## Overview This epic tracks the addition of **Kotlin**, **Dart**, and **Scala** to Advanced SAST using GitLab's new Software Factory architecture (SAT). These three languages represent a significant expansion of Advanced SAST's taint-aware analysis coverage, and are delivered using the same shared engine, framework detection, and rule-authoring infrastructure introduced by the software factory approach. ## What we're shipping in 19.4 ### Kotlin / Android (gitlab-org/gitlab#616302) First-wave detection rules for Kotlin and Android apps, covering the most impactful vulnerability classes: - **CWE-749** — Unsafe WebView load and dangerous WebView settings - **CWE-89** — SQL injection via `rawQuery` / `execSQL` - **CWE-78** — OS command injection via `Runtime.exec` / `ProcessBuilder` - **CWE-798** — Hardcoded credentials and keys - **CWE-79** — WebView XSS - **CWE-295** — Improper certificate validation (custom `TrustManager`, `HostnameVerifier`) - **CWE-312/522/922** — Cleartext storage in `SharedPreferences` / files - **CWE-327/328/916** — Weak/broken cryptography (MD5, ECB, unsalted hash) - **CWE-532** — Sensitive data logged via `Log.d` ### Dart / Flutter / Dio (static-analysis-toolkit#62) Full Dart language front-end and Flutter/Dio framework detection: - Tree-sitter Dart grammar, CAST normalizer, and `package:` / relative import resolver - Framework detection from `pubspec.yaml` / `pubspec.lock` - Detection rules: SSRF (CWE-918, cross-file Dio flow), path traversal (CWE-22), command injection (CWE-78), insecure random key (CWE-330), static IV (CWE-329), Dio cleartext transmission (CWE-319) - End-to-end verified against DVFA and flutter-dio-example with source→sink code flows ### Scala + Akka / Play / Slick (static-analysis-toolkit#63) Full Scala language front-end and Akka/Play/Slick framework detection: - Tree-sitter Scala grammar, CAST normalizer (objects/classes/traits/defs, string interpolation), import resolver - Framework detection from `build.sbt` / `project/*.scala` - Detection rules across Play (SQL injection CWE-89, SSRF CWE-918, open redirect CWE-601, path traversal CWE-22, command injection CWE-78, XSS CWE-79), Slick (SQL injection via unsafe `#$` splicing), and Akka (SSRF CWE-918) - End-to-end verified against play-webgoat with source→sink code flows ## Software Factory architecture All three languages are delivered through the GLASEXT engine's shared infrastructure ## Milestone 19.4 (due 2026-09-11) ## Child work items - [Kotlin/Android detection rules](https://gitlab.com/gitlab-org/gitlab/-/work_items/616302) — gitlab-org/gitlab#616302 - [Dart / Flutter / Dio language and framework support](https://gitlab.com/gitlab-org/security-products/analyzers/static-analysis-toolkit/-/work_items/62) — static-analysis-toolkit#62 - [Scala + Akka / Play / Slick support](https://gitlab.com/gitlab-org/security-products/analyzers/static-analysis-toolkit/-/work_items/63) — static-analysis-toolkit#63