Home
Extending product function
Learn how to extend the product.
Customizing the vulnerability database and pattern rules
This section describes how to customize the database and integrate customized vulnerabilities and other routines into scans.
Customizing with pattern-based rules
AppScan® Source pattern-based scanning is an analysis of your source code based on customized search criteria. Pattern-based scanning is similar to grep (grep searches one or more files for a given character string or pattern). Auditors or security analysts performing triage might use pattern-based scanning to search for specific patterns in specific applications or in a project. Once you define a pattern as a vulnerability type, a scan of your source code identifies the pattern as a vulnerability. When AppScan Source finds a match, the item appears in the findings table. The out-of-the-box AppScan Source rule library includes predefined rules and rule sets (collections of rules).
Pattern rules
AppScan® Source text rules can be Extended Global Regular Expressions Print (egrep), Global Regular Expressions (grep), or Perl regular expressions. These regular expressions (expressions that have string values that use the complete set of alphanumeric and special characters) match the rules.

Welcome
Welcome to the documentation for HCL® AppScan® Source.
Introduction to HCL® AppScan® Source
HCL® AppScan® Source delivers maximum value to every user in your organization who plays a role in software security. Whether a security analyst, quality assurance professional, developer, or executive, the AppScan Source products deliver the functionality, flexibility, and power you need - right to your desktop.
What's New in AppScan® Source
Explore these new features that have been added to AppScan® Source - and note any features and capabilities that have been deprecated in this release.
Installing
Learn how to install the product.
Configuring
Learn how to configure the product.
Administering
Learn how to administer the product.
Developing
Learn how to develop by using the product.
Extending product function
Learn how to extend the product.
- Customizing the vulnerability database and pattern rules
  This section describes how to customize the database and integrate customized vulnerabilities and other routines into scans.
  - Extending the AppScan® Source Security Knowledgebase
    This section describes how to customize the database and integrate customized vulnerabilities and other routines into scans. Custom rules tailor the AppScan® Source Security Knowledgebase (or vulnerability database) to your specific security standards and apply those standards consistently across your enterprise.
  - Customizing input/output tracing through AppScan® Source trace
    Some applications (particularly web applications) require input/output tracing to identify security vulnerabilities related to SQL injection, command injection, and cross-site scripting. Through AppScan® Source trace, you can specify a validation routine that, if used, eliminates the reporting of any vulnerability. All other outputs are marked as vulnerabilities if input has not been validated.
  - Customizing with pattern-based rules
    AppScan® Source pattern-based scanning is an analysis of your source code based on customized search criteria. Pattern-based scanning is similar to grep (grep searches one or more files for a given character string or pattern). Auditors or security analysts performing triage might use pattern-based scanning to search for specific patterns in specific applications or in a project. Once you define a pattern as a vulnerability type, a scan of your source code identifies the pattern as a vulnerability. When AppScan Source finds a match, the item appears in the findings table. The out-of-the-box AppScan Source rule library includes predefined rules and rule sets (collections of rules).
    - Pattern rule sets
      A pattern rule set is a collection of pattern rules. You can add new pattern rule sets or you can modify or remove existing ones. AppScan® Source provides a series of language-specific pattern rule sets that you can choose to apply to your projects or applications (for example, you may want to apply the Java pattern rule set to your Java/JSP projects).
    - Pattern rules
      AppScan® Source text rules can be Extended Global Regular Expressions Print (egrep), Global Regular Expressions (grep), or Perl regular expressions. These regular expressions (expressions that have string values that use the complete set of alphanumeric and special characters) match the rules.
      - Searching for text patterns
        Within a given source file, pattern-based scanning searches for text patterns in files by extension, allowing the search to exist in source files, XML configuration files, and other text files.
      - Creating a pattern rule
        Rules can be created in the Pattern Rule Library view, the Properties view for a project or application, or in a scan configuration.
      - Modifying and removing pattern rules
        Pattern rules that you have created can be modified and removed in the Pattern Rule Library view.
    - Applying pattern rules and rule sets
      Rules and rule sets are applied at the application or project level in the Properties view - or in a scan configuration. After you scan applications or projects with applied rules - or use a scan configuration that includes rules - the results of the rule search appear in the views that contain findings.
    - Pattern Rule Library view
      Pattern-based scanning is an analysis of your source code based on customized search criteria. The Pattern Rule Library view allows you to view existing pattern-based rules, by language (including the out-of-the-box AppScan® Source pattern rule library). In addition, the view allows you to add rules and patterns for pattern-based scanning.
- Extending the application server import framework
  AppScan® Source allows you to import Java™ applications from Apache Tomcat and WebSphere® Application Server Liberty profile. You can import Java applications from other application servers by extending the application server import framework, as explained in this topic.
- HCL® AppScan® Source for Development (Eclipse Plug-in)
  With AppScan® Source for Development, you can work in your existing development environment and perform security vulnerability analysis on Java and IBM® MobileFirst Platform projects. Security analysis lets you pinpoint vulnerabilities in the source code and eliminate them entirely with AppScan Source Security Knowledgebase remediation assistance.
Reference
Review reference information for the product.
Troubleshooting and support
There are a number of self-help information resources and tools to help you troubleshoot problems.

Pattern rules

AppScan® Source text rules can be Extended Global Regular Expressions Print (egrep), Global Regular Expressions (grep), or Perl regular expressions. These regular expressions (expressions that have string values that use the complete set of alphanumeric and special characters) match the rules.


Character	Description
`^`	Starts with
`$`	Ends with
`\n`, `\t`, or `\r`	Literal newline, tab, return
`[xyz]`	Any characters listed
`[^abx]`	Any characters except those listed
`[a-fA-F0-9]`	Any hex character
`.`	Any character
`\|`	Either
`\`	Cancel special character meaning `\$ \^ \\ \?`

Pattern rules are stored in a global pattern rule library (in the AppScan® Source Database) and may be shared across projects and applications. Rules and rule sets can also be shared by all users. Rules are added by reference, which you can disable by removing the reference in the associated object without deleting the underlying rule.

You create rules in the Pattern Rule Library view, the Properties tab of the Explorer view, or in a scan configuration. When you install AppScan® Source, the Pattern Rule Library view displays AppScan® Source-provided rules. In this view, you can edit, delete, or create a rule.

Pattern Rule Library view

Important: You can add or remove search criteria, but each pattern-based rule must have at least one search criteria.