...
Further than source code, Visual Studio plugins process all configuration files (XML, XSD, XPath, .cfg, .config, .ini, XAML, json, etc.), binaries (DLL, EXE, OCX, ActiveX) and libraries (64 .NET libraries and 52 JavaScript frameworks of the most used), finding and detects weaknesses hidden inside them, and assesses potential vulnerabilities according OWASP, PCI-DSS, WASC, CVE, CVSS and CWE-/SANS international standards.
Visual Studio Code 1.39 for Windows/Mac OSx and Linux, Visual Studio 6.0, 2003, 2005, 2008, 2010, 2012, 2013 Addins and Visual Studio 2015, 2017, 2019, 2022 plugins are extensionsare available.
In the Security Reviewer View you can find the Analysis results:
...
Linking VSCode to Static Analyses results, made by Jenkins and GitLab Static Reviewer plugins.
An interactive interface for viewing scan results in the Visual Studio Code environment. This interface has several advantages over the regular Static Reviewer web interface:
You can make changes to the code as you view the vulnerabilities in the locations indicated by the scan results without a needing to switch between applications.
The extension displays full paths with their intersections, rather than just the first and last elements of each vulnerability instance.
The extension highlights the elements where fixes can be most efficiently applied.
...
Eclipse, Rational RTC, RSA and RAD Studio
Security Reviewer PostSpy plugin for Eclipse, Rational RTC, RSA and RAD Studio plugin shares the same interface and scans source code written in JAVA, JSP, JavaScript and SQL programming languages, directly from Eclipse, IBM Rapid Application Developer (RAD), IBM Rational Team Concert (RTC), and IBM Rational Software Architect (RSA). Further than source code, PostSpy the plugin processes all configuration files (XML, XSD, XPath, .cfg, .conf, .yml, json, etc.), binaries (JAR, WAR, EAR) and frameworks (115 JAVA and 52 JavaScript frameworks of the most used), finding and detects weaknesses hidden inside them, and assesses potential vulnerabilities according OWASP, PCI-DSS, WASC, CVE, CVSS and CWE-SANS international standards.
PostSpy is an Open Source project, published to github
Scanning
You can scan your source code directly inside Eclipse:
...
It will invoke Static Reviewer Desktop both locally (requires Statis Reviewer preinstalled) and remotely (required Team Reviewer and Static Server Plugin for Team Reviewer):
...
Once you analyzed your application you can have results directly in Eclipse, by using the Security Reviewer View.
...
This plugin is able to import Micro Focus OpenText Fortify FPR files, containing the Static Analysis results of Fortify Analysis, for comparing or integrating with Security Reviewer’s results.
...
Listing results of previously analyzed code and show issues in your IDE
Running a script to perform a local analysis to find issues in your local code
...