I've tried this Zarn on a non-trivial codebase at $work, and I'm sorry, but in its present form it is worse than useless.

First, it only reports the file name and the purported "vulnerability", but no context, not even a line number.

Second, it seems to flags most files, some even multiple times with "Path Traversal" or "Code Injection". It doesn't tell what these are, but looking at the default.yaml rules file (the only one that has actual content):

  - id: '0002'
    category: vuln
    name: Code Injection
    message: 
    sample:
      - system
      - eval
      - exec
  - id: '0003'
    category: vuln
    name: Path Traversal
    message: 
    sample:
      - open
[download]

it appears that it flags every single occurrence of these keywords as a vulnerability, which is ridiculous. An open() with a known, static filename is not a path traversal vulnerability, nor is a block eval (to catch exceptions) a code injection.

Discipulus, thanks for asking this ... made me realise I didn't have anything on this important topic at my List of Security References ... so, after a quick google, I've just added a new "Static Program Analysis" section there, starting with your node of course, along with:

• Perl::Critic Policy Themes (see policies that relate to security issues)
• CERN Computer Security Information: Perl::Critic
• CERN Computer Security Information: RATS
• Perl Critic distributions and policies (perlmaven)

The only static code analysis tool I've personally used on Perl code is the most excellent Perl::Critic, though I don't recall using it for Security analysis.

Further cool references on static code security analysis welcome.