Home
Developing
Learn how to develop by using the product.
AppScan® Source trace
With AppScan® Source trace, you can verify input validation and encoding that meets your software security policies. You can look at the findings that produce input/output traces and mark methods as validation and encoding routines, sources or sinks, callbacks, or taint propagators.
Using the Trace view
Analyzing source code in an editor
With AppScan® Source, you can analyze or modify source code in an internal editor - or you can choose from a variety of external editors.

Developing
Learn how to develop by using the product.
- Scanning source code and managing assessments
  This section explains how to scan your source code and manage assessments.
- Triage and analysis
  Grouping similar findings allows security analysts or IT auditors to segment and triage source code problems. This section explains how to triage AppScan® Source assessments and analyze results.
- AppScan® Source trace
  With AppScan® Source trace, you can verify input validation and encoding that meets your software security policies. You can look at the findings that produce input/output traces and mark methods as validation and encoding routines, sources or sinks, callbacks, or taint propagators.
  - AppScan® Source trace scan results
    Scan results may include traces identified by AppScan® Source trace. The icon in the Trace column indicates the existence of a trace of the call graph.
  - Input/output tracing
    An input/output trace is generated when AppScan® Source for Analysis can track the data from a known source to a sink or lost sink.
  - Using the Trace view
    - Input/output stacks in the Trace view
      The upper left panel displays the input and output stacks. The stack is a sequence of calls that terminates at either a source (input stack) or sink (output stack).
    - Analyzing source code in an editor
      With AppScan® Source, you can analyze or modify source code in an internal editor - or you can choose from a variety of external editors.
  - Validation and encoding scope
    From the Trace view, you can specify custom validation and encoding routines that, once stored in the AppScan® Source Security Knowledgebase, marks data as checked instead of tainted. With the Custom Rules Wizard, you define these routines based on their scope.
  - Creating custom rules from an AppScan® Source trace
    You can create custom rules from the Trace view that allow you to filter out findings with traces that are taint propagators, not susceptible to taint, or sinks. You can also mark methods in the trace as validation/encoding routines (or indicate that they are not validation/encoding routines).
  - Code examples for tracing
    This section provides code examples which illustrate tracking tainted data from a source to a sink - and how to create a validation and encoding routine.
- AppScan® Source for Analysis and defect tracking
  AppScan® Source for Analysis integrates with defect tracking systemsIBM® Rational Team Concert™ to deliver confirmed software vulnerabilities directly to the developer desktop. Defect submission to a defect tracking system contains a textual description of the bug and a file that contains only the findings submitted with the defect.
- Findings reports and audit reports
  Security analysts and risk managers can access reports of select findings or a series of audit reports that measure compliance with software security best practices and regulatory requirements. This section explains how to create reports of aggregate finding data.
- Creating custom reports
  In the Report Editor, you create report templates used to generate custom reports.

Analyzing source code in an editor

With AppScan® Source, you can analyze or modify source code in an internal editor - or you can choose from a variety of external editors.

External editors allow you to review results in AppScan® Source for Analysis and make code modifications in the development environment of your choice. External editors include:

Table 1. Supported external editors
Editor	Platform
Eclipse (see the AppScan® Source system requirements to learn which versions of Eclipse are supported)	Windows™ and Linux™
Notepad	Windows™
vi	Linux™
System Default	Windows™ and Linux™

vi
Eclipse (see the AppScan® Source system requirements to learn which versions of Eclipse are supported)
System Default

Note: You cannot edit source files in a WAR file.

To view/modify source code in the editor, choose one of these options:

Double-click a finding in the findings table. The internal editor opens at the line of code.
Right-click a finding in the findings table and select Open in Internal Editor or Open in External Editor > <editor> (where <editor> is one of the supported external editors listed in the above table).
Select a trace node and then select the Open in Internal Editor or Open in External Editor > <editor> toolbar button - or right-click the selection and select Open in Internal Editor or Open in External Editor > <editor> from the menu.

If you have opened a file in the editor, markers indicate locations in the file that represent findings. To follow these back to the findings table, right-click the line of code in the editor and then select Show in Findings View from the menu.