@codacy/tools-flawfinder-2 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +77 -0
- package/dist/index.d.ts +5 -0
- package/dist/index.js +2166 -0
- package/package.json +31 -0
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Codacy
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
ADDED
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
# @codacy/tools-flawfinder-2
|
|
2
|
+
|
|
3
|
+
## Table of Contents
|
|
4
|
+
- [Overview](#overview)
|
|
5
|
+
- [Updating patterns](#updating-patterns)
|
|
6
|
+
- [Updating the Flawfinder version](#updating-the-flawfinder-version)
|
|
7
|
+
- [Development](#development)
|
|
8
|
+
- [Notes for maintainers](#notes-for-maintainers)
|
|
9
|
+
|
|
10
|
+
---
|
|
11
|
+
|
|
12
|
+
## Overview
|
|
13
|
+
|
|
14
|
+
C/C++ security scanner using the [Flawfinder](https://dwheeler.com/flawfinder/) Python script. Uses the CLI execution strategy -- spawns `flawfinder` via `spawnTool()` and parses its SARIF JSON output.
|
|
15
|
+
|
|
16
|
+
| Property | Value |
|
|
17
|
+
|----------|-------|
|
|
18
|
+
| Tool ID | `flawfinder` |
|
|
19
|
+
| Codacy UUID | `81806a42-1d70-40e6-ad07-9a1a9da9e500` |
|
|
20
|
+
| Strategy | CLI |
|
|
21
|
+
| Languages | C, CPP |
|
|
22
|
+
| Binary | `flawfinder` (Python script) |
|
|
23
|
+
| File patterns | `**/*.c`, `**/*.h`, `**/*.cpp`, `**/*.cc`, `**/*.cxx`, `**/*.hpp` |
|
|
24
|
+
| Pattern count | ~222 |
|
|
25
|
+
| Prerequisites | Python >= 3.8.0 |
|
|
26
|
+
|
|
27
|
+
## Updating patterns
|
|
28
|
+
|
|
29
|
+
```bash
|
|
30
|
+
# Re-fetch pattern metadata from the Codacy API
|
|
31
|
+
pnpm prefetch
|
|
32
|
+
|
|
33
|
+
# Commit the result
|
|
34
|
+
git add src/patterns.json
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
Pattern IDs follow the format `flawfinder_strcpy`, `flawfinder_gets`, etc.
|
|
38
|
+
|
|
39
|
+
## Updating the Flawfinder version
|
|
40
|
+
|
|
41
|
+
1. Update `preferredVersion` in `src/adapter.ts`
|
|
42
|
+
2. Update the `PIP_PACKAGE` constant version pin in `src/adapter.ts`
|
|
43
|
+
3. Run `pnpm prefetch` to check for new/removed rules
|
|
44
|
+
4. Run `pnpm test` to verify compatibility
|
|
45
|
+
5. If the major version changes, create a new adapter package (`flawfinder-3/`)
|
|
46
|
+
|
|
47
|
+
## Development
|
|
48
|
+
|
|
49
|
+
```bash
|
|
50
|
+
pnpm build # Build with tsup
|
|
51
|
+
pnpm test # Run tests (requires flawfinder in PATH or venv)
|
|
52
|
+
```
|
|
53
|
+
|
|
54
|
+
**Installing flawfinder** -- the adapter can auto-install via `pip install` into an isolated venv, or you can install manually:
|
|
55
|
+
|
|
56
|
+
```bash
|
|
57
|
+
# Via pip (recommended)
|
|
58
|
+
pip install flawfinder==2.0.19
|
|
59
|
+
|
|
60
|
+
# macOS
|
|
61
|
+
brew install flawfinder
|
|
62
|
+
|
|
63
|
+
# Ubuntu/Debian
|
|
64
|
+
apt-get install flawfinder
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
## Notes for maintainers
|
|
68
|
+
|
|
69
|
+
- Flawfinder is a pure Python script with no compiled dependencies beyond the standard library.
|
|
70
|
+
- Installation uses an isolated venv at `~/.codacy/runtimes/flawfinder/venv/` to avoid polluting the system Python.
|
|
71
|
+
- The adapter uses `--sarif` for SARIF v2.1.0 JSON output and `--falsepositive` to exclude likely false positives (matching the legacy Codacy wrapper behavior).
|
|
72
|
+
- Flawfinder has **no configuration file** -- all options are CLI flags. `checkLocalConfigurationFile` always returns `{ found: false }`.
|
|
73
|
+
- Pattern filtering is done **post-hoc** since flawfinder has no flag to select individual rules.
|
|
74
|
+
- Exit code 0 = success. Exit code 15 = encoding error. Exit code 16 = CLI option error.
|
|
75
|
+
- The `--minlevel` flag is not set, so flawfinder uses its default minimum level of 1 (matching the legacy wrapper).
|
|
76
|
+
- SARIF parsing extracts `runs[0].results[]`. Each result's `ruleId` is the function name (e.g. "strcpy", "gets").
|
|
77
|
+
- The version regex handles both `Flawfinder version 2.0.19` and variations in output format.
|