Skip to content

Commit f977e46

Browse files
springkillspringkill
authored
Create README_en.md
1 parent 81b6ef5 commit f977e46

File tree

1 file changed

+173
-0
lines changed

1 file changed

+173
-0
lines changed

‎README_en.md

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
# CodeAuditAssistant
2+
3+
[中文版 (Chinese Version)](./README.md)
4+
5+
**Authors**: SpringKill, Unam4
6+
**Supported Plugin Version**: `IDEA >= 2022.3`
7+
**Kotlin**: JDK17+
8+
9+
With the support of `Weijie Security`, we will continue to provide open-source projects for everyone. Our team has also become an open-source team sponsored by `Weijie Security`, aiming to bring you more **reliable** and **powerful** security tools.
10+
11+
There are still some known and unknown `bugs` in the project. To prevent the buggy source code from being redeveloped or widely distributed, the plugin currently adopts an **authorization activation** model. Once we’ve collected enough `issues` and fixed more bugs to elevate the tool’s usability to the next level, we will **fully open-source the code** and invite security enthusiasts to collaborate on its development and maintenance.
12+
13+
## Acknowledgments
14+
15+
The following contributors have provided significant suggestions and technical support during the plugin’s development. A heartfelt thank you!
16+
17+
**Technical Support**: Ar3h
18+
**Non-Technical Contributors**: zjacky
19+
20+
## Features
21+
22+
### Code Inspection
23+
24+
`CodeAuditAssistant` is a code audit assistant plugin consisting of three main components: `Decompiler`, `Code Analysis`, and `SinkFinder`. These work together to provide powerful code auditing assistance.
25+
26+
#### SinkFinder
27+
28+
`SinkFinder` includes built-in common `Java` code `Web` vulnerability `sink` points and high-risk component call `sink` points. Through IDEA’s native `Problem` module, you can quickly collect `sink` points in your project:
29+
30+
<img src="./img/image-20250331010159751.png" alt="Sink Collection Interface" width="50%" />
31+
32+
After collecting `sinks`, double-click to jump to the corresponding code location:
33+
34+
<img src="./img/image-20250331010358550.png" alt="Sink Jump Demo" width="50%" />
35+
36+
#### Decompiler
37+
38+
The decompiler module remains unchanged from its previous version. Select a `jar` package from the list and click `Run` to decompile it back to source code (currently unoptimized with a high failure rate).
39+
40+
<img src="./img/image-20250331010458737.png" alt="Decompiler Interface" width="35%" />
41+
42+
#### Code Analysis
43+
44+
The biggest update in this release is the code analysis module, which allows you to quickly trace a method’s call path. Here’s a step-by-step introduction:
45+
46+
<img src="./img/image-20250331010441318.png" alt="Code Analysis Interface" width="50%" />
47+
48+
First, the functional area: The `Generate CallGraph` button generates the project’s call graph, and the adjacent **dropdown menu** selects the **scope** of the call graph. Choosing `Entire` builds the graph for the entire project, while `Selected Module` prompts a window to select the scope when you click `Generate CallGraph`.
49+
50+
<img src="./img/image-20250331010933308.png" alt="Module Selection" width="50%" />
51+
<img src="./img/image-20250331123256112.png" alt="Right-Click Menu" width="50%" />
52+
53+
Before building the graph, you’ll notice two checkboxes:
54+
55+
- `Info`: Collects all method-related information (for conditional method searches).
56+
- `Path`: Includes method call paths in the graph (for building call relationships).
57+
58+
If your codebase isn’t too large and your computer has sufficient memory, we recommend checking both.
59+
60+
<img src="./img/image-20250331123349918.png" alt="Checkbox Explanation" width="50%" />
61+
62+
Hidden Window:
63+
64+
Clicking this button reveals a hidden window. If you selected `Info` during graph building, you can quickly search for methods by conditions here:
65+
66+
The `ParamType` field requires fully qualified class names, separated by commas, and supports `*` as a wildcard. Example:
67+
68+
`java.lang.String,*` finds all methods with a first parameter of `String` and any second parameter.
69+
70+
The `Annotations` field is also comma-separated but doesn’t require fully qualified names. Example:
71+
72+
`@Override,@xxx` finds all methods with `Override` and `xxx` annotations.
73+
74+
<img src="./img/image-20250331124009118.png" alt="Hidden Window" width="50%" />
75+
76+
Usage Example:
77+
78+
<img src="./img/image-20250331124429606.png" alt="Search Example" width="50%" />
79+
80+
Search Paths:
81+
82+
After building the graph (the progress bar may not display if the tool window is too narrow; consider dragging it out as a separate window), you can use the search function:
83+
84+
There are three search methods:
85+
1. To find a call path between two methods, set the starting method as `ROOT` and the ending method as `SINK`, then click `Search`. Double-click the results to jump to the code (may not always be accurate):
86+
87+
<img src="./img/image-20250331124823202.png" alt="Path Search" width="50%" />
88+
89+
2. If you don’t know the starting point and only want to find a method’s call chain/location, input only the `SINK`:
90+
91+
<img src="./img/image-20250331124952438.png" alt="Single Sink Search" width="50%" />
92+
93+
3. When you find an interesting method in the code and want to trace all paths leading to it, use the right-click menu’s `Search as sink`. This auto-fills the selected method into the `SINK` field and runs the search:
94+
95+
<img src="./img/image-20250331125202792.png" alt="Right-Click Search" width="50%" />
96+
97+
All results can be expanded/collapsed with `Enter`, and all nodes can be double-clicked to jump to their locations.
98+
99+
Log4j Detection Example:
100+
101+
<img src="./img/image-20250401025726431.png" alt="Log4j Detection Example" width="50%" />
102+
103+
#### Display Interface
104+
105+
When idle, you’ll see this interface:
106+
107+
- `Root Methods`: Displays all methods **not called by others**.
108+
- `Info`: Shows tips and identifies your system platform (useful for submitting ISSUEs). The `CallGraph` status is "Not Ready" until a graph is successfully built, then it becomes "Ready".
109+
- `MethodNode`: Shows the number of nodes in the current call graph, memory usage, and any tips or error messages.
110+
111+
<img src="./img/image-20250331125415889.png" alt="Initial Interface" width="50%" />
112+
113+
The `Search Results` interface displays search outcomes:
114+
115+
<img src="./img/image-20250331125928270.png" alt="Search Path Icon" width="5%" /> Icon for search paths
116+
<img src="./img/image-20250331130037060.png" alt="Method Declaration Icon" width="5%" /> Icon for method declarations (where methods are defined)
117+
<img src="./img/image-20250331130128343.png" alt="Method Call Icon" width="5%" /> Icon for method calls
118+
<img src="./img/image-20250331130217321.png" alt="New Object Icon" width="5%" /> Icon for object creation (also used for hidden window search results in this version)
119+
`File Icon`: Indicates methods in interfaces or abstract classes being implemented/overridden
120+
121+
### Notes & Feature Development
122+
123+
We care about your code security, and we believe you do too. Please report any desired features or `bugs` promptly, and we’ll optimize/fix them as soon as possible.
124+
125+
The current version uses the `DFS` algorithm for path searching, which may not display all paths in cases with multiple routes. For now, use segmented searches. Planned improvements include:
126+
127+
- Search function optimization
128+
- Path-finding method optimization
129+
- Graph structure optimization
130+
131+
The current `CallGraph` cannot be persistently saved. Planned features include:
132+
133+
- Call graph persistence
134+
- Method change monitoring
135+
136+
Duplicate `Root/Source` nodes in searches may lead to redundant paths. Planned fixes include:
137+
138+
- `Root/Source` node deduplication and path deduplication
139+
140+
Other features:
141+
142+
- Direct search support for lib jars, removing decompilation
143+
- Search result highlighting optimization
144+
- …
145+
146+
We welcome all security enthusiasts to submit `Issues` to help improve the project!
147+
148+
### About Future Versions
149+
150+
We plan to launch a `Pro` version later. Contributors whose Issues are adopted in the open-source version will receive a `Pro` authorization code.
151+
152+
Unlike the open-source version, the `Pro` version will use a proprietary engine and mechanisms for analysis, offering:
153+
154+
The `Pro` version aims for one-click accurate vulnerability detection, minimizing false positives, and supporting one-click report generation—ideal for beginners needing quick audit reports.
155+
156+
| Feature Differences | Open-Source Version | Pro Version |
157+
| :-----------------: | :-----------------: | :----------------------------------: |
158+
| Language Support | All JVM Languages | More languages (Python, Go, etc.) |
159+
| Taint Analysis | Method Calls Only | Enhanced taint analysis |
160+
| Report Export | Not Supported | Supported |
161+
| SCA | Dependency Analysis | More precise call-level SCA analysis |
162+
| AI Assistance | None | Unique AI analysis mode |
163+
| … | … | … |
164+
165+
### Authorization
166+
167+
For authorization of the current version, please send an email to springkill@163.com or contact me through X @chun_springX.
168+
169+
If you find this project helpful, please give it a small Star and Follow to encourage me~
170+
171+
### Conclusion
172+
173+
The forest grows beyond the walls of Mansu. Every student of history knows that Mansu has no walls.

0 commit comments

Comments
 (0)