Momo Code Sec Inspector ​(Java)​

Compatible with IntelliJ IDEA (Ultimate, Community), Android Studio and 1 more
Screenshot 1
Screenshot 2

MOMO Code Sec Inspectors plugin


GitHub | Issues

Java静态代码安全审计插件。
A Java static code inspector with one-click fix capability.

本插件侧重于在编码过程中发现项目潜在的安全风险,并提供一键修复能力。
This plugin focus on the security risks and provides one-click fix capability.

本插件利用IDEA原生Inspection机制检查活跃文件,检查速度快,占用资源少。
It uses the IDEA native inspection mechanism to check the active file, which is faster and takes up less resources.

插件提供的规则名称均以"Momo"开头。
It provides a set of inspection rules, the name of all rules starts with "Momo".


Contact: mmsrc [AT] immomo.com

What’s New

Changelog

All notable changes to this project will be documented in this file.

Main version site uses 'x' stand for idea main version.

> version [x.15]

# Modify

- 1004: Fix false positive on mybatis plus

> version [x.14]

# Added

- 1025: HardcodedIp

# Modify

- 1020: support jdbc url and except not ASCII text
- vendor change to immomo.com
- add Chinese description

# BugFix

- aspect annotation support 'SetBoolArgQuickFix'

> version [x.13]

# Added

- 1021: PublicControllerOnSpring
- 1022: SpringSessionFixProtection
- 1023: ReplacePseudorandomGenerator
- 1024: OpenSAML2IgnoreComment

# Modify

- 1009: support New SecureRandom Expression
- Github issue#5 HardcodedCredentials support Property key
- Replace TrueArgToFalseQuickFix by SetBoolArgQuickFix

> version [x.12]

# Modify

- optimize sql sentence regex pattern
- optimize constant String trace method

> version [x.11]

# Modify

- Replace entropy algorithm
- Replace deprecated api

> version [x.10]

# Added

- 1020: HardcodedCredentials
- scaffold for add/delete Inspection

# Modify

- remove unused test code
- i18n for Inspection Message, QuickFix, DisplayName
- upgrade org.jetbrains.intellij to 0.5.0

> version [x.9]

# Modify

- Support more XML Parser to detect XXE vuln.

# BugFix

- Show green screen when use XXE quickfix.
- Github issue#2 XML foreach Error.

> version [x.8]

# Modify

- Replace deprecated API.

> version [x.7]

# BugFix

- Order by with limit end, false positive.

# Modify

- Feedback data adds plugin version.
- Optimize the packaging process.

> version [x.6]

# BugFix

- Redis could use Jackson as cache, false positive.

> version [x.5]

# BugFix

- Some statements see as SQLi, false positive.

> version [x.4]

# Added

- Whitelist on vulnerable signs.

# Modify

- Added gain FQName of an Element.
- Make vulnerable sign method to public.
- MOMOBootConfiguration suffix judge.

# BugFix

- SQL joint on INSERT field, false positive.
- SQL joint judge variable type.

> version [x.3]

# BugFix

- SQL joint on FIELD, false positive.
- SQL joint on INSERT VALUE(S), false positive.

> version [x.2]

# BugFix

- Judge if use MOMOBoot to reduce, false positive.

> version [x.1]

# Added

- 1017: LDAPUnserialize
- 1018: BroadCORSAllowOrigin
- 1019: SpringSecurityDebugEnabled

# Modify

- Split MOMOBoot rules.

# BugFix

- Constants InputStream has null point exception.

> version [x.0]

# Added

- 1001: PolyadicExpressionSQLi
- 1002: PlaceholderStringSQLi
- 1003: MybatisAnnotationSQLi
- 1004: MybatisXmlSQLi
- 1005: RegexDos
- 1006: JacksonDatabindDefaultTyping
- 1007: FastjsonAutoType
- 1008: NettyResponseSplitting
- 1009: PredictableSeed
- 1010: XxeInspector
- 1011: XStreamUnserialize
- 1014: WeakHashInspector
- 1015: OutdatedEncryptionInspector
- 1016: XMLDecoderUnserialize

Apr 29, 2024
Version 203.15.1

Getting Started

Out of the box

Rating & Reviews

4.6
2 Ratings (41,206 Downloads)
5
4
3
2
1

augustm

27.07.2023

伟大,无需多言

0

j jinghong

16.10.2020

好评

0

Additional Information

Vendor:
sec-and(Trader)
Copyright:
Plugin ID:
Momo Code Sec Inspector (Java)