Security Scanning for GWT Code

[Niraj Salot]

Which tools can be used to Scan the GWT Source Code for doing Security Scan?

[Thomas Broyer]

What kind of security vulnerabilities are you looking for?

Of the OWASP Top 10, I think only XSS could be detected by static analysis, looking for any call to unsafe methods, making sure you're using SafeHtml et al. everywhere (and SafeHtmlUtils.fromSafeConstant and SafeHtmlUtils.fromTrustedString, and similar SafeStylesUtils and UriUtils methods, would still have to be manually inspected). I believe Google has some ErrorProne check for that (which would respect @SuppressIsSafeHtmlCastCheck et al.), but I don't think they opensourced it.

[lofid...@gmail.com]

For Java code scanning you can use anything like BlackDuck, Snyk, etc. all for Java code / libs security scanning.

GWT code is just Java code.

If you need to scan the "result" then you can scan the JavaScript result... I'm not sure whether this makes sense?