title: Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿Ð»Ð°Ð³Ð¸Ð½Ð° Ðº Ð¿Ð»Ð°ÑÑÐ¾ÑÐ¼Ðµ SonarQube Ð´Ð»Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ·ÑÐºÐ° GoLang
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¼Ð°Ð³Ð¸ÑÑÑÐ°
titleType: Subtitle
title: Development of a plug-in for the SonarQube platform for static analysis of the GoLang language
Creators: name: ÐÑÐ±Ð¾ÑÐ¾Ð»ÐºÐ¾Ð²Ð°, ÐÐ°ÑÐ°Ð»Ð¸
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2023
Subjects: ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·
Ð¿Ð»Ð°Ð³Ð¸Ð½
Sonarqube
GoLang
static analysis
plugin

description: Â  Â  Ð­ÑÐ° ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐµ Ð¿Ð»Ð°Ð³Ð¸Ð½Ð° SonarQube Ð´Ð»Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ·ÑÐºÐ° GoLang. ÐÑÐ»Ð¸ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ñ ÑÐ»ÐµÐ´ÑÑÑÐ¸Ðµ Ð·Ð°Ð´Ð°ÑÐ¸: Â  Â  Â  Â  ÐÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð¼Ð¾Ð´ÑÐ»ÐµÐ¹, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÐ¼ÑÑ Ð² ÑÐ·ÑÐºÐµ Golang Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ¾Ð². Â  Â  Â  Â  ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ¾Ð² ÐºÐ¾Ð´Ð° Ð´Ð»Ñ ÑÐ·ÑÐºÐ° GoLang. Â  Â  Â  Â  Ð ÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ Ð¿Ð»Ð°Ð³Ð¸Ð½Ð° Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ° Sonarqube, Ð¸Ð½ÑÐµÐ³ÑÐ¸ÑÑÑÑÐµÐ³Ð¾ Ð¾Ð´Ð¸Ð½ Ð¸Ð· Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ¾Ð². Â  Â  Â  Â  Ð­ÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½Ð¾Ðµ ÑÑÐ°Ð²Ð½ÐµÐ½Ð¸Ðµ Ð¿ÑÐ¾Ð¸Ð·Ð²Ð¾Ð´Ð¸ÑÐµÐ»ÑÐ½Ð¾ÑÑÐ¸ Ð¸ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¿Ð»Ð°Ð³Ð¸Ð½Ð° Ñ Ð´ÑÑÐ³Ð¸Ð¼Ð¸ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ð¼Ð¸ ÑÐµÑÐµÐ½Ð¸ÑÐ¼Ð¸ Ð½Ð° ÑÐµÐ°Ð»ÑÐ½ÑÑ Ð¿ÑÐ¾ÐµÐºÑÐ°Ñ. Â  Â  ÐÐ¾ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ°Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð±ÑÐ» Ð²ÑÐ±ÑÐ°Ð½ govulncheck - Ð¸Ð½ÑÑÑÑÐ¼ÐµÐ½Ñ, ÐºÐ¾ÑÐ¾ÑÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÑÐµÑ Ð¿Ð¾Ð´ÐºÐ»ÑÑÐ°ÐµÐ¼ÑÐµ Ð¿Ð°ÐºÐµÑÑ c Ð¿Ð¾Ð¼Ð¾ÑÑÑ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¿ÐµÑÐµÐ¼ÐµÐ½Ð½ÑÑ ÑÐ¸Ð¿Ð¾Ð² (VTA), Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÐ¼ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¸Ð· ÑÑÐ·Ð²Ð¸Ð¼Ð¾Ð³Ð¾ Ð¿Ð°ÐºÐµÑÐ°, ÑÐµÐ¼ ÑÐ°Ð¼ÑÐ¼ ÑÐ¼ÐµÐ½ÑÑÐ°Ñ ÐºÐ¾Ð»Ð¸ÑÐµÑÑÐ²Ð¾ Ð»Ð¾Ð¶Ð½ÑÑ ÑÑÐ°Ð±Ð°ÑÑÐ²Ð°Ð½Ð¸Ð¹. Â  Â  Â  Â  ÐÐ¾Ð±Ð°Ð²Ð»ÐµÐ½Ð¸Ðµ Ð¿Ð¾Ð´Ð´ÐµÑÐ¶ÐºÐ¸ Ð´Ð°Ð½Ð½Ð¾Ð¹ ÑÑÐ¸Ð»Ð¸ÑÑ Ð² Ð¿Ð¾Ð¿ÑÐ»ÑÑÐ½ÑÐ¹ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾Ñ Sonarqube Ð¿Ð¾Ð·Ð²Ð¾Ð»Ð¸Ð»Ð¾ ÑÐ¿ÑÐ¾ÑÑÐ¸ÑÑ Ð¸ ÑÑÐºÐ¾ÑÐ¸ÑÑ Ð¿Ð¾Ð¸ÑÐº ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¿ÑÐ¾ÐµÐºÑÐ°Ñ Ð½Ð° ÑÐ·ÑÐºÐµ GoLang.
description: This work is devoted to the development of the SonarQube plugin for static analysis of the GoLang language. The following tasks were completed: Â  Â  Â  Â  Â  Identification and categorization of vulnerabilities in GoLang code that can be detected using static analysis. Â  Â  Â  Â  Â  Research and analysis of existing static code analyzers in the GoLang language. Â  Â  Â  Â  Â  Creation and implementation of a plug-in for the Sonarqube analyzer, integrating one of the analyzers. Â  Â  Â  Â  Â  An experimental comparison of the performance and efficiency of the developed plugin with other existing solutions on real projects. Â  Â  According to the results of the study, govulncheck was chosen - a tool that analyzes plug-in packages. It uses variable type analysis (VTA) to determine which methods are being used from a vulnerable package, reducing false positives. Â  Â  Â  Â  Adding support for this utility to the popular Sonarqube static analyzer has simplified and accelerated the search for vulnerabilities in GoLang projects.