⚠️ Note: We are currently redesigning Codyze. We have moved most of the functionality into a subpackagelegacy. For the foreseeable future, we continue to maintain the legacy version of Codyze. OverGradually, we're replacing legacy functionality with the redesigned one. Where this approach isn't feasible due to breaking changes, we're going to offer a switch to either use the legacy version or redesigned version.
If you are looking for a stable version, please use the 2.0.0-beta release.
Codyze is a static code analyzer that focuses on verifying security compliance in source code, i.e. by inferring the correct use of cryptographic libraries. It operates on code property graphs and is thus able to handle non-compiling or even incomplete code fragments.
Documentation: https://www.codyze.io
Java 11 (OpenJDK) is a prerequisite.
To build an executable version of Codyze, use the installDist task:
$ ./gradlew installDistThis will provide you with an executable Codyze installation under build/install/codyze.
To start Codyze, change to the directory and run Codyze.
Codyze has three execution modes:
- commando line interface mode (
-c, default) - language server protocol mode (
-l) - interactive console mode (
-t).
An exemplary call to start the commando line interface mode would be
$ cd build/install/codyze
$ ./bin/codyze -m ./mark -s <sourcepath>where <sourcepath> denotes the path to the source directory or file which should be analyzed.
Codyze can be further configured with additional command line arguments or a YAML configuration file. For more information about the usage and configurations, please refer to https://www.codyze.io and the corresponding wiki page.
If you are looking for an exciting thesis project or student job in the field of static analysis, we are happy to discuss possible topics. Please contact us at codyze [at] aisec.fraunhofer.de.
We will continue to maintain this project for the foreseeable future on a best-effort basis. That is, if you run into any bugs or find the documentation insufficient, we encourage you to open issues or pull requests. If you are interested in support and development for commercial use, please contact us.