GLITCH is a technology-agnostic framework that enables automated detection of IaC smells. GLITCH allows polyglot smell detection by transforming IaC scripts into an intermediate representation, on which different smell detectors can be defined. GLITCH currently supports the detection of nine different security smells [1, 2] and nine design & implementation smells [3] in scripts written in Puppet, Ansible, or Chef.
"GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code" is the main paper that describes the implementation of security smells in GLITCH. It also presents a large-scale empirical study that analyzes security smells on three large datasets containing 196,755 IaC scripts and 12,281,251 LOC.
If you use GLITCH or any of its datasets, please cite:
- Nuno Saavedra and João F. Ferreira. 2022. GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code. In 37th IEEE/ACM International Conference on Automated Software Engineering (ASE ’22), October 10–14, 2022, Rochester, MI, USA. ACM, New York NY, USA, 12 pages. https://doi.org/10.1145/3551349.3556945
@inproceedings{saavedraferreira22glitch,
title={{GLITCH}: Automated Polyglot Security Smell Detection in Infrastructure as Code},
author={Saavedra, Nuno and Ferreira, Jo{\~a}o F},
booktitle={Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering},
year={2022}
}
- Nuno Saavedra, João Gonçalves, Miguel Henriques, João F. Ferreira, Alexandra Mendes. 2023. Polyglot Code Smell Detection for Infrastructure as Code with GLITCH. In 38th IEEE/ACM International Conference on Automated Software Engineering (ASE '23), September 11-15, 2023, Luxembourg. https://doi.org/10.1109/ASE56229.2023.00162
@inproceedings{saavedra23glitchdemo,
author={Saavedra, Nuno and Gonçalves, João and Henriques, Miguel and Ferreira, João F. and Mendes, Alexandra},
booktitle={2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE)},
title={Polyglot Code Smell Detection for Infrastructure as Code with GLITCH},
year={2023},
pages={2042-2045},
doi={10.1109/ASE56229.2023.00162}
}
To install run:
python -m pip install -e .
To use the tool for Chef you also need Ruby and its Ripper package installed.
To install GLITCH using Poetry, run:
poetry install
WARNING: For now, the GLITCH VSCode extension does not function if GLITCH is installed via Poetry. Since Poetry uses virtual environments it does not create a binary for GLITCH available in the user's PATH, which is required for the VSCode extension.
To explore all available options, use the command:
glitch --help
To analyze a file or folder and retrieve CSV results, use the following command:
glitch --tech (chef|puppet|ansible|terraform) --csv --config PATH_TO_CONFIG PATH_TO_FILE_OR_FOLDER
If you want to consider the module structure you can add the flag --module.
If GLITCH was installed using Poetry, execute GLITCH commands as follows:
poetry run glitch --help
Alternatively, you can use poetry shell:
poetry shell
glitch --help
To run the tests for GLITCH go to the folder glitch and run:
python -m unittest discover tests
New configs can be created with the same structure as the ones found in the folder configs.
More information can be found in GLITCH's documentation.
GLITCH has a Visual Studio Code extension which is available here.
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
Please make sure to update tests as appropriate.
[1] Rahman, A., Parnin, C., & Williams, L. (2019, May). The seven sins: Security smells in infrastructure as code scripts. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) (pp. 164-175). IEEE.
[2] Rahman, A., Rahman, M. R., Parnin, C., & Williams, L. (2021). Security smells in ansible and chef scripts: A replication study. ACM Transactions on Software Engineering and Methodology (TOSEM), 30(1), 1-31.
[3] Schwarz, J., Steffens, A., & Lichter, H. (2018, September). Code smells in infrastructure as code. In 2018 11th International Conference on the Quality of Information and Communications Technology (QUATIC) (pp. 220-228). IEEE.