ASP SQL Injection Source Code Analysis (CTP)

Microsoft Downloads - Microsoft Source Code Analyzer for SQL Injection

“Community Technology Preview (June 2008)

Microsoft Source Code Analyzer for SQL Injection is a static code analysis tool for finding SQL Injection vulnerabilities in ASP code. Customers can run the tool on their ASP source code to help identify code paths that are vulnerable to SQL Injection attacks.

…

In response to the recent mass SQL injection attacks, Microsoft has developed a new static code analysis tool for finding SQL Injection vulnerabilities in ASP code. Web developers can run the tool on their ASP source code to identify the root cause of the attack and address them to reduce their exposure to future attacks. The tool will scan ASP source code and generate warnings related to first order and second order SQL Injection vulnerabilities. The tool also provides annotation support that can be used to improve the analysis of the code.

…”

Nice. I like that MS is stepping up and working to help us, developers, in this area. I don’t do much (cough… any…) ASP development these days, but I still thought this might be useful to note

Of course I can’t be satisfied with just this, but also want the same/like source analysis for C#/VB projects too. Maybe given the name, we’ll get this in the future… ;)

Note: This appears to be a Classic ASP focused tool...