Polyspace BugFinder: Disabling Security Defects
1 Ansicht (letzte 30 Tage)
Ältere Kommentare anzeigen
Narayan Narvekar
am 18 Mai 2021
Bearbeitet: Anirban
am 18 Mai 2021
Hello Support Team,
I would like to get some information on what would be the impact if the "Polyspace BugFinder Security Defects" are disabled in our embedded C project.
According to the documentation, these defects highlight places in the code which are vulnerable to hacking or other security attacks. If our software does not need to satisfy any such security requirements, would it be ok to disable these defects from our project?
Best Regards,
Narayan
0 Kommentare
Akzeptierte Antwort
Anirban
am 18 Mai 2021
Bearbeitet: Anirban
am 18 Mai 2021
Hi,
I will start with the difference between a security defect checker and another type of defect checker. A security defect shows a vulnerability in your code that by itself is not a problem, but has to be actively exploited by a hacker to cause a problem. A very simple example is the following: a Division by zero by itself is a problem. But the equivalent security defect is a Tainted division operand, which shows cases where the divisor is obtained from an untrusted external source and not checked for certain problem values. This by itself might not be a problem since the source has to actually pass those problem values to trigger an issue. In other words, your program is not robust against malicious data from sources.
If you do not have requirements for this kind of robustness against malicious data (or malicious code injection through data), you can disable the security defects. They should not have an impact on other types of defect checkers.
0 Kommentare
Weitere Antworten (0)
Siehe auch
Kategorien
Mehr zu Bug Finder Analysis finden Sie in Help Center und File Exchange
Community Treasure Hunt
Find the treasures in MATLAB Central and discover how the community can help you!
Start Hunting!