Here are some security relevant VI analyzer tests. Rather than deeming whether a VI is safe or not, it just detects whether the functions are used or not and marks the test as a failure if used. That is meant to force the inspector to manually inspect the code. For example, if a transmission protocol such as Bluetooth, UDP, TCP, datasockets, etc are used, then it will mark as a failure making sure that someone manually inspects the code to ensure that either the data being transmitted is non-sensitive or that encryption/decryption is being applied outside of those functions.
For the Hardcoded DB Credentials test, it checks if constants are connected to the username and password fields and marks them as a failure if they are there.
For the OS Injection test, it checks if a constant is wired to command line input on system exec. If it does, it marks it as a pass. If not, that means it's either a control (could be passed in as a subvi) or is being manipulated through string manipulation functions, in which case it is asked that you manually inspect to ensure that an OS injection cannot occur or that inputs are properly being sanitized/checked.
In our use case, we are not using the VI analyzer UI to run these tests. We have a seperate static security testing GUI we've created, that runs only certain security VI analyzer tests. From here, we can run these and see which VIs fail. From the GUI, we can then just open up the VI in question. Lastly, we can certify that the code meets certain security requirements and rather than outputting the VI analyzer results, we are generating our own results programmatically. That way we don't report a whole ton of failures when there aren't actually security issues.
Feel free to modify these tests to suit your own needs as well.
