JavaSinkTracer

Acerca de

JavaSinkTracer is a robust Java source code vulnerability auditing tool that leverages function-level taint analysis to identify potential security flaws. Unlike traditional variable-level analysis, its function-level approach is designed to overcome common challenges such as threading, reflection, and callbacks, providing a more comprehensive view of potential attack paths. The tool integrates seamlessly with AI assistants via the Model Context Protocol (MCP), empowering them with advanced security analysis capabilities to detect and analyze vulnerabilities efficiently.

Características Principales

• Automatic vulnerability scanning from sinks to sources
• Comprehensive Java project function call graph analysis
• Intelligent function-level taint analysis to prevent broken chains in complex scenarios
• Automated extraction of complete source code for identified vulnerability chains
• Support for custom vulnerability rules for sinks, sources, and sanitizers
• 6 GitHub stars

Casos de Uso

• Deeply analyze potential vulnerability chains by extracting and examining the relevant source code functions.
• Perform comprehensive security audits on entire Java projects for various vulnerability types.
• Conduct targeted scans to identify specific vulnerabilities like SQL Injection or Remote Code Execution.