Microsoft Application Inspector

Re:Microsoft Application Inspector by SloopJon on Tuesday January 28, 2020 @11:42AM (#22171030)

I don't see any mention of the languages that it recognizes, but a perusal of some of the JSON files leads me to believe that this handles many different languages. It seems that it's by way of regular expressions, though, not language-specific parsing.

[ Parent | on HN ]

Re:Microsoft Application Inspector by neves on Tuesday January 28, 2020 @01:02PM (#22172110)

This info is in the front page:

The tool supports scanning various programming languages including C, C++, C#, Java, JavaScript, HTML, Python, Objective-C, Go, Rudy, Powershell and more and includes html, json and text output formats with the default being an html report

[ Parent | on HN ]

Re:Microsoft Application Inspector by acidictadpole on Tuesday January 28, 2020 @01:58PM (#22172830)

Ah. The old classic Rudy.

[ Parent | on HN ]

Re:Microsoft Application Inspector by malkia on Tuesday January 28, 2020 @07:15PM (#22175703)

And ... "A message to you, Rudy!" - that be my favourite ska song from the Specials :)

[ Parent | on HN ]

Re:Microsoft Application Inspector by dana321 on Tuesday January 28, 2020 @02:35PM (#22173217)

What about Rudt and Godlang?

[ Parent | on HN ]

Re:Microsoft Application Inspector by SloopJon on Tuesday January 28, 2020 @02:30PM (#22173170)

Not sure how I missed that. The wiki page it links to has a nice list, which is apparently related to Visual Studio Code.

[ Parent | on HN ]

Re:Microsoft Application Inspector by protanopia on Tuesday January 28, 2020 @12:55PM (#22171989)

The README has been updated since your comment to include:

> The tool supports scanning various programming languages including C, C++, C#, Java, JavaScript, HTML, Python, Objective-C, Go, Rudy, Powershell and more

[ Parent | on HN ]

Re:Microsoft Application Inspector by kozhevnikov on Tuesday January 28, 2020 @11:47AM (#22171098)

Does it support HTML? Can one parse HTML with regex?

[ Parent | on HN ]

Re:Microsoft Application Inspector by SloopJon on Tuesday January 28, 2020 @11:59AM (#22171256)

It doesn't appear to be parsing at all. It's just looking for patterns.

If you look at languages.json in RulesEngine/Resources, files with the extension .html (and some others) are recognized as "html", with type "code":

  {
    "name": "html",
    "extensions": [ ".html", ".htm", ".cshtml", ".tmpl" ],
    "type": "code"
  },

This sets the scope for the patterns in AppInspector/rules/default; e.g.,

  {
    "name": "Content Management Framework: Wordpress",
    "id": "AI021200",
    "description": "Development Framework: Wordpress",
    "applies_to": [ "javascript", "html" ],
    "tags": [ "Framework.CMS.Wordpress" ],
    "severity": "moderate",
    "patterns": [
      {
        "pattern": "wordpress",
        "type": "string",
        "scopes": [ "code", "comment" ],
        "modifiers": [ "i" ],
        "confidence": "high"
      }
    ]
  },

This seems like it would be prone to a lot of false positives, but I haven't tried the tool.

[ Parent | on HN ]

Re:Microsoft Application Inspector by JadeNB on Tuesday January 28, 2020 @12:38PM (#22171719)

Boy, are you in for a fun StackExchange read: https://stackoverflow.com/a/1732454 .

[ Parent | on HN ]

Re:Microsoft Application Inspector by singlow on Tuesday January 28, 2020 @11:52AM (#22171158)

You can't parse it properly with a Regular Expression, but you can parse it with regex-like systems. However I doubt it is parsing outright - it only has to look for certain keywords and patterns that indicate certain behaviors.

[ Parent | on HN ]

Re:Microsoft Application Inspector by guydalf on Tuesday January 28, 2020 @03:01PM (#22173476)

Correct. We don't need to parse it per se just look for use of features that are easy to identify like XmlHttpRequest, Json.Parse use etc.

[ Parent | on HN ]