Overview¶
ts-sast finds security problems in source code and reports them as SARIF 2.1. It is the static-analysis member of the TrustSource scanner family: ts-scan builds the Software Bill of Materials, ts-obom extracts the IAM access graph from infrastructure code, ts-sast looks at the code itself. The three are separate tools on purpose. A pipeline that only needs an SBOM should never have to install a static analyser.
The first target is classic Visual Basic 6, a language that only the large commercial platforms cover today. ts-sast drives Microsoft's DevSkim with a VB6 language definition and a rule pack written for the mistakes VB6 code actually contains. A semantic VB6 analyser with data-flow analysis is in preparation as a second backend; the command line and the result format will not change when it arrives.
The recommended way to run ts-sast is the Docker image trustsource/ts-sast, which bundles Python, the .NET runtime and DevSkim. A local installation is possible for rule development.
To get started:
- Architecture, backends and what the scan can and cannot see
- Installation
- Usage, the rules and the result format
- Operating inside a container
Getting Support¶
ts-sast is open source and supported through this repository. As a TrustSource subscriber, you may contact TrustSource support for help. As a community user, please file a ticket with the repo.
You may also find additional information and learning materials in our open TrustSource Knowledgebase.
Reporting Vulnerabilities¶
TrustSource supports a coordinated vulnerability disclosure procedure for its platform. ts-sast follows that schema and vulnerabilities identified should follow this procedure. Please find all details in our Security Policy.