SAST Tools

codesectools.sasts.core

Initializes the core SAST module.

Modules:

Name	Description
`cli`	Provides a factory for building command-line interfaces for SAST tools.
`graphics`	Provides classes for generating plots and visualizations from analysis results.
`parser`	Defines the core abstract classes for parsing SAST tool results.
`sast`	Defines the core abstract class and logic for SAST tool integrations.

cli

Provides a factory for building command-line interfaces for SAST tools.

This module contains the CLIFactory class, which simplifies the creation of standardized typer CLI commands (analyze, benchmark, list, plot) for any SAST integration.

CLIFactory

CLIFactory(sast: SAST, custom_messages: dict)

Provide a factory to generate a standard set of CLI commands for a SAST tool.

Attributes:

Name	Type	Description
`cli`	`typer.Typer`	The `typer` application to which commands will be added.
`sast`	`SAST`	The SAST tool instance for which the CLI is being built.
`help_messages`	`dict`	A dictionary of help messages for the standard commands.

Initialize the CLIFactory.

Parameters:

Name	Type	Description	Default
`sast`	`SAST`	An instance of the SAST tool's implementation class.	required
`custom_messages`	`dict`	A dictionary of custom help messages to override the defaults.	required

Methods:

Name	Description
`build_cli`	Build and return the Typer CLI application for the SAST tool.
`add_main`	Add the main callback command to the CLI.
`add_install`	Add the 'install' command to the CLI.
`add_analyze`	Add the 'analyze' command to the CLI.
`add_benchmark`	Add the 'benchmark' command to the CLI.
`add_list`	Add the 'list' command to the CLI.
`add_plot`	Add the 'plot' command to the CLI.

sast `instance-attribute`

sast = sast

help_messages `instance-attribute`

help_messages = {
    "main": f"{sast.name}",
    "install": "List instruction to install missing requirements.",
    "analyze": f"Analyze a project using {sast.name}.",
    "benchmark": f"Benchmark a dataset using {sast.name}.",
    "list": "List existing analysis results.",
    "plot": "Generate plot for results visualization.",
}

build_cli

build_cli() -> typer.Typer

Build and return the Typer CLI application for the SAST tool.

add_main

add_main(help: str = '') -> None

Add the main callback command to the CLI.

This function sets up the main callback that runs when the SAST-specific command is invoked without a subcommand.

Parameters:

Name	Type	Description	Default
`help`	`str`	The help string for the main command.	`''`

add_install

add_install(help: str = '') -> None

Add the 'install' command to the CLI.

This command opens the tool's installation guide URL in a web browser.

Parameters:

Name	Type	Description	Default
`help`	`str`	The help string for the command.	`''`

add_analyze

add_analyze(help: str = '') -> None

Add the 'analyze' command to the CLI.

This command runs the SAST tool on the current directory.

Parameters:

Name	Type	Description	Default
`help`	`str`	The help string for the command.	`''`

add_benchmark

add_benchmark(help: str = '') -> None

Add the 'benchmark' command to the CLI.

This command runs the SAST tool against a specified dataset.

Parameters:

Name	Type	Description	Default
`help`	`str`	The help string for the command.	`''`

add_list

add_list(help: str = '') -> None

Add the 'list' command to the CLI.

This command lists all available analysis results for the SAST tool.

Parameters:

Name	Type	Description	Default
`help`	`str`	The help string for the command.	`''`

add_plot

add_plot(help: str = '') -> None

Add the 'plot' command to the CLI.

This command generates visualizations from analysis or benchmark results.

Parameters:

Name	Type	Description	Default
`help`	`str`	The help string for the command.	`''`

graphics

Provides classes for generating plots and visualizations from analysis results.

This module contains base and specific graphics classes that use Matplotlib to create visual representations of SAST analysis data, such as defect distributions and benchmark performance.

Graphics

Graphics(sast: SAST, project_name: str)

Base class for generating graphics from SAST results.

Attributes:

Name	Type	Description
`sast`	`SAST`	The SAST tool instance.
`output_dir`	`Path`	The directory containing the analysis results.
`color_mapping`	`dict`	A mapping of categories to colors for plotting.
`plot_functions`	`list`	A list of methods that generate plots.
`limit`	`int`	The maximum number of items to show in top-N plots.
`has_latex`	`bool`	True if a LaTeX installation is found.

Initialize the Graphics object.

Parameters:

Name	Type	Description	Default
`sast`	`SAST`	The SAST tool instance.	required
`project_name`	`str`	The name of the project or dataset being visualized.	required

Methods:

Name	Description
`export`	Generate, save, and optionally display all registered plots.

sast `instance-attribute`

sast = sast

output_dir `instance-attribute`

output_dir = sast.output_dir / project_name

color_mapping `instance-attribute`

color_mapping = sast.color_mapping

plot_functions `instance-attribute`

plot_functions = []

limit `instance-attribute`

limit = 10

has_latex `instance-attribute`

has_latex = shutil.which('pdflatex')

export

export(overwrite: bool, pgf: bool, show: bool) -> None

Generate, save, and optionally display all registered plots.

Parameters:

Name	Type	Description	Default
`overwrite`	`bool`	If True, overwrite existing figure files.	required
`pgf`	`bool`	If True and LaTeX is available, export figures in PGF format.	required
`show`	`bool`	If True, open the generated figures using the default viewer.	required

ProjectGraphics

ProjectGraphics(sast: SAST, project_name: str)

Bases: Graphics

Generate graphics for a single project analysis result.

Attributes:

Name	Type	Description
`result`	`AnalysisResult`	The loaded analysis result data.

Initialize the ProjectGraphics object.

Parameters:

Name	Type	Description	Default
`sast`	`SAST`	The SAST tool instance.	required
`project_name`	`str`	The name of the project.	required

Methods:

Name	Description
`checker_to_category`	Map a checker name to its category.
`plot_overview`	Generate an overview plot with stats by files, checkers, and categories.

result `instance-attribute`

result = sast.parser.load_from_output_dir(self.output_dir)

checker_to_category

checker_to_category(checker: str) -> str

Map a checker name to its category.

Parameters:

Name	Type	Description	Default
`checker`	`str`	The name of the checker.	required

Returns:

Type	Description
`str`	The category string for the checker, or "NONE" if not found.

plot_overview

plot_overview() -> Figure

Generate an overview plot with stats by files, checkers, and categories.

Returns:

Type	Description
`Figure`	A Matplotlib Figure object containing the plots.

FileDatasetGraphics

FileDatasetGraphics(sast: SAST, dataset: FileDataset)

Bases: ProjectGraphics

Generate graphics for a file-based dataset benchmark result.

Attributes:

Name	Type	Description
`dataset`	`FileDataset`	The dataset instance used for the benchmark.
`benchmark_data`	`FileDatasetData`	The validated benchmark data.

Initialize the FileDatasetGraphics object.

Parameters:

Name	Type	Description	Default
`sast`	`SAST`	The SAST tool instance.	required
`dataset`	`FileDataset`	The file-based dataset that was benchmarked.	required

Methods:

Name	Description
`plot_top_cwes`	Generate a plot showing the top predicted CWEs.

dataset `instance-attribute`

dataset = dataset

benchmark_data `instance-attribute`

benchmark_data = self.dataset.validate(self.result)

plot_top_cwes

plot_top_cwes() -> Figure

Generate a plot showing the top predicted CWEs.

Returns:

Type	Description
`Figure`	A Matplotlib Figure object containing the plot.

GitRepoDatasetGraphics

GitRepoDatasetGraphics(sast: SAST, dataset: GitRepoDataset)

Bases: Graphics

Generate graphics for a Git repository-based dataset benchmark result.

Attributes:

Name	Type	Description
`dataset`	`GitRepoDataset`	The dataset instance used for the benchmark.
`results`	`list[AnalysisResult]`	A list of loaded analysis results.
`benchmark_data`	`GitRepoDatasetData`	The validated benchmark data.

Initialize the GitRepoDatasetGraphics object.

Parameters:

Name	Type	Description	Default
`sast`	`SAST`	The SAST tool instance.	required
`dataset`	`GitRepoDataset`	The Git repository-based dataset that was benchmarked.	required

Methods:

Name	Description
`checker_to_category`	Map a checker name to its category.
`plot_overview`	Generate an overview plot classifying defects.
`plot_top_cwes`	Generate a plot showing the top predicted CWEs.
`plot_defects_per_loc`	Generate a scatter plot of defects found versus lines of code.
`plot_time_per_loc`	Generate a scatter plot of analysis time versus lines of code.

dataset `instance-attribute`

dataset = dataset

results `instance-attribute`

results = sast.parser.load_from_output_dirs(repo_paths)

benchmark_data `instance-attribute`

benchmark_data = self.dataset.validate(self.results)

checker_to_category

checker_to_category(checker: str) -> str

Map a checker name to its category.

Parameters:

Name	Type	Description	Default
`checker`	`str`	The name of the checker.	required

Returns:

Type	Description
`str`	The category string for the checker, or "NONE" if not found.

plot_overview

plot_overview() -> Figure

Generate an overview plot classifying defects.

Returns:

Type	Description
`Figure`	A Matplotlib Figure object containing the plot.

plot_top_cwes

plot_top_cwes() -> Figure

Generate a plot showing the top predicted CWEs.

Returns:

Type	Description
`Figure`	A Matplotlib Figure object containing the plot.

plot_defects_per_loc

plot_defects_per_loc() -> Figure

Generate a scatter plot of defects found versus lines of code.

Returns:

Type	Description
`Figure`	A Matplotlib Figure object containing the plot.

plot_time_per_loc

plot_time_per_loc() -> Figure

Generate a scatter plot of analysis time versus lines of code.

Returns:

Type	Description
`Figure`	A Matplotlib Figure object containing the plot.

parser

Defines the core abstract classes for parsing SAST tool results.

This module provides the Defect and AnalysisResult classes, which serve as standardized data structures for holding information about vulnerabilities and the overall analysis process. Each SAST integration must implement a concrete subclass of AnalysisResult to parse its specific output format.

Defect

Defect(
    file: Path,
    checker: str,
    category: str,
    cwe: CWE,
    message: str,
    location: tuple[int] | None,
    data: tuple[Any],
)

Represent a single defect or finding reported by a SAST tool.

Attributes:

Name	Type	Description
`sast`	`str`	The name of the SAST tool that reported the defect.
`file`	`Path`	The path to the file where the defect was found.
`file_path`	`str`	The string representation of the file path.
`checker`	`str`	The name of the checker or rule that reported the defect.
`category`	`str`	The category of the checker (e.g., security, performance).
`cwe`	`CWE`	The CWE associated with the defect.
`message`	`str`	The description of the defect.
`location`	`tuple[int, int] \| None`	A tuple with the start and end line numbers of the defect.
`data`	`tuple[Any]`	Raw data from the SAST tool for this defect.

Initialize a Defect instance.

Parameters:

Name	Type	Description	Default
`file`	`Path`	The file path of the defect.	required
`checker`	`str`	The name of the rule/checker.	required
`category`	`str`	The category of the checker.	required
`cwe`	`CWE`	The CWE associated with the defect.	required
`message`	`str`	The description of the defect.	required
`location`	`tuple[int] \| None`	A tuple with start and end line numbers of the defect, or None.	required
`data`	`tuple[Any]`	Raw data from the SAST tool for this defect.	required

Methods:

Name	Description
`__repr__`	Return a developer-friendly string representation of the Defect.

sast `instance-attribute`

sast: str

file `instance-attribute`

file = file

file_path `instance-attribute`

file_path = str(file)

checker `instance-attribute`

checker = checker

category `instance-attribute`

category = category

cwe `instance-attribute`

cwe = cwe

message `instance-attribute`

message = message

location `instance-attribute`

location = location

data `instance-attribute`

data = data

repr

__repr__() -> str

Return a developer-friendly string representation of the Defect.

Returns:

Type	Description
`str`	A string showing the class name and key attributes of the defect.

AnalysisResult

AnalysisResult(
    name: str,
    source_path: Path,
    lang: str,
    files: list[str],
    defects: list[Defect],
    time: float,
    loc: int,
    data: tuple[Any],
)

Bases: ABC

Abstract base class for holding the parsed results of a SAST analysis.

Attributes:

Name	Type	Description
`name`	`str`	The name of the analyzed project or dataset.
`source_path`	`Path`	The path to the analyzed source code.
`lang`	`str`	The primary programming language analyzed.
`files`	`list[str]`	A list of files that were analyzed.
`defects`	`list[Defect]`	A list of `Defect` objects found.
`time`	`float`	The duration of the analysis in seconds.
`loc`	`int`	The number of lines of code analyzed.
`data`	`tuple[Any]`	Raw data from the SAST tool's output.

Initialize an AnalysisResult instance.

Parameters:

Name	Type	Description	Default
`name`	`str`	The name of the analyzed project/dataset.	required
`source_path`	`Path`	The path to the analyzed source code.	required
`lang`	`str`	The programming language of the code.	required
`files`	`list[str]`	A list of analyzed files.	required
`defects`	`list[Defect]`	A list of `Defect` objects.	required
`time`	`float`	The analysis duration in seconds.	required
`loc`	`int`	The lines of code analyzed.	required
`data`	`tuple[Any]`	Raw data from the SAST tool's output.	required

Methods:

Name	Description
`__repr__`	Return a developer-friendly string representation of the AnalysisResult.
`load_from_output_dir`	Load and parse analysis results from a specified directory.
`load_from_output_dirs`	Load and parse analysis results from multiple directories.
`checker_to_category`	Get the category for a given checker name.
`stats_by_checkers`	Calculate statistics on defects, grouped by checker.
`stats_by_categories`	Calculate statistics on defects, grouped by category.
`stats_by_files`	Calculate statistics on defects, grouped by file.
`stats_by_cwes`	Calculate statistics on defects, grouped by CWE ID.

name `instance-attribute`

name = name

source_path `instance-attribute`

source_path = source_path

lang `instance-attribute`

lang = lang

files `instance-attribute`

files = files

defects `instance-attribute`

defects = defects

time `instance-attribute`

time = time

loc `instance-attribute`

loc = loc

data `instance-attribute`

data = data

repr

__repr__() -> str

Return a developer-friendly string representation of the AnalysisResult.

Returns:

Type	Description
`str`	A string showing key metrics of the analysis.

load_from_output_dir `abstractmethod` `classmethod`

load_from_output_dir(output_dir: Path) -> Self

Load and parse analysis results from a specified directory.

This method must be implemented by subclasses to handle the specific output files of a SAST tool.

Parameters:

Name	Type	Description	Default
`output_dir`	`Path`	The directory containing the raw analysis output files.	required

Returns:

Type	Description
`Self`	An instance of the `AnalysisResult` subclass.

load_from_output_dirs `classmethod`

load_from_output_dirs(output_dirs: list[str]) -> list[Self]

Load and parse analysis results from multiple directories.

Parameters:

Name	Type	Description	Default
`output_dirs`	`list[str]`	An iterable of directory paths containing results.	required

Returns:

Type	Description
`list[Self]`	A list of `AnalysisResult` subclass instances.

checker_to_category

checker_to_category(checker: str) -> str

Get the category for a given checker name.

Parameters:

Name	Type	Description	Default
`checker`	`str`	The name of the checker.	required

Returns:

Type	Description
`str`	The category string, or "NONE" if not found.

stats_by_checkers

stats_by_checkers() -> dict

Calculate statistics on defects, grouped by checker.

Returns:

Type	Description
`dict`	A dictionary where keys are checker names and values are dicts
`dict`	containing defect counts and affected files.

stats_by_categories

stats_by_categories() -> dict

Calculate statistics on defects, grouped by category.

Returns:

Type	Description
`dict`	A dictionary where keys are category names and values are dicts
`dict`	containing counts and checker lists.

stats_by_files

stats_by_files() -> dict

Calculate statistics on defects, grouped by file.

Returns:

Type	Description
`dict`	A dictionary where keys are filenames and values are dicts
`dict`	containing defect counts and the checkers that fired.

stats_by_cwes

stats_by_cwes() -> dict

Calculate statistics on defects, grouped by CWE ID.

Returns:

Type	Description
`dict`	A dictionary where keys are CWE IDs and values are dicts
`dict`	containing defect counts and affected files.

sast

Defines the core abstract class and logic for SAST tool integrations.

This module provides the SAST abstract base class, which outlines the common interface for running a static analysis tool, saving its results, and performing benchmarks against datasets.

Modules:

Name	Description
`properties`	Define properties for SAST tool integrations.
`requirements`	Define requirements for SAST tools and their fulfillment status.

SAST

SAST()

Bases: ABC

Abstract base class for a SAST tool integration.

Subclasses of this abstract class must define various class attributes to configure the integration with a specific SAST tool.

Attributes:

Name	Type	Description
`name`	`str`	The name of the SAST tool.
`supported_languages`	`list[str]`	A list of supported programming languages.
`supported_dataset_names`	`list[str]`	Names of compatible datasets.
`supported_datasets`	`list[Dataset]`	A list of supported dataset classes.
`properties`	`SASTProperties`	The properties of the SAST tool.
`requirements`	`SASTRequirements`	The requirements for the SAST tool.
`commands`	`list[list[str]]`	Command-line templates to be executed.
`environ`	`dict[str, str]`	Environment variables to set for commands.
`output_files`	`list[tuple[Path, bool]]`	Expected output files and whether they are required.
`parser`	`type[AnalysisResult]`	The parser class for the tool's results.
`color_mapping`	`dict`	A mapping of result categories to colors for plotting.
`install_help`	`str \| None`	An optional string with installation help.
`output_dir`	`Path`	(Instance attribute) The base directory for storing analysis results.
`status`	`str`	(Instance attribute) The operational status ('full', 'partial', or 'none') determined by fulfilled requirements.
`missing`	`list`	(Instance attribute) A list of unfulfilled requirements for the tool.

Initialize the SAST instance.

Set up the list of supported dataset objects based on the supported_dataset_names class attribute and define the tool-specific output directory.

Methods:

Name	Description
`render_command`	Render a command template by replacing placeholders with values.
`run_analysis`	Run the SAST analysis on a given project directory.
`save_results`	Save the results of a SAST analysis.
`analyze_files`	Analyze a dataset composed of individual files.
`analyze_repos`	Analyze a dataset composed of Git repositories.
`list_results`	List the names of available analysis results.

name `instance-attribute`

name: str

supported_languages `instance-attribute`

supported_languages: list[str]

supported_dataset_names `instance-attribute`

supported_dataset_names: list[str]

properties `instance-attribute`

properties: SASTProperties

requirements `instance-attribute`

requirements: SASTRequirements

commands `instance-attribute`

commands: list[list[str]]

environ `class-attribute` `instance-attribute`

environ: dict[str, str] = {}

output_files `instance-attribute`

output_files: list[tuple[Path, bool]]

parser `instance-attribute`

parser: AnalysisResult

color_mapping `instance-attribute`

color_mapping: dict

install_help `class-attribute` `instance-attribute`

install_help: str | None = None

supported_datasets `instance-attribute`

supported_datasets: list[Dataset] = [
    (DATASETS_ALL[d])
    for d in (self.supported_dataset_names)
]

output_dir `instance-attribute`

output_dir = USER_OUTPUT_DIR / self.name

status `instance-attribute`

status = self.requirements.get_status()

missing `instance-attribute`

missing = self.requirements.get_missing()

supported_dataset_full_names `property`

supported_dataset_full_names: list[str]

List all language-specific datasets supported by this SAST tool.

Returns:

Type	Description
`list[str]`	A list of dataset name strings (e.g., "MyDataset_java").

render_command

render_command(
    command: list[str], map: dict[str, str]
) -> list[str]

Render a command template by replacing placeholders with values.

Parameters:

Name	Type	Description	Default
`command`	`list[str]`	The command template as a list of strings.	required
`map`	`dict[str, str]`	A dictionary of placeholders to their replacement values.	required

Returns:

Type	Description
`list[str]`	The rendered command as a list of strings.

run_analysis

run_analysis(
    lang: str,
    project_dir: Path,
    output_dir: Path,
    **kwargs: Any,
) -> None

Run the SAST analysis on a given project directory.

Execute the tool's commands, time the analysis, calculate LoC, and save the results.

Parameters:

Name	Type	Description	Default
`lang`	`str`	The programming language of the project.	required
`project_dir`	`Path`	The path to the project's source code.	required
`output_dir`	`Path`	The path to save the analysis results.	required
`**kwargs`	`Any`	Additional tool-specific arguments.	`{}`

save_results

save_results(
    project_dir: Path, output_dir: Path, extra: dict
) -> None

Save the results of a SAST analysis.

Copy the tool's output files and save any extra metadata to the result directory.

Parameters:

Name	Type	Description	Default
`project_dir`	`Path`	The directory where the analysis was run.	required
`output_dir`	`Path`	The directory where results should be saved.	required
`extra`	`dict`	A dictionary of extra metadata to save as JSON.	required

analyze_files

analyze_files(
    dataset: FileDataset,
    overwrite: bool = False,
    testing: bool = False,
) -> None

Analyze a dataset composed of individual files.

Set up a temporary directory, save the dataset files, run the analysis, and clean up.

Parameters:

Name	Type	Description	Default
`dataset`	`FileDataset`	The `FileDataset` instance to analyze.	required
`overwrite`	`bool`	If True, overwrite existing results for this dataset.	`False`
`testing`	`bool`	If True, run analysis on a sample of two random files for testing purposes.	`False`

analyze_repos

analyze_repos(
    dataset: GitRepoDataset,
    overwrite: bool = False,
    testing: bool = False,
) -> None

Analyze a dataset composed of Git repositories.

Iterate through each repository in the dataset, clone it, check out the specified commit, run the analysis, and save the results.

Parameters:

Name	Type	Description	Default
`dataset`	`GitRepoDataset`	The `GitRepoDataset` instance to analyze.	required
`overwrite`	`bool`	If True, re-analyze repositories with existing results.	`False`
`testing`	`bool`	If True, run analysis on a sample of two small random repositories for testing purposes.	`False`

list_results

list_results(
    project: bool = False,
    dataset: bool = False,
    limit: int | None = None,
) -> list[str]

List the names of available analysis results.

Parameters:

Name	Type	Description	Default
`project`	`bool`	If True, include results from local project analyses.	`False`
`dataset`	`bool`	If True, include results from dataset benchmarks.	`False`
`limit`	`int \| None`	An optional limit on the number of results to return.	`None`

Returns:

Type	Description
`list[str]`	A sorted list of result directory names.

BuildlessSAST

BuildlessSAST()

Bases: SAST

Represent a SAST tool that analyzes source code directly without a build step.

PrebuiltSAST

PrebuiltSAST()

Bases: SAST

Represent a SAST tool that requires a pre-built project.

Methods:

Name	Description
`analyze_files`	Analyze a pre-built file-based dataset.

analyze_files

analyze_files(
    dataset: PrebuiltFileDataset,
    overwrite: bool = False,
    testing: bool = False,
) -> None

Analyze a pre-built file-based dataset.

Check if the dataset has been built. If not, provide build instructions. Otherwise, run the analysis on the pre-built files.

Parameters:

Name	Type	Description	Default
`dataset`	`PrebuiltFileDataset`	The `PrebuiltFileDataset` instance to analyze.	required
`overwrite`	`bool`	If True, overwrite existing results for this dataset.	`False`
`testing`	`bool`	If True, run analysis on a sample of two random files for testing.	`False`

properties

Define properties for SAST tool integrations.

SASTProperties

SASTProperties(free: bool, offline: bool)

Represent properties of a SAST tool.

Initialize a SASTProperties instance.

Parameters:

Name	Type	Description	Default
`free`	`bool`	A boolean indicating if the tool is free to use.	required
`offline`	`bool`	A boolean indicating if the tool can run without an internet connection.	required

Attributes:

Name	Type	Description
`free`
`offline`

free `instance-attribute`

free = free

offline `instance-attribute`

offline = offline

requirements

Define requirements for SAST tools and their fulfillment status.

SASTRequirement

SASTRequirement(
    name: str,
    instruction: str | None = None,
    url: str | None = None,
    doc: bool = False,
)

Bases: ABC

Represent a single requirement for a SAST tool to be functional.

Initialize a SASTRequirement instance.

Parameters:

Name	Type	Description	Default
`name`	`str`	The name of the requirement.	required
`instruction`	`str \| None`	A short instruction on how to download the requirement.	`None`
`url`	`str \| None`	A URL for more detailed instructions.	`None`
`doc`	`bool`	A flag indicating if the instruction is available in the documentaton.	`False`

Methods:

Name	Description
`is_fulfilled`	Check if the requirement is met.
`__repr__`	Return a developer-friendly string representation of the requirement.

Attributes:

Name	Type	Description
`name`
`instruction`
`url`
`doc`

name `instance-attribute`

name = name

instruction `instance-attribute`

instruction = instruction

url `instance-attribute`

url = url

doc `instance-attribute`

doc = doc

is_fulfilled `abstractmethod`

is_fulfilled(**kwargs: Any) -> bool

Check if the requirement is met.

repr

__repr__() -> str

Return a developer-friendly string representation of the requirement.

DownloadableRequirement

DownloadableRequirement(
    name: str,
    instruction: str | None = None,
    url: str | None = None,
    doc: bool = False,
)

Bases: SASTRequirement

Represent a SAST requirement that can be downloaded automatically.

Initialize a DownloadableRequirement instance.

Sets a standard instruction message on how to download the requirement using the CLI.

Parameters:

Name	Type	Description	Default
`name`	`str`	The name of the requirement.	required
`instruction`	`str \| None`	A short instruction on how to download the requirement.	`None`
`url`	`str \| None`	A URL for more detailed instructions.	`None`
`doc`	`bool`	A flag indicating if the instruction is available in the documentaton.	`False`

Methods:

Name	Description
`download`	Download the requirement.

download `abstractmethod`

download(**kwargs: Any) -> None

Download the requirement.

Config

Config(
    name: str,
    instruction: str | None = None,
    url: str | None = None,
    doc: bool = False,
)

Bases: SASTRequirement

Represent a configuration file requirement for a SAST tool.

Initialize a Config instance.

Parameters:

Name	Type	Description	Default
`name`	`str`	The name of the requirement.	required
`instruction`	`str \| None`	A short instruction on how to download the requirement.	`None`
`url`	`str \| None`	A URL for more detailed instructions.	`None`
`doc`	`bool`	A flag indicating if the instruction is available in the documentaton.	`False`

Methods:

Name	Description
`is_fulfilled`	Check if the configuration file exists for the given SAST tool.

is_fulfilled

is_fulfilled(sast_name: str, **kwargs: Any) -> bool

Check if the configuration file exists for the given SAST tool.

Binary

Binary(
    name: str,
    instruction: str | None = None,
    url: str | None = None,
    doc: bool = False,
)

Bases: SASTRequirement

Represent a binary executable requirement for a SAST tool.

Initialize a Binary instance.

Parameters:

Name	Type	Description	Default
`name`	`str`	The name of the requirement.	required
`instruction`	`str \| None`	A short instruction on how to download the requirement.	`None`
`url`	`str \| None`	A URL for more detailed instructions.	`None`
`doc`	`bool`	A flag indicating if the instruction is available in the documentaton.	`False`

Methods:

Name	Description
`is_fulfilled`	Check if the binary is available in the system's PATH.

is_fulfilled

is_fulfilled(**kwargs: Any) -> bool

Check if the binary is available in the system's PATH.

GitRepo

GitRepo(
    name: str,
    repo_url: str,
    license: str,
    license_url: str,
    instruction: str | None = None,
    url: str | None = None,
    doc: bool = False,
)

Bases: DownloadableRequirement

Represent a Git repository requirement that can be downloaded.

Initialize a GitRepo requirement instance.

Parameters:

Name	Type	Description	Default
`name`	`str`	The name of the requirement.	required
`repo_url`	`str`	The URL of the Git repository to clone.	required
`license`	`str`	The license of the repository.	required
`license_url`	`str`	A URL for the repository's license.	required
`instruction`	`str \| None`	A short instruction on how to download the requirement.	`None`
`url`	`str \| None`	A URL for more detailed instructions.	`None`
`doc`	`bool`	A flag indicating if the instruction is available in the documentaton.	`False`

Methods:

Name	Description
`is_fulfilled`	Check if the Git repository has been cloned.
`download`	Prompt for license agreement and clone the Git repository.

Attributes:

Name	Type	Description
`repo_url`
`license`
`license_url`
`directory`

repo_url `instance-attribute`

repo_url = repo_url

license `instance-attribute`

license = license

license_url `instance-attribute`

license_url = license_url

directory `instance-attribute`

directory = USER_CACHE_DIR / self.name

is_fulfilled

is_fulfilled(**kwargs: Any) -> bool

Check if the Git repository has been cloned.

download

download(**kwargs: Any) -> None

Prompt for license agreement and clone the Git repository.

File

File(
    name: str,
    parent_dir: Path,
    file_url: str,
    license: str,
    license_url: str,
    instruction: str | None = None,
    url: str | None = None,
    doc: bool = False,
)

Bases: DownloadableRequirement

Represent a file requirement that can be downloaded.

Initialize a File requirement instance.

Parameters:

Name	Type	Description	Default
`name`	`str`	The name of the requirement.	required
`parent_dir`	`Path`	The directory where the file should be saved.	required
`file_url`	`str`	The URL to download the file from.	required
`license`	`str`	The license of the file.	required
`license_url`	`str`	A URL for the file's license.	required
`instruction`	`str \| None`	A short instruction on how to download the requirement.	`None`
`url`	`str \| None`	A URL for more detailed instructions.	`None`
`doc`	`bool`	A flag indicating if the instruction is available in the documentaton.	`False`

Methods:

Name	Description
`is_fulfilled`	Check if the file has been downloaded.
`download`	Prompt for license agreement and download the file.

Attributes:

Name	Type	Description
`parent_dir`
`file_url`
`license`
`license_url`

parent_dir `instance-attribute`

parent_dir = parent_dir

file_url `instance-attribute`

file_url = file_url

license `instance-attribute`

license = license

license_url `instance-attribute`

license_url = license_url

is_fulfilled

is_fulfilled(**kwargs: Any) -> bool

Check if the file has been downloaded.

download

download(**kwargs: Any) -> None

Prompt for license agreement and download the file.

SASTRequirements

SASTRequirements(
    full_reqs: list[SASTRequirement],
    partial_reqs: list[SASTRequirement],
)

Manage the requirements for a SAST tool and determine its operational status.

Initialize a SASTRequirements instance.

Parameters:

Name	Type	Description	Default
`full_reqs`	`list[SASTRequirement]`	A list of requirements for full functionality.	required
`partial_reqs`	`list[SASTRequirement]`	A list of requirements for partial functionality.	required

Methods:

Name	Description
`get_status`	Determine the operational status (full, partial, none) based on fulfilled requirements.
`get_missing`	Get a list of all unfulfilled requirements.

Attributes:

Name	Type	Description
`name`
`full`
`partial`
`all`

name `instance-attribute`

name = None

full `instance-attribute`

full = full_reqs

partial `instance-attribute`

partial = partial_reqs

all `instance-attribute`

all = full_reqs + partial_reqs

get_status

get_status() -> (
    Literal["full"] | Literal["partial"] | Literal["none"]
)

Determine the operational status (full, partial, none) based on fulfilled requirements.

get_missing

get_missing() -> list[SASTRequirement]

Get a list of all unfulfilled requirements.

SAST Tools

codesectools.sasts.core

cli

CLIFactory

sast

custom_messages

sast instance-attribute

help_messages instance-attribute

build_cli

add_main

help

add_install

help

add_analyze

help

add_benchmark

help

add_list

help

add_plot

help

graphics

Graphics

sast

project_name

sast instance-attribute

output_dir instance-attribute

color_mapping instance-attribute

plot_functions instance-attribute

limit instance-attribute

has_latex instance-attribute

export

overwrite

pgf

show

ProjectGraphics

sast

project_name

result instance-attribute

checker_to_category

checker

plot_overview

FileDatasetGraphics

sast

dataset

dataset instance-attribute

benchmark_data instance-attribute

plot_top_cwes

GitRepoDatasetGraphics

sast

dataset

dataset instance-attribute

results instance-attribute

benchmark_data instance-attribute

checker_to_category

checker

plot_overview

plot_top_cwes

plot_defects_per_loc

plot_time_per_loc

parser

Defect

file

checker

category

cwe

message

location

data

sast instance-attribute

file instance-attribute

file_path instance-attribute

checker instance-attribute

category instance-attribute

cwe instance-attribute

message instance-attribute

location instance-attribute

data instance-attribute

__repr__

AnalysisResult

`sast`

`custom_messages`

sast `instance-attribute`

help_messages `instance-attribute`

`help`

`help`

`help`

`help`

`help`

`help`

`sast`

`project_name`

sast `instance-attribute`

output_dir `instance-attribute`

color_mapping `instance-attribute`

plot_functions `instance-attribute`

limit `instance-attribute`

has_latex `instance-attribute`

`overwrite`

`pgf`

`show`

`sast`

`project_name`

result `instance-attribute`

`checker`

`sast`

`dataset`

dataset `instance-attribute`

benchmark_data `instance-attribute`

`sast`

`dataset`

dataset `instance-attribute`

results `instance-attribute`

benchmark_data `instance-attribute`

`checker`

`file`

`checker`

`category`

`cwe`

`message`

`location`

`data`

sast `instance-attribute`

file `instance-attribute`

file_path `instance-attribute`

checker `instance-attribute`

category `instance-attribute`

cwe `instance-attribute`

message `instance-attribute`

location `instance-attribute`

data `instance-attribute`

repr

`name`

`source_path`

`lang`

`files`

`defects`

`time`

`loc`

`data`

name `instance-attribute`

source_path `instance-attribute`

lang `instance-attribute`

files `instance-attribute`

defects `instance-attribute`

time `instance-attribute`

loc `instance-attribute`

data `instance-attribute`

repr

load_from_output_dir `abstractmethod` `classmethod`

`output_dir`

load_from_output_dirs `classmethod`

`output_dirs`

`checker`

name `instance-attribute`

supported_languages `instance-attribute`

supported_dataset_names `instance-attribute`

properties `instance-attribute`

requirements `instance-attribute`

commands `instance-attribute`