How Well Do SAST Tools Work Across Languages? An Empirical Study Using OCPP Implementations
[Kryptografia i bezpieczeństwo] Autorzy: Zachary Wadhams, Emma Sheppard, Dalton Arford i 2 więcej
As electric vehicle (EV) adoption accelerates globally, securing electric vehicle charging station (EVCS) software becomes increasingly critical. The Open Charge Point Protocol (OCPP), widely adopted for EVCS management, places significant responsibility on developers to securely implement specifications that are subject to multiple interpretations. The variety of OCPP implementations across different programming languages provides a unique opportunity to evaluate security tooling in a real-world, multi-language context where implementation variability may introduce vulnerabilities. This study provides the first empirical evaluation of Static Application Security Testing (SAST) tool performance across multiple programming languages using OCPP implementations as a real-world test corpus. We applied both comprehensive multi-language tools (SonarQube and Semgrep) and language-specific anal…
- Kategoria arxiv
- cs.CR
- Kategoria
- Kryptografia i bezpieczeństwo
- Doi
- 10.1109/CSR69374.2026.11759929