Feature Diff · Report Bug · Request Feature · FAQ · Ask Question
Table of contents
- Project Introduction
- Quick Start
- Set up a development environment
- Test Suite Performance
- Custom Rule Checker
- License
- Communication and Feedback
- Recruitment
CoraxJava (Corax Community Edition) is a static code security analysis tool for Java projects. Its core analysis engine is derived from the Corax commercial version, possessing consistent underlying code analysis capabilities with the commercial version. Additionally, it is equipped with dedicated open-source rule checkers and rules.
CoraxJava consists of two parts: CoraxJava Core Analysis Engine and CoraxJava Rule Checker. The rule checker module supports the implementation of various rule checks. Currently, CoraxJava includes program analysis technologies such as Abstract Interpretation and IFDS (Sparse analysis implemented by Feysh). In the future, we will continue to optimize engine analysis performance and improve analytical precision, introducing more powerful program analysis algorithms to continually enhance the core analysis capabilities, pushing for the constant improvement of code safety, quality, and performance.
CoraxJava has the following features:
- A fully open rule checker module, with several rule checker code examples open-sourced.
- Support for developing custom rule checkers using Kotlin/Java languages.
- Support for modifying and generating rule checkers through either configuration files or writing code.
- Analysis targets Java bytecode, but requires source code as a reference for results display.
- Analysis results are outputted in SARIF format.
Note: Currently, the CoraxJava core analysis engine is not open-sourced. You need to download the engine's jar file (corax-cli-x.x.x.jar) to use it in conjunction with the rule checker. This code repository is for the CoraxJava custom rule checker module, which contains multiple open-source implementations of rule checkers.
Read the Corax Community Edition Feature Comparison to understand the differences between the Corax Community and Commercial editions.
This repository is for the CoraxJava Rule Checker module, which also includes test cases corax-config-tests. After the project is built, the CoraxJava Rule Checker module will be in the form of a plugin (a separate zip package). It is to be used in combination with the CoraxJava Core Engine module to perform Java static code analysis. The test cases can be used for rapid testing and validation of CoraxJava's detection results.
- It should include a project with Java source code, preferably complete and not compressed.
- You need complete project build artifacts and as many third-party library JARs as possible: (If there are no pre-built artifacts, manually build using commands like
mvn package -Dmaven.test.skip.exec=true -DskipTestsorgradle build -x test. Avoid usingmvn compile/jarorgradle compile/jaras these commands often do not pull the project's dependent third-party library JARs and the build artifacts are incomplete.)- For example, the project source code corresponds to a folder containing a large number of
.classfiles (target/classes,build/classes). - Project build artifacts corresponding to
.jar/.war/.zipfiles, or any folder path containing them. - The folder containing the third-party library JARs (provide as many as possible, if not available, use the
mvn dependency:copy-dependencies -DoutputDirectory=target\libscommand to manually pull them).
- For example, the project source code corresponds to a folder containing a large number of
One-line command for analysis
When running for the first time, the script will download JDK and Corax release as needed, unpack them to the corresponding locations, and will not disrupt the original environment~
-
For Linux and macOS:
- Download coraxjw.sh (To avoid potential encoding errors, please click the download button instead of copying and pasting.)
- Copy and run the following command:
chmod +x ./coraxjw.sh ./coraxjw.sh --target java --auto-app-classes "{project root directory (including source code and compiled artifacts)}" --output corax_reports
-
For Windows:
-
Download coraxjw.ps1
-
Command Prompt (cmd):
@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -File coraxjw.ps1 --target java --auto-app-classes "{project root directory (including source code and compiled artifacts)}" --output corax_reports
-
PowerShell:
Set-ExecutionPolicy Bypass -Scope Process -Force; ./coraxjw.ps1 --target java --auto-app-classes "{project root directory (including source code and compiled artifacts)}" --output corax_reports
-
Note: The output directory specified by the --output parameter should not be set within the folder being analyzed; otherwise, the engine will refuse to perform the analysis.
Note: The downloaded script contains a fixed version of the CoraxJava analyzer and rule package. If you need to update the analysis tool later, please find the script you downloaded before, then execute "uninstall" and delete the script. Then, follow the steps above to download the latest version (Master stable branch) of the CoraxJava analyzer.
General parameter explanation: General Configuration Parameters
Detailed parameter explanation: Command Line Parameter Details
To uninstall, simply run ./coraxjw.sh uninstall
Recommendation: It is advisable to have more than 12GB of remaining memory. Otherwise, when analyzing large projects, there is a higher risk of encountering Out Of Memory (OOM) errors.