hub / github.com/KimJun1010/inspector

github.com/KimJun1010/inspector @0.0.2

Chat with this repo

repository ↗ · DeepWiki ↗ · release 0.0.2 ↗ · + Follow

348 symbols 1,018 edges 83 files 92 documented · 26%

What it actually does AI analysis from the code graph — generated when you open this

loading…

README

SecInspector

介绍

SecInspector为IDEA静态代码扫描插件，侧重于在编码过程中发现项目潜在的安全风险（一键搜索所有的sink点，替代传统control+F大法），部分漏洞并提供一键修复能力，提升安全攻防人员代码审计效率、开发人员代码安全质量
插件利用IDEA原生Inspection机制检查项目，自动检查当前活跃窗口的活跃文件，检查速度快，占用资源少，官方介绍：https://www.jetbrains.com/help/idea/inspections-settings.html#5
插件提供的规则名称均以"SecInspector"开头，由深信服深蓝实验室天威战队强力驱动

版本支持

Intellij IDEA ( Community / Ultimate ) >= 2021.3

安装使用

IDEA "Settings" --> "Plugins"，获取SecInspector.jar后，选中从本地磁盘安装该插件

使用：方法一

该插件会在您编码过程中自动扫描当前编辑的代码，并实时提醒安全风险

使用：方法二

IDEA 提供Inspect Code功能支持对整个项目/指定范围文件进行自定义规则的扫描

可以漏洞扫描需求，选中SecInspector规则

插件规则覆盖常见的RCE、反序列化、SQL注入、JNDI注入、任意文件读取/写入等类型的sink点

项目实战

以项目审计为例，反编译jar包后，把源码标记为Source Root，扫描业务代码，跟踪该方法即可分析出rce的漏洞

项目参考

https://github.com/momosecurity/momo-code-sec-inspector-java

Core symbols most depended-on inside this repo

hasFullQualifiedName

called by 378

src/main/java/com/itkim/inspector/utils/SecExpressionUtils.java

registerProblem

called by 102

src/main/java/com/itkim/inspector/rule/other/WeakHashInspector.java

message

called by 87

src/main/java/com/itkim/inspector/utils/InspectionBundle.java

getText

called by 14

src/main/java/com/itkim/inspector/utils/SecExpressionUtils.java

getLiteralInnerText

called by 13

src/main/java/com/itkim/inspector/utils/SecExpressionUtils.java

commonExpressionCheck

called by 10

src/main/java/com/itkim/inspector/rule/xxe/XXEInspector.java

isText

called by 7

src/main/java/com/itkim/inspector/utils/SecExpressionUtils.java

rtrim

called by 6

src/main/java/com/itkim/inspector/utils/Str.java

Shape

Method 251

Class 95

Enum 2

Languages

Java100%

Modules by API surface

src/main/java/com/itkim/inspector/utils/SecExpressionUtils.java20 symbols

src/main/java/com/itkim/inspector/rule/xxe/XXEInspector.java18 symbols

src/main/java/com/itkim/inspector/rule/rce/JacksonDatabindDefaultTyping.java10 symbols

src/main/java/com/itkim/inspector/rule/sqli/MybatisXmlSQLi.java9 symbols

src/main/java/com/itkim/inspector/rule/sqli/MybatisAnnotationSQLi.java9 symbols

src/main/java/com/itkim/inspector/rule/other/PredictableSeed.java8 symbols

src/main/java/com/itkim/inspector/rule/other/HardcodedCredentials.java8 symbols

src/main/java/com/itkim/inspector/rule/other/ReplacePseudorandomGenerator.java7 symbols

src/main/java/com/itkim/inspector/rule/dos/NettyResponseSplitting.java7 symbols

src/main/java/com/itkim/inspector/rule/other/WeakHashInspector.java6 symbols

src/main/java/com/itkim/inspector/rule/other/SpringSessionFixProtection.java6 symbols

src/main/java/com/itkim/inspector/rule/other/SpringSecurityDebugEnabled.java6 symbols

For agents

$ claude mcp add inspector \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact