4 ms·
This is a potentially great idea. You could make your build process include submitting your code to a search engine like this (perhaps in some obfuscated manner
by sage_joch 13y ago
This is a potentially great idea. You could make your build process include submitting your code to a search engine like this (perhaps in some obfuscated manner) and making illegal patterns fail if not manually "approved". Just because the halting problem exists doesn't mean there's not a low hanging fruit in approaching it.
- egsec 13y agoNot sure if this search would be good, but your responses triggers the id of a distributed code review like reCAPTHA. Possibly a pattern search brings up suspicious code and then there is distributed review and once enough people flag it as SQL injection, it could be flagged on Github and someone could submit a patch, etc. Clearly not bulletproof, but this would provide a way of doing code review on projects you might have no other interest in helping.
- jesstaa 13y agoYep, It's called 'static analysis'. http://en.wikipedia.org/wiki/Static_program_analysis http://en.wikipedia.org/wiki/Static_program_analysis
- deleted 13y ago[deleted]
- sage_joch 13y agoHeh. I sure romanticized a semi-mundane thing that already exists. ;-)
- peterkelly 13y agoDon't worry. That's basically what every tech company does these days anyway.
- twistedpair 13y agoTons of code review tools already exist out there, runnable on your CI machine. Sonar and Fortify are a few off the top of my head, but there are many, many more. Nothing new here. Google code search a while back was similar. Also search for index.php~, a great way to see the source for an index page with a unix temp file that Apache will forward as plain text. Oops.