ishenwei/nexus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auto-sync: 2026-04-21 17:12

Browse Source
This commit is contained in:
weishen
2026-04-21 17:12:45 +08:00
parent 914c8f6925
commit 0fe7ba237f
1888 changed files with 220 additions and 68174 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
wiki/concepts/SAST.md
View File

@@ -1,26 +0,0 @@
---
title: "SAST（静态应用安全测试）"
type: concept
tags: [安全, 测试, 代码分析]
sources: [what-is-devsecops-best-practices-benefits-and-tools]
last_updated: 2026-04-16
---
## Definition
SAST（Static Application Security Testing）是一种静态代码分析技术，在不运行应用程序的情况下分析源代码以识别安全漏洞。
## Characteristics
- 在开发早期（编码阶段）使用
- 无需执行代码
- 可检测 SQL 注入、跨站脚本、缓冲区溢出等常见漏洞
- 集成到 IDE 和 CI/CD 流水线
## Tools
- SonarQube
- Checkmarx
- Fortify
## Connections
- [[DevSecOps]] ← uses ← [[SAST]]
- [[CI-CD-流水线]] ← integrates ← [[SAST]]
- [[SDLC]] ← embeds ← [[SAST]]