用于网站安全分析的 CAT.NET 替代方案
我正在寻找 CAT.NET 用于对 .NET 代码执行静态安全扫描。目前，CAT.NET 工具/开发正处于一个脆弱的阶段，无法提供我所寻求的可靠性。
是否有其他静态代码分析器可用于检测安全问题？
I'm looking for an alternative tool to CAT.NET for performing static security scans on .NET code. Currently the CAT.NET tooling/development is at a somewhat fragile stage and doesn't offer the reliability that I'm looking for.
Are there any alternative static code analyzers that you use for detecting security issues?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
查看 FxCopy、StyleCop、CodeIt.Right、Coverity，还有来自 red-gate.com 的一个发现异常处理较弱的工具。另请查看 DevPartner Studio。谷歌搜索链接。
Check out FxCopy, StyleCop, CodeIt.Right, Coverity and there's one from red-gate.com which finds weak exception handling. Also checkout DevPartner Studio. Google for the links.
您现在应该发现 CAT.NET 的状态要好得多。它已从头开始重写，并将于今年晚些时候随 Visual Studio 2010 一起发布。
在查看其他代码审查工具之前，值得考虑一下您在过程间或过程内静态分析或黑盒 HTTP 扫描器（不对代码进行操作）方面正在寻找什么。
所有这些工具可能只能发现 25-50% 的安全问题（这是来自构建 CAT.NET 团队的负责人）。他们只能发现某些类型的问题。
You should now find that CAT.NET is in a much better state. It's been re-written from the ground up and will ship with Visual Studio 2010 later this year.
Before looking at the other code review tools its worth considering what you are looking for in terms of inter-proceedural or intra-proceedural static analyis or the black-box HTTP scanners (that dont operate on code).
All of these tools will only likeely find 25-50% of the security issues (and thats from the person who ran the team that built CAT.NET). They can only ever find certain types of issues.