Yasca > Documentation > Creating a Plugin

So you've downloaded and installed Yasca, and like the results, but you want it to write your own plugin. This tutorial will show you how easy it is to do.

First, you should understand how Yasca is designed. Yasca is basically a file scanning engine with the ability to run plug-ins that find interesting things in those files and report the results back to the engine for inclusion into the report. Everything that goes into a report comes from a plugin. (Yasca can do nothing without them.)

Yasca comes with a number of plug-ins by default, including FindBugs, PMD, Jlint, and Grep. The first three are external tools that are maintained by others, but included because I think they provide great information. I wrote the Grep plugin to make it easy to create simple rules that only require regular expression matching. In the first part of this tutorial, we'll create a new Grep plugin to search for something interesting.

Writing a New Grep Plugin

Writing a Grep plug-in requires you to have a few pieces of information (and a few more optional pieces):

• the regular expression to search for
• the file extensions that you want to scan
• the name and category you want findings to be given

Let's suppose you want to search for social security numbers within a code base. Create a new file called SocialSecurityNumber.grep. The base name of the file is not important, but the extension (.grep) is. The Grep plugin actually scans for .grep files in the plug-in directory and uses each of them. Here's the contents of SocialSecurityNumber.grep:

Using the value JAVA for the file_type attribute actually expands the extension out to a set known to be common for Java files, such as .java, .jsp, .jsw, and others. The full list is located in the lib/plugin.php file.

Additional parameters are also available, including:

• category_link - a URL containing more information about this particular plug-in
• severity - the severity (1=critical down to 5=informative)
• description - a multi-line description of the plug-in, ending with a line containing only the string “END;”

For example, consider the a slightly modified version of the Formatting.MissingAMPM.grep plugin:

You can also specify multiple grep patterns, which are logically "ORed" during evaluation.

Place the file you created in the plugins directory and start Yasca. The Grep plugin will automatically find all .grep files within the plugins directory and use them.