Skip to content

docs: add OpenTaint (taint-analysis SAST) under a new "Code Security" section#2876

Open
misonijnik wants to merge 2 commits into
Snailclimb:mainfrom
misonijnik:docs/add-opentaint-security-tool
Open

docs: add OpenTaint (taint-analysis SAST) under a new "Code Security" section#2876
misonijnik wants to merge 2 commits into
Snailclimb:mainfrom
misonijnik:docs/add-opentaint-security-tool

Conversation

@misonijnik

@misonijnik misonijnik commented Jun 16, 2026

Copy link
Copy Markdown

What

Add a 代码安全 (Code Security) section to docs/open-source-project/tools.md listing OpenTaint — an open-source taint-analysis (SAST) engine for Java / Kotlin / Spring Boot.

It's placed right after 代码质量: same "run-against-your-code" tooling, but focused on security vulnerabilities rather than code quality, so a separate category keeps it easy to find.

Why OpenTaint

  • On-topic — targets Java / Kotlin / Spring Boot
  • Bytecode-level inter-procedural dataflow; detects 20+ vuln classes (SQLi, XSS, SSRF, command injection, etc.)
  • Models Spring DI, singleton bean state, and JPA flows that file-by-file matchers miss
  • Fully open source (engine is Apache 2.0, CLI and rules are MIT)

The entry links to the Chinese README, the official site, and two deep-dive posts (Spring analysis and LLM-agent with taint workflow).

Note for reviewers

The copy was drafted with Claude Opus 4.8 — please review the wording and improve any phrasing that reads unnaturally.

@Snailclimb

Copy link
Copy Markdown
Owner

感谢补充,这个工具方向可以考虑,但当前文案太长且偏推广,和这个页面“一行简介”的风格不一致,所以先不直接合入。

建议改成:

  • 保留 GitHub 或官网链接即可,列表项里不要堆多个博客链接。
  • 去掉“AI 时代”“相比传统工具”“更深层次”等主观/营销表达。
  • 压缩成 1 句中性描述。

可以改成类似:

  • OpenTaint:面向 Java、Kotlin 和 Spring Boot 应用的开源污点分析/SAST 工具,可用于检测 SQL 注入、XSS、SSRF 等安全风险。

@Snailclimb Snailclimb left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

感谢补充,方向可以考虑,但当前文案和该页面“一行简介”的风格不一致,先不合入。

请按上面的建议压缩为 1 句中性描述,去掉推广表达和额外博客链接后再更新。

@Snailclimb Snailclimb left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

感谢补充,方向可以考虑,但当前文案和该页面“一行简介”的风格不一致,先不合入。

请按上面的建议压缩为 1 句中性描述,去掉推广表达和额外博客链接后再更新。

@Snailclimb Snailclimb dismissed their stale review June 25, 2026 15:32

重复提交的 review,保留另一条同内容的 changes requested。

@misonijnik misonijnik requested a review from Snailclimb June 25, 2026 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants