Application Security Automation
Clone or download
fmscorreia and omerlh Fix retirejs task (#143)
* Fix retirejs task

* Undo change in retirejs.rb

* Add test for js file containing components without vulnerabilities
Latest commit d3fade9 Dec 13, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github Disable stale bot closing issues May 9, 2018
bin severity_threshold Apr 25, 2017
docker Merge branch 'master' into master May 9, 2018
docs added zap pattern for dynamic task (#130) Sep 3, 2018
integrations Add start of Glue for Jenkins pipeline. Feb 19, 2017
lib Fix retirejs task (#143) Dec 13, 2018
spec Fix retirejs task (#143) Dec 13, 2018
.gitignore Merge branch 'master' into master May 9, 2018
.rspec dummy Mar 22, 2018
.ruby-version Update Ruby and remove a type. Sep 9, 2016
.rvmrc Add default rvm settings. Sep 15, 2016
.travis.yml fix - use proper docker tag Jul 4, 2018
Apache2_License.html License and minor cleanup. Jul 21, 2015
CHANGES Start working on cleanup for 0.9.3 release. Add error handling. Testi… Jan 15, 2017 Added link to CodeBurner (#140) Oct 25, 2018 Fix Docker image name in docs, Minor copy edit Jan 17, 2017
FEATURES Working docker impl. Dec 5, 2014
Gemfile added the dynamic task Jun 4, 2018
Gemfile.lock added the dynamic task Jun 4, 2018 Added Slack reporter Jul 24, 2017 Added to demonstrate Glue's features Apr 22, 2018 fix badges to point to right links and add travis badge May 10, 2018
Rakefile Start setting up tests. Sep 15, 2016 Refactor retirejs.rb Oct 14, 2017
config.yml.example Example cleanup. Jan 14, 2017
glue.gemspec added the dynamic task Jun 4, 2018
glue.png Update logo. Sep 15, 2016

Twitter Ruby Gem Dockerhub Travis


Glue is a framework for running a series of tools. Generally, it is intended as a backbone for automating a security analysis pipeline of tools.

Recommended Usage

For those wishing to run Glue, we recommend using the docker image because it should have the other tools it uses available already and configured. See the documentation for more info. Glue Docker Documentation

For those interested in how to use Glue in a DevOps context, see Glue DevOps Integration Options

Checkout the Playground to get a better understanding of Glue's features and how you can use them.

Local run

docker run owasp/glue

Installation for Development

git clone
cd glue                     -- RVM will set to 2.3.1 with Gemset Glue
gem install bundler
bundle install

Running in Development

cd lib
../bin/glue -h

Extending Glue

Glue is intended to be extended through added "tasks". To add a new tool, copy an existing task and tweak to make it work for the tool in question.


Glue <options> <target>


Common options include:

-d for debug
-f for format (takes "json", "csv", "jira")

For a full list of options, use Glue --help or see the file.


The target can be:

  • Filesystem (which is analyzed in place)
  • Git repo (which is cloned for analysis)
  • Other types of images (.iso, docker, etc. are experimental)


  • clamav
  • hashdeep
  • rm (*nix)
  • git
  • mount (*nix)
  • docker


To run the code, run the following from the root directory:

>ruby bin/Glue <options> target

To build a gem, just run:

gem build Glue.gemspec


Git Hooks

First, grab the hook from the code.

meditation:hooks mk$ cp /area53/owasp/Glue/hooks/pre-commit .

Then make it executable.

meditation:hooks mk$ chmod +x pre-commit

Make sure the shell you are committing in can see docker.

meditation:hooks mk$ eval "$(docker-machine env default)"

Now go test and make a change and commit a file. The result should be that Glue runs against your code and will not allow commits unless the results are clean. (Which is not necessarily a reasonable expectation)

Configuration files

For advanced usage scenarios, you can save your configuration and use it at runtime.


Matt Konda Alex Lock Rafa Perez


Apache 2: