Yasca User's Guide
2 Yasca User's Guide
Table of Contents
1 INTRODUCTION TO YASCA ............................................................................................................................. 3
1.1 PURPOSE .................................................................................................................................................. 3
1.2 SCOPE ...................................................................................................................................................... 3
1.3 SYSTEM ORGANIZATION .............................................................................................................................. 4
2 INSTALLATION & USE ..................................................................................................................................... 5
2.1 FIRST-TIME USERS ...................................................................................................................................... 5
2.2 LICENSING ................................................................................................................................................ 6
2.3 INSTALLING THE SYSTEM .............................................................................................................................. 6
2.4 STARTING THE SYSTEM ................................................................................................................................ 6
2.5 STOPPING YASCA ....................................................................................................................................... 8
3 PLUGINS ......................................................................................................................................................... 9
3.1 ABOUT PLUGINS ........................................................................................................................................ 9
3.2 PLUGIN DETAILS ....................................................................................................................................... 10
3.3 WRITING YOUR OWN PLUGINS ................................................................................................................... 15
4 KNOWN ISSUES ............................................................................................................................................ 21
4.1 KNOWN BUGS ......................................................................................................................................... 21
4.2 FUTURE ENHANCEMENTS ........................................................................................................................... 21
Yasca User's Guide 3
1 Introduction to Yasca
1.1 Purpose
Yasca was created to help software developers ensure that applications are designed and developed to
meet the highest quality standards. It is related to QA testing and vulnerability scanning, but replaces
neither. Instead, Yasca can be used during development to catch much of the "low hanging fruit" that
may only be found much later in the development lifecycle. Distributed with both custom scanners and
embedded open-source tools (e.g. JLint, antiC, Lint4J, FindBugs, and PMD, Yasca is able to deliver a
relatively comprehensive analysis of scanned applications.
Yasca can be thought of as an aggregation tool "plus a little more". While the majority of detected issues
are actually found by the open-source tools, the "little more" consists of plugins written for Yacsa to
detect issues that the other tools did not scan for.
The philosophy behind Yasca is that developers should have access to a suite of tools to enable them to
better develop secure software. Since much work has been done in this area in the form of disparate
products performing similar functions, it was important to aggregate the results back in a simple, easy-
to-use tool.
1.2 Scope
This guide is meant to be both a user manual and a developer guide for extending Yasca. It does not
contain detailed information on any of the embedded tools that accompany Yasca. (This information
resides in the docs directory.)
4 Yasca User's Guide
1.3 System Organization
Yasca is distributed as a lightweight, "no-install" desktop application. Most components are written in an
included minimal distribution of PHP v5.2.5. As with all products embedded in Yasca, future distributions
will attempt to include the latest stable release.
Logically, Yasca consists of a basic front-end, a set of scanning plugins and report renderers, and an
engine to tie them all together.
Yasca has two front-ends available: a command line interface and a Windows GUI. Each can be used to
start Yasca, but the command line interface has considerably more options available and offers better
performance.
All plugins reside in the plugins directory. Three plugins are included in Yasca that have external
dependencies. The first is JLint, which scans Java .class files, and requires the jlint.exe file to be available
in the resource/utility directory. The second is antiC, which scans Java and C/C++ source code, and also
requires the antic.exe file to be available in the resource/utility directory. The third is PMD, which
partially compiles Java source code and scans the resulting abstract syntax tree. PMD requires Java JRE
1.4 or later. If any of these dependencies cannot be located, Yasca will issue a warning but will continue
scanning with other plugins.
The output of Yasca is a file created by a specific report renderer. Yasca currently has renderers for rich
HTML, XML, and CSV formats.
The Yasca engine, which ties the other components together, is embedded in distributed binaries. It is
not meant to be modified except as part of a subsequent release. (This differs from plugins, which are
meant to be modified as needed.)
Yasca User's Guide 5
2 Installation & Use
2.1 First-time Users
Before using Yasca, be sure your system meets the following prerequisites:
Microsoft Windows 2000 or later**
Java JRE (or JDK) v1.4 or later (required for PMD)
At least 512 MB RAM (1+ GB suggested)
Note: Yasca was not tested on a wide range of environments, so if you run into
trouble, please let us know.
Two methods of using Yasca are available: local installation and network installation.
2.1.1 Local Installation
Step 1: Download the Yasca binary from http://yasca.org/ and install it to a directory of your choice.
Step 2: Test the installation by running the following command:
(Unix) yasca ./resources/test/
(Windows) yasca resources\test
Step 3: Check the new file created on your desktop in the Yasca folder (Yasca-Report-NNNNNNNN-
NNNN.html). It should contain findings from the test.
2.1.2 Shell Installation
You can integrate Yasca into the Windows Explorer shell by running the etc/yasca.reg registry file.
The yasca.reg file is set up to look for Yasca at the following location:
