Vulnerability Scanner for MATLAB code?

9 次查看（过去 30 天）

Wes 2020-4-6

0
链接

此问题的直接链接

https://ww2.mathworks.cn/matlabcentral/answers/515879-vulnerability-scanner-for-matlab-code

评论： Walter Roberson 2020-4-8

Products like SonarQube and Veracode exist for source code analysis of vulnerabilities. However, I haven't seemed to find one that supports MATLAB. What options are there for a code scanner that can scan MATLAB?

2 个评论
显示无隐藏无

Walter Roberson 2020-4-6

I do not know of any myself.

The areas that I can think of at the moment that should be checked:

system() and dos()
! operator
input() without 's' option
eval() or evalc() of insufficiently sanitized user input
evalin('base') or evalin('caller') as those could potentially be used to execute statements that are vulnerable
evalin(symengine) or feval(symengine) that could potentially use mupad system facilities

I have probably missed some, not even counting the file i/o possibilities

Walter Roberson 2020-4-8

Oh yes, I forgot that regexp() or regexprep() can execute arbitrary commands, so you have to sanitize any input that might make it into part of a pattern.

请先登录，再进行评论。

请先登录，再回答此问题。