Zarn is a static application security testing tool aimed specifically at modern Perl codebases. Its purpose is to identify source constructs that may expose an application to security weaknesses rather than enforce formatting conventions or general coding style.
The analyser parses each source file into an abstract syntax tree, searches for potentially dangerous tokens, and applies taint tracking to determine whether a finding may actually be exploitable. This gives Zarn a more security-focused role than a conventional Perl linter.
Analysis currently operates within a single-file context. Vulnerabilities whose relevant call path or data flow crosses several files can therefore escape detection. Call-graph analysis is identified as a future development direction.
Zarn can generate SARIF output, allowing results to be consumed by tools supporting the Static Analysis Results Interchange Format.
This is free and open source software.
Key Features
- Uses configurable YAML rule files.
- Rules can test for the presence or absence of specified constructs.
- Includes checks for code injection and path traversal patterns.
- Flags weak cryptographic algorithms and weak random-number generation.
- Can identify missing strict and warnings declarations.
- Classifies findings as informational messages, warnings or vulnerabilities.
- Can run as part of GitHub Actions workflows.
- Supports integration with GitHub code scanning.
Website: github.com/htrgouvea/zarn
Support:
Developer: Heitor Gouvêa
License: MIT License
Zarn is written in Perl. Learn Perl with our recommended free books and free tutorials.
Related Software
| Perl Linters | |
|---|---|
| Perl::Critic | Extensible framework for creating and applying coding standards |
| Perltidy | Indents and reformats Perl scripts |
Read our verdict in the software roundup.
 Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category.This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form. |
Please read our Comment Policy before commenting.