docs: add OpenTaint (taint-analysis SAST) under a new "Code Security" section by misonijnik · Pull Request #2876 · Snailclimb/JavaGuide · GitHub
Skip to content

docs: add OpenTaint (taint-analysis SAST) under a new "Code Security" section#2876

Open
misonijnik wants to merge 2 commits into
Snailclimb:mainfrom
misonijnik:docs/add-opentaint-security-tool
Open

docs: add OpenTaint (taint-analysis SAST) under a new "Code Security" section#2876
misonijnik wants to merge 2 commits into
Snailclimb:mainfrom
misonijnik:docs/add-opentaint-security-tool

Conversation

@misonijnik

@misonijnik misonijnik commented Jun 16, 2026

Copy link
Copy Markdown

What

Add a 代码安全 (Code Security) section to docs/open-source-project/tools.md listing OpenTaint — an open-source taint-analysis (SAST) engine for Java / Kotlin / Spring Boot.

It's placed right after 代码质量: same "run-against-your-code" tooling, but focused on security vulnerabilities rather than code quality, so a separate category keeps it easy to find.

Why OpenTaint

  • On-topic — targets Java / Kotlin / Spring Boot
  • Bytecode-level inter-procedural dataflow; detects 20+ vuln classes (SQLi, XSS, SSRF, command injection, etc.)
  • Models Spring DI, singleton bean state, and JPA flows that file-by-file matchers miss
  • Fully open source (engine is Apache 2.0, CLI and rules are MIT)

The entry links to the Chinese README, the official site, and two deep-dive posts (Spring analysis and LLM-agent with taint workflow).

Note for reviewers

The copy was drafted with Claude Opus 4.8 — please review the wording and improve any phrasing that reads unnaturally.

@Snailclimb

Copy link
Copy Markdown
Owner

@Snailclimb Snailclimb left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

感谢补充,方向可以考虑,但当前文案和该页面“一行简介”的风格不一致,先不合入。

请按上面的建议压缩为 1 句中性描述,去掉推广表达和额外博客链接后再更新。

@Snailclimb Snailclimb left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

感谢补充,方向可以考虑,但当前文案和该页面“一行简介”的风格不一致,先不合入。

请按上面的建议压缩为 1 句中性描述,去掉推广表达和额外博客链接后再更新。

@Snailclimb Snailclimb dismissed their stale review June 25, 2026 15:32

重复提交的 review,保留另一条同内容的 changes requested。

@misonijnik misonijnik requested a review from Snailclimb June 25, 2026 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants