having flashbacks guys, knock it off!

Anyone know of any tools that integrate into pipelines such as a sonarqube plugin? I used an old plugin a few years back

Testbox's code coverage will generate a sonarqube file, but In not aware of any cf pentesting integrations for it. @bclingan