| Table of Contents |
|---|
Introduction
Kiuwan allows for a true shiflteft approach by integrating with all the main IDEs.
Kiuwan for Developers (K4D) is a plug-in for development IDEs that facilitates and automates compliance with security normatives, quality standards and best practices for several languages.
It provides the following benefits:
- Security Vulnerabilities Detection - Kiuwan for Developers allows the developers to detect and fix security vulnerabilities such as Injection (SQL, XML, OS, etc), XSS, CSRF, etc. directly integrated within their development IDEs).
- Adoption of Security and Coding Standards – Ensuring the compliance of standards (CWE, OWASP, CERT-Java/C/C++, SANS-Top25, WASC, PCI-DSS, NIST, MISRA, BIZEC, ISO/IEC 25000 and ISO/IEC 9126) by a development department can be a long and tedious task without the support of some sort of tool that will facilitate and automate this work. This plugin connects with Kiuwan and harness the power of its security models and audits to enforce security standards and policies.
- Full vulnerabilities documentation – Developers have access, right on their IDEs, to the full Kiuwan vulnerabilities documentation of any of the displayed vulnerabilities listed for the specific projects. This includes code samples on how to fix them in the same language of the project.
- Automatic Error Prevention – Coding standards are specific rules for a programming language. By implementing and monitoring compliance with these standards at the time the code is entered you can avoid errors and reduce the time and cost of debugging and testing activities.
Kiuwan for Developers monitors and reports on the security, quality and efficiency of your code at the point that it is written. This immediate feedback provides you with the opportunity to improve your code before it is delivered.
Supported IDEs and Requeriments
...
| title | Supported IDEs |
|---|
...
...
| title | Java 8 required |
|---|
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
|  |
...
...
...
...
...
...
...
...
 |
...
...
...
...
...
...
Configuration
...
...
...
...
...
...
| Steps | Image | ||
|---|---|---|---|
Find the connection settings under Windows > Preferences > Kiuwan > Connection Settings. Fill in the User and Password with those of your Kiuwan Account and click Apply and Check Credentials to validate access. In case you are using a proxy, please configure Proxy Settings.
|  |
Fill in you User and Password of your Kiuwan Account and click Check Credentials to validate access.
In case you are using a proxy, please configure Proxy Settings.
...
...
...
...
Visualization Options
Under Visualization Options you can configure:
Automatic remote defects synchronization
If checked,
...
...
...
- , the plug-in will mark those defects as "potential match".
...
...
...
...
...
...
...
...
check Enable project specific settings.
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
| title | Execution modes |
|---|
...
...
...
...
...
...
...
If your Eclipse project is NOT configured to "Build Automatically", Kiuwan will only run on-demand.
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
| Info | ||
|---|---|---|
| ||
If your Eclipse project is configured to |
...
...
...
...
...
...
is checked. |
...
...
...
...
> Kiuwan
Local defects list
...
...
...
...
...
...
...
...
...
This option will open an internal browser to display Rule Information.
...
inspect the Rule information of a defect to better understand it. (A browser will open to display the Rule Information page. You may be asked for your Kiuwan credentials.)
Vulnerabilities details (Source and Sink)
...
...
...
| title | Source and Sink |
|---|
...
...
on the > icon will open details on associated Source and Sink of the defect.
Local Analysis Configuration
...
...
...
...
...
...
...
...
...
on the 
icon of the Local Defects list.
Note: All the options unchecked are equivalent to all checked.
Configuring Defects View
Regardless of you have configured the subset of defects of K4D analysis (see above), you can further reduce the defects view by defining additional filtering conditions.
...
...
on the 
...
icon of Local Defects list.
Note: All the options unchecked are equivalent to all checked.
Server defects list
| Info |
|---|
...
...
...
- Your current source code could be different to the source code of the server (you or other might already have modified that version)
- The list of defects to be fixed will be more probably a subset of all defects found during the server analysis (more on this topic below)
In these cases, you will need to have access to server defects.
Source of Server defects list
- Last baseline analysis
- All the defects found during last complete application analysis (i.e. the Application Baseline)
- Action plan
- Defects included within an Action Plan (you can select the plan from the app's list of available action plans)
- Audit Delivery
- Defects that must be fixed so the Audit of
...
...
...
on the icon of the Server Defects list.
Note: All the options unchecked are equivalent to all checked.
Besides to configure the source of server defects, you can further filter server defects to be downloaded based on Priority, Characteristic, Language or File Pattern
| Info | ||
|---|---|---|
| ||
An important point is to set a limit for the number of defects displayed in the list. By default, it's set to 100. You can increase such limit, but performance of your Eclipse can be seriously damaged. Take care not to set that limit to a high number. |
Configuring Filters
Besides to configure source and filters, you can further reduce the server defect list by defining additional filtering conditions.
You can define view filters by clicking
...
on the icon of the Server Defects list.
Note: All the options unchecked are equivalent to all checked.
An important filter is Scope:
...
...
...
...
...
...
...
...
example, because it's a false positive or because it's a so special condition that must not be fixed). In these cases, you can use the Muted filter.
Any server defect may have an associated Life Cycle Status (To Review, Reviewed, or None). When server defects are downloaded, you can filter defects based on their status.
If you work on a to-review server defect, right-clicking on the defect you can "Mark as reviewed locally" that defect (see image below), and filter the defect list using Reviewed locally filter.
Then, that defect will be marked as "Reviewed locally"
Support and Troubleshooting
If you experience problems with the Kiuwan plugin for Eclipse, you can read Kiuwan
...
...
...
...
...
...