Last week, a new version of Find Security Bugs (FSB), a FindBugs extension was released. In this post, we will present the most recent improvements and some project announcements.


Find Security Bugs

FSB is a plugin for the FindBugs static code analysis tool. It specializes in finding security issues in code by searching for bug patterns. It can be used to scan Java Web applications, Android applications and, more recently, Scala and Groovy applications.

Since it analyzes at the bytecode level, source code is not mandatory for the analysis.

FSB can be integrated in most Java IDEs (IntelliJ, Eclipse, Android Studio, etc.) and has many continuous integration options like Jenkins or SonarQube.


New languages support

We are now encouraging Groovy and Scala developers to scan their applications and provide feedback. These languages may not be as prevalent as Java but they may be used in certain critical components of your business.

Two enhancements were done in the previous months:
– Added API signatures and bug patterns to support specific framework such as the Play framework.
– Built sample projects to showcase the configuration needed for Gradle, SBT and Maven.

In this first iteration, Scala developers will find rules that cover the most common injection patterns. It also has new capacity to highlight Cross-Site Scripting (XSS) in Play controllers and Twirl templates. Furthermore, all the existing rules targeting cryptography and general Java APIs will be effective if they are used in Scala code as well.

Results of a Scan in IntelliJ


Support for JavaServer Pages (JSP)

JSP may not be the safest templating technology available. Indeed, many modern template technologies such as Thymeleaf or client-side Angular.js handle encoding in a much safer fashion. Nevertheless, JSP is still widely used. We frequently encounter it in new code audits. Legacy applications are rarely refactored. For this reason, we needed to cover JSP.

The most likely vulnerability to be found in JSP will be XSS. It may find other types of vulnerabilities if weak buisness logic is embedded in the JSP files.

Here is a preview in SonarQube 5.6 displaying the discovery of two reflected XSS in a JSP:

JSP Coverage in Find Security Bugs (SonarQube)

OWASP Benchmark

OWASP Benchmark compares various static code analysis tools by comparing the results from various analysis samples. It covers eight vulnerability types. The benchmark focuses on evaluating the false positive rate.

In the following diagram, we can see that Find Security Bugs has an excellent coverage (96%). However, the false positive rate is slightly higher than four of the six commercial tools, which is a less good news.


Key Contributors

Aside from technological advances, the project is gaining momentum with additional contributors who joined this year. Notably, Tomáš Polešovský from Liferay did excellent contributions and fixes related to the taint analysis system. Also, Maxime Nadeau, an undergraduate student from École de Technologie Supérieure in Montréal, has built an excellent foundation for Scala support as part of his capstone project.

GoSecure is also a key supporter of the project. Some of the new contributions are made in the context of client mandates, while others come from vulnerability research. Both of which are funded by GoSecure. These improvements are directly integrated into the open source project.



If you are maintaining or auditing Java, Scala, Groovy or Android applications, you should test the latest version of FSB and potentially discover important vulnerabilities. If you are an existing user, you now have a list of reasons to keep your tool up to date.

Détection et réponse gérées Titan
Antivirus de nouvelle génération
Détection et réponse sur les terminaux
Détection et réponse sur le réseau
Détection et réponse sur les boîtes de messagerie
Détection et réponse face aux menaces internes
Gestion des pare-feu
Gestion des SIEM
La gestion des vulnérabilités en tant que service
GoSecure Titan
Logiciel Titan
Sécurité de la messagerie
Sécurité Web
Boîte à outils «Responder PRO Forensics»
Services professionnels
Services de préparation aux brèches
Les services-conseils personnalisés en cybersécurité
Évaluation de la cybersécurité
Services de réponse aux incidents
Services des équipes « Red & Purple »
Services de tests d'intrusion
Services de conformité et d'audit
Évaluation de la compromission de la sécurité
Technologies tierces

Pin It on Pinterest

Share This