Prerequisites
Learn which languages, frameworks, and libraries JFrog SAST supports.
Language Support
The following table lists the languages, frameworks, and libraries that JFrog SAST supports.
| Language | Supported Frameworks | Supported Libraries | Not Supported | Notes |
|---|---|---|---|---|
| C / C++ | Pistache, Wt, Qt, MFC | SQLite3, MySQL C API, libpq, ODBC, mysqlpp, libpqxx, Boost, OpenSSL, Crypto++, Libgcrypt, pugixml, RapidJSON, nlohmann/json, TinyXML2, yaml-cpp, protobuf, FlatBuffers, Cap'n Proto, cereal | None | None |
| C# / .NET | ASP.NET Core, ASP.NET MVC, ASP.NET Web Forms, Nancy, ServiceStack, Blazor | Entity Framework, Dapper, NHibernate, PetaPoco, Microsoft AntiXss, Razor, Telerik UI, Infragistics, ComponentArt, log4net, NLog, Serilog, Microsoft.Extensions.Logging | Legacy ASPX templates only | None |
| Golang | Gin, Echo, Chi, Gorilla Mux, Beego, fasthttp, grpc | GORM, sqlx, pgx, go-sql-driver, go-redis, gocql, mongo-go-driver, viper | html/template has no taint-tracking support | None |
| Java | Spring Framework, JAX-RS, Micronaut, Struts, Vaadin, Wicket, Grails, Seam, Atmosphere | Hibernate, JPA, MyBatis, OWASP ESAPI, Apache Commons, Thymeleaf, FreeMarker, Velocity, JSP templating | Standalone legacy JSP | None |
| JavaScript | Express.js, Koa, Fastify, NestJS | mysql / mysql2, pg, mongodb, sequelize, knex, sqlite3, redis, axios, node-fetch, request, needle, ws, DOMPurify, escape-html, xss, sanitize-html, validator, lodash, Handlebars, EJS, Pug, Mustache, multiparty, formidable, unified, path-sanitizer, sanitize-filename, sqlstring | JSX | None |
| Kotlin | Android (SDK / AndroidX), Spring, Ktor, Servlet, Exposed ORM, Javalin, http4k | Kotlin stdlib, kotlinx.serialization, kotlinx.coroutines, Jackson, Gson, Moshi, Retrofit, OkHttp, Room / SupportSQLite, BouncyCastle | Jetpack Compose, SQLDelight, Firebase, Micronaut, Quarkus, Vert.x, Coil/Glide | Also covers calls to Java and JVM APIs modeled for Java, for example Hibernate, MongoDB, Netty, and Apache libraries |
| PHP | Laravel, Symfony, CodeIgniter, Yii2, WordPress | Guzzle, PDO | None | None |
| Python | Flask, Django, FastAPI | SQLAlchemy, psycopg2, MySQLdb, mysql.connector, pymongo, requests, bleach, tkinter, pandas, numpy | Python 1.x, 2.x | None |
| Rust | Actix-web, Rocket, Axum, Warp, Tide, Poem, Salvo, Hyper, Iron | Diesel, SQLx, tokio-postgres, rusqlite, mysql, mongodb, redis, tiberius, reqwest, hyper, surf, ureq, isahc, attohttpc, tokio, async-std, futures, serde_json, serde_yaml, bincode, postcard, rmp-serde, askama, tera, handlebars, maud, sailfish, liquid, minijinja, yarte, ammonia, base64, hex, clap, structopt, rdkafka, lapin, nats, tonic | None | None |
| TypeScript | Express.js, Koa, Fastify, NestJS | Same as JavaScript libraries | TSX | Same frameworks and libraries as JavaScript |
Analysis Capabilities
JFrog SAST understands dependencies in the code, such as call flow, type propagation, and constants, in the full project context.
- Cross-functional
- Cross-file
- Cross-module
Custom Query Capabilities
Note
This feature is in beta and is subject to change.
You can construct code queries of unlimited complexity based on types, constants, external API names, data reachability, and control flow dependencies. Custom queries are in beta and are subject to change.
Related Topics
Updated 9 days ago
Did this page help you?