How can I run only defined detectors in find-sec-bugs

Question

I'd like to run a findsecbugs scan (CLI version) against multiple jar and I only want it to check for issues related to bad usage of crypto functions (like using md5). How can I tell findsecbugs to only use detectors defined by me?

Thank you!

Answer 1

The CLI is wrapping SpotBugs official CLI. All SpotBugs options will be available in the FindSecurityBugs CLI. You can use the -include parameter to define a filter file. Filter files can be used to define which detector or class should be considered.

findsecbugs.sh -include include.xml [...]

Other references:

1. https://github.com/find-sec-bugs/find-sec-bugs/wiki/CLI-Tutorial
2. https://github.com/find-sec-bugs/find-sec-bugs/wiki/Maven-configuration