TP-Framework relies on testability patterns to reduce false positive/negative rate in SAST analysis over supported programming languages. Testability patterns are code patterns that make difficult for SAST tools to detect a vulnerability.
TP-Framework enables operations such as:
- measurement of SAST tools against a catalog of testability patterns, and
- discovery of testability patterns within application source code
In the future, we aim to enable patterns' transformations from the framework to improve the testability of the application to be scanned via SAST.
OWASP Project: This project has a OWASP website available at: https://owasp.org/www-project-testability-patterns-for-web-applications/.
Concepts
How to
So far, we have created a catalog of testability patterns for the following programming languages:
- Java
- PHP
- JavaScript
The complete list of patterns is available at Testability Patterns for SAST repository (also included as a submodule of this project .\testability_patterns).
After following the installation instructions, you can run the TP-Framework with docker:
$ docker-compose up --build
$ docker-compose run -d --name <CONTAINER_NAME> tp-framework
$ docker exec -it <CONTAINER_NAME> bashThen, run the following command inside the docker container to see the CLI options.
tpframework -hDetailed documentation is available in the docs folder. Also, a related publication presented at NDSS 2022 is available here.
You can contribute to this repository through bug-reports, bug-fixes, new code or new documentation. For any report, please raise an issue in the repository before submitting a PR. We welcome suggestions and feedback from the community.
To see the complete list publications, please visit https://testable.eu/publications/.
Follow us on Twitter on @Testable_EU or check out TESTABLE website available at https://testable.eu/.
This project is licensed under Apache License Version 2.0 . See LICENSE for more information.
This project received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No. 101019206.
Funded by the European Union
