picuscan 1.0.0rc1__tar.gz

picuscan-1.0.0rc1/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.4
+Name: picuscan
+Version: 1.0.0rc1
+Summary: A unified orchestration and enrichment layer for C/C++ static analysis tools
+Author: AISEC Code Audit Team
+License-Expression: Apache-2.0
+Classifier: Development Status :: 4 - Beta
+Classifier: Topic :: Security
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: attrs>=25.2.0
+Requires-Dist: cattrs>=25.1.0
+Requires-Dist: click>=8.0.3
+Requires-Dist: neo4j>=6.0.1
+Requires-Dist: networkx>=3.0
+Requires-Dist: tqdm>=4.68.4
+Requires-Dist: xmltodict>=1.0.0
+Requires-Dist: pandas>=2.0.3
+Requires-Dist: tabulate>=0.9.0
+Maintainer: Tobias Specht, Hannah Schmid
+Maintainer-email: Tobias Specht <tobias.specht@aisec.fraunhofer.de>, Hannah Schmid <hannah.schmid@aisec.fraunhofer.de>
+Requires-Python: >=3.11, <3.15
+Project-URL: Documentation, https://github.com/Fraunhofer-AISEC/picuscan
+Project-URL: Repository, https://github.com/Fraunhofer-AISEC/picuscan
+Project-URL: Bug Tracker, https://github.com/Fraunhofer-AISEC/picuscan/issues
+Description-Content-Type: text/markdown
+
+<!--
+SPDX-FileCopyrightText: 2026 AISEC Code Audit Team
+
+SPDX-License-Identifier: CC0-1.0
+-->
+
+# Picuscan
+
+Picuscan (Picus: Latin for woodpecker; a scanner hunting for bugs in source code) is an orchestration and utility tool for C/C++ security code audits. It provides a unified interface for running multiple external static analysis (SAST) tools, aggregates and normalizes their findings, and enriches the results with security metadata such as CWE categories.
+
+Picuscan does not perform static analysis itself; instead, it collects tool outputs and turns them into a single, audit-focused view. It also ranks findings using a heuristic that combines tool feedback with practical experience to help auditors prioritize likely true positives. Additional utilities support audit preparation, including generating compilation databases, preparing source code, and working with SARIF files.
+
+## Quick Start
+
+### Docker (Recommended)
+
+```bash
+$ docker pull ghcr.io/fraunhofer-aisec/picuscan:main
+$ docker run --rm -it -v $PWD:$PWD:z -w $PWD --entrypoint bash ghcr.io/fraunhofer-aisec/picuscan:main
+$ picuscan --help
+```
+
+See [Installation → Docker](docs/installation.md#docker) for more details.
+
+### From PyPI
+
+```bash
+$ pipx install picuscan
+$ picuscan --help
+```
+
+**Note:** When installing via pip, you must install the analysis tools separately. See [Installation → Dependencies](docs/installation.md#dependencies) for a list of supported tools.
+
+## Usage
+
+You need a [compilation database][compdb] for the analysis to work.
+Run analysis and generate a SARIF report:
+
+```bash
+$ picuscan analyze
+```
+
+See [Usage](docs/usage.md) for comprehensive documentation.
+
+## Documentation
+
+- [Installation](docs/installation.md) - Docker and pip installation
+- [Usage](docs/usage.md) - Analysis, compilation databases, preprocessing
+- [Analyzers](docs/analyzers.md) - Tool-specific options and configurations
+
+## License
+
+[Apache-2.0](LICENSE)
+
+## Acknowledgments
+
+This work was partly funded by the German Federal Ministry of Economic Affairs and Energy (BMWE) as part of the ATLAS-L4 project (grant no. 19A21048D).
+This work was partly funded by the German Federal Ministry of Education and Research (BMBF) as part of the SHIQ project (grant no. 16KIS1955).
+
+[compdb]: https://clang.llvm.org/docs/JSONCompilationDatabase.html

picuscan-1.0.0rc1/README.md

@@ -0,0 +1,60 @@
+<!--
+SPDX-FileCopyrightText: 2026 AISEC Code Audit Team
+
+SPDX-License-Identifier: CC0-1.0
+-->
+
+# Picuscan
+
+Picuscan (Picus: Latin for woodpecker; a scanner hunting for bugs in source code) is an orchestration and utility tool for C/C++ security code audits. It provides a unified interface for running multiple external static analysis (SAST) tools, aggregates and normalizes their findings, and enriches the results with security metadata such as CWE categories.
+
+Picuscan does not perform static analysis itself; instead, it collects tool outputs and turns them into a single, audit-focused view. It also ranks findings using a heuristic that combines tool feedback with practical experience to help auditors prioritize likely true positives. Additional utilities support audit preparation, including generating compilation databases, preparing source code, and working with SARIF files.
+
+## Quick Start
+
+### Docker (Recommended)
+
+```bash
+$ docker pull ghcr.io/fraunhofer-aisec/picuscan:main
+$ docker run --rm -it -v $PWD:$PWD:z -w $PWD --entrypoint bash ghcr.io/fraunhofer-aisec/picuscan:main
+$ picuscan --help
+```
+
+See [Installation → Docker](docs/installation.md#docker) for more details.
+
+### From PyPI
+
+```bash
+$ pipx install picuscan
+$ picuscan --help
+```
+
+**Note:** When installing via pip, you must install the analysis tools separately. See [Installation → Dependencies](docs/installation.md#dependencies) for a list of supported tools.
+
+## Usage
+
+You need a [compilation database][compdb] for the analysis to work.
+Run analysis and generate a SARIF report:
+
+```bash
+$ picuscan analyze
+```
+
+See [Usage](docs/usage.md) for comprehensive documentation.
+
+## Documentation
+
+- [Installation](docs/installation.md) - Docker and pip installation
+- [Usage](docs/usage.md) - Analysis, compilation databases, preprocessing
+- [Analyzers](docs/analyzers.md) - Tool-specific options and configurations
+
+## License
+
+[Apache-2.0](LICENSE)
+
+## Acknowledgments
+
+This work was partly funded by the German Federal Ministry of Economic Affairs and Energy (BMWE) as part of the ATLAS-L4 project (grant no. 19A21048D).
+This work was partly funded by the German Federal Ministry of Education and Research (BMBF) as part of the SHIQ project (grant no. 16KIS1955).
+
+[compdb]: https://clang.llvm.org/docs/JSONCompilationDatabase.html

picuscan-1.0.0rc1/pyproject.toml

@@ -0,0 +1,85 @@
+# SPDX-FileCopyrightText: 2026 AISEC Code Audit Team
+#
+# SPDX-License-Identifier: CC0-1.0
+
+[build-system]
+requires = ["uv_build>=0.11.28,<0.12.0"]
+build-backend = "uv_build"
+
+[project]
+name = "picuscan"
+version = "1.0.0rc1"
+description = "A unified orchestration and enrichment layer for C/C++ static analysis tools"
+readme = "README.md"
+license = "Apache-2.0"
+authors = [{name = "AISEC Code Audit Team"}]
+maintainers = [
+  { name = "Tobias Specht", email = "tobias.specht@aisec.fraunhofer.de" },
+  { name = "Hannah Schmid", email = "hannah.schmid@aisec.fraunhofer.de" }
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Topic :: Security",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+]
+requires-python = ">=3.11,<3.15"
+dependencies = [
+  "attrs>=25.2.0",
+  "cattrs>=25.1.0",
+  "click>=8.0.3",
+  "neo4j>=6.0.1",
+  "networkx>=3.0",
+  "tqdm>=4.68.4",
+  "xmltodict>=1.0.0",
+  "pandas>=2.0.3",
+  "tabulate>=0.9.0",
+]
+
+[dependency-groups]
+dev = [
+  "ruff>=0.15.21",
+  "pytest>=9.0.1",
+  "pytest-asyncio>=1.3.0",
+  "pytest-mock>=3.15.1",
+  "pandas-stubs>=2.3.2.250926",
+  "mypy>=2.3.0",
+  "types-tqdm>=4.68.0.20260608",
+  "types-xmltodict>=1.0.1.20260518",
+  "types-networkx>=3.6.1.20260624",
+  "typing-extensions>=4.0.1",
+  "reuse>=6.2.0",
+]
+
+[project.scripts]
+picuscan = "picuscan:main"
+
+[project.urls]
+Documentation = "https://github.com/Fraunhofer-AISEC/picuscan"
+Repository = "https://github.com/Fraunhofer-AISEC/picuscan"
+"Bug Tracker" = "https://github.com/Fraunhofer-AISEC/picuscan/issues"
+
+[tool.uv]
+package = true
+build-constraint-dependencies = ["setuptools<81"]
+
+[tool.ruff]
+line-length = 120
+target-version = "py311"
+[tool.ruff.lint]
+select = ["E", "F", "W"]
+ignore = ["E501"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+
+[tool.mypy]
+strict = true
+native_parser = true
+num_workers = 4
+
+

picuscan-1.0.0rc1/src/picuscan/__init__.py

@@ -0,0 +1,57 @@
+# SPDX-FileCopyrightText: 2026 AISEC Code Audit Team
+#
+# SPDX-License-Identifier: Apache-2.0
+
+from __future__ import annotations
+
+import importlib
+import pkgutil
+from asyncio import Semaphore
+from typing import Any
+
+import click
+
+from . import commands, logging
+from .config import Config
+from .misc import sysutils
+
+logging.install()
+logger = logging.get_logger(__name__)
+
+
+class Loader(click.Group):
+    def list_commands(self, ctx: click.Context) -> list[str]:
+        return [name.replace("_", "-") for _, name, _ in pkgutil.iter_modules(commands.__path__)]
+
+    def get_command(self, ctx: click.Context, cmd_name: str) -> click.Command | None:
+        cmd_name = cmd_name.replace("-", "_")
+        try:
+            # When a user runs 'picuscan some-command', look for the
+            # command definition in 'picuscan.commands.some_command'
+            module = importlib.import_module(f"{commands.__name__}.{cmd_name}")
+            cmd = getattr(module, "cli")
+            if isinstance(cmd, click.Command):
+                return cmd
+        except (ModuleNotFoundError, AttributeError):
+            pass
+        return None
+
+
+LEVELS = ("CRITICAL", "ERROR", "WARNING", "INFO", "DEBUG")
+
+
+@click.command(cls=Loader, help="Picuscan")
+@click.option(
+    "--log", type=click.Choice(LEVELS, case_sensitive=False), default="INFO", show_default=True, help="Log level."
+)
+@click.option(
+    "--max-jobs", "-j", type=click.IntRange(1), default=sysutils.cpu_count(), help="Maximum number of processes."
+)
+@click.option("--keep-tmps", is_flag=True, help="Don't delete temporary files.")
+@click.version_option()
+@click.pass_context
+def main(ctx: click.Context, /, log: str, max_jobs: int, **kwds: Any) -> None:
+    logger.setLevel(log)
+    semaphore = Semaphore(max_jobs)
+    # Make the configuration available in all subcommand contexts
+    ctx.obj = Config(job_semaphore=semaphore, **kwds)

picuscan-1.0.0rc1/src/picuscan/__main__.py

@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: 2026 AISEC Code Audit Team
+#
+# SPDX-License-Identifier: Apache-2.0
+
+from picuscan import main
+
+main()

picuscan-1.0.0rc1/src/picuscan/analyzer/__init__.py

@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: 2026 AISEC Code Audit Team
+#
+# SPDX-License-Identifier: Apache-2.0

picuscan-1.0.0rc1/src/picuscan/analyzer/cwe.py

@@ -0,0 +1,261 @@
+# SPDX-FileCopyrightText: 2026 AISEC Code Audit Team
+#
+# SPDX-License-Identifier: Apache-2.0
+
+"""Map tool rules to CWE categories."""
+
+mapping = {
+    "clangsa": {
+        "core.CallAndMessage": "CWE-628",
+        "core.DivideZero": "CWE-369",
+        "core.NonNullParamChecker": "CWE-233",
+        "unix.cstring.NullArg": "CWE-233",
+        "core.NullDereference": "CWE-476",
+        "core.uninitialized.ArraySubscript": "CWE-129",
+        "core.uninitialized.Assign": "CWE-457",
+        "core.uninitialized.Branch": "CWE-665",
+        "core.uninitialized.UndefReturn": "CWE-457",
+        "cplusplus.NewDeleteLeaks": "CWE-401",
+        "deadcode.DeadStores": "CWE-563",
+        "security.FloatLoopCounter": "CWE-1077",
+        "unix.API": "CWE-242",
+        "unix.Malloc": "CWE-770",
+        "unix.MallocSizeof": "CWE-704",
+        "unix.BlockInCriticalSection": "CWE-667",
+        "unix.Stream": "CWE-775",
+        "unix.StdCLibraryFunctions": "CWE-233",
+        "valist.Unterminated": "CWE-401",
+        "security.insecureAPI.DeprecatedOrUnsafeBufferHandling": "CWE-120",
+        "security.insecureAPI.strcpy": "CWE-120",
+        "security.insecureAPI.vfork": "CWE-676",
+        "cplusplus.StringChecker": "CWE-476",
+        "cplusplus.PlacementNew": "CWE-119",
+        "core.UndefinedBinaryOperatorResult": "CWE-457",
+        "cplusplus.PureVirtualCall": "CWE-758",
+        "core.StackAddressEscape": "CWE-562",
+        "core.BitwiseShift": "CWE-190",
+        "optin.core.EnumCastOutOfRange": "CWE-704",
+        "alpha.core.CastSize": "CWE-704",
+        "alpha.core.SizeofPtr": "CWE-467",
+        "alpha.clone.CloneChecker": "CWE-1041",
+        "alpha.security.ArrayBound": "CWE-119",
+        "alpha.security.ArrayBoundV2": "CWE-119",
+        "alpha.cplusplus.EnumCastOutOfRange": "CWE-704",
+        "alpha.cplusplus.IteratorRange": "CWE-118",
+        "alpha.deadcode.UnreachableCode": "CWE-561",
+        "alpha.unix.cstring.OutOfBounds": "CWE-119",
+        "alpha.unix.cstring.BufferOverlap": "CWE-119",
+        "alpha.security.ReturnPtrRange": "CWE-119",
+        "alpha.unix.cstring.UninitializedRead": "CWE-457",
+        "alpha.core.Conversion": "CWE-681",
+        "alpha.core.PointerArithm": "CWE-465",
+        "alpha.security.MallocOverflow": "CWE-190",
+        "alpha.cplusplus.InvalidatedIterator": "CWE-118",
+        "alpha.cplusplus.MismatchedIterator": "CWE-118",
+        "alpha.unix.PthreadLock": "CWE-667",
+        "alpha.core.CastToStruct": "CWE-704",
+        "alpha.core.FixedAddr": "CWE-587",
+    },
+    "clang-tidy": {
+        "bugprone-integer-division": "CWE-682",
+        "clang-diagnostic-constant-conversion": "CWE-704",
+        "clang-diagnostic-incompatible-pointer-types": "CWE-843",
+        "clang-diagnostic-missing-field-initializers": "CWE-665",
+        "clang-diagnostic-unused-const-variable": "CWE-563",
+        "misc-incorrect-roundings": "CWE-682",
+        "misc-misplaced-const": "CWE-843",
+        "misc-misplaced-widening-cast": "CWE-704",
+        "misc-redundant-expression": "CWE-1041",
+        "misc-sizeof-expression": "CWE-467",
+        "misc-*": "CWE-1006",
+        "modernize-*": "CWE-1006",
+        "performance-*": "CWE-1006",
+        "altera-*": "CWE-1006",
+        "boost-use-*": "CWE-1006",
+        "bugprone-narrowing-conversions": "CWE-681",
+        "bugprone-exception-escape": "CWE-248",
+        "concurrency-mt-unsafe": "CWE-362",
+        "misc-no-recursion": "CWE-674",
+        "bugprone-implicit-widening-of-multiplication-result": "CWE-681",
+        "bugprone-signed-char-misuse": "CWE-681",
+        "bugprone-move-forwarding-reference": "CWE-676",
+        "bugprone-misplaced-widening-cast": "CWE-681",
+        "bugprone-macro-parentheses": "CWE-1006",
+        "bugprone-unchecked-optional-access": "CWE-457",
+        "clang-diagnostic-uninitialized": "CWE-457",
+        "clang-diagnostic-format": "CWE-1006",
+        "clang-diagnostic-format-nonliteral": "CWE-134",
+        "clang-diagnostic-deprecated-declarations": "CWE-477",
+        "clang-diagnostic-sometimes-uninitialized": "CWE-457",
+        "clang-diagnostic-conditional-uninitialized": "CWE-457",
+        "clang-diagnostic-return-stack-address": "CWE-562",
+        "clang-diagnostic-dangling-gsl": "CWE-826",
+        "clang-diagnostic-unsafe-buffer-usage": "CWE-119",
+        "clang-diagnostic-fortify-source": "CWE-119",
+        "clang-diagnostic-*": "CWE-1006",
+        "bugprone-*": "CWE-1006",
+        "readability-*": "CWE-1006",
+        "cert-msc32-c": "CWE-335",
+        "cert-msc30-c": "CWE-330",
+        "cert-str34-c": "CWE-681",
+        "cert-dcl59-cpp": "CWE-1006",
+        "cert-err58-cpp": "CWE-248",
+        "cert-msc51-cpp": "CWE-335",
+        "cert-int09-c": "CWE-1006",
+        "cert-dcl37-c": "CWE-1006",
+        "cert-dcl51-cpp": "CWE-1006",
+        "cert-oop54-cpp": "CWE-416",
+        "cert-err33-c": "CWE-252",
+        "cert-err34-c": "CWE-704",
+        "cert-ctr56-cpp": "CWE-465",
+        "google-build-namespaces": "CWE-1006",
+        "clang-diagnostic-division-by-zero": "CWE-369",
+        "clang-diagnostic-unused-result": "CWE-252",
+        "clang-diagnostic-switch-enum": "CWE-1023",
+        "clang-diagnostic-implicit*": "CWE-704",
+        "clang-diagnostic-return-type": "CWE-1006",
+        "clang-diagnostic-misleading-indentation": "CWE-1006",
+        "clang-diagnostic-dangling-else": "CWE-1006",
+        "clang-diagnostic-unused-value": "CWE-252",
+        "clang-diagnostic-implicit-int-conversion": "CWE-681",
+    },
+    "infer": {
+        "BUFFER_OVERRUN_*": "CWE-119",
+        "DEAD_STORE": "CWE-563",
+        "INFERBO_ALLOC_IS_NEGATIVE": "CWE-119",
+        "INFERBO_ALLOC_IS_ZERO": "CWE-131",
+        "NULL_DEREFERENCE*": "CWE-476",
+        "NULLPTR_DEREFERENCE*": "CWE-476",
+        "COMPARED_TO_NULL_AND_DEREFERENCED": "CWE-476",
+        "*RESOURCE_LEAK": "CWE-404",
+        "SHELL_INJECTION": "CWE-807",
+        "*UNINITIALIZED_VALUE*": "CWE-457",
+        "USE_AFTER_FREE*": "CWE-416",
+        "USE_AFTER_DELETE*": "CWE-416",
+        "USE_AFTER_LIFETIME*": "CWE-826",
+        "LOCK_CONSISTENCY_VIOLATION": "CWE-362",
+        "INTEGER_OVERFLOW_*": "CWE-190",
+        "OPTIONAL_EMPTY_ACCESS*": "CWE-457",
+        "PULSE_READONLY_SHARED_PTR_PARAM": "CWE-1006",
+        "DANGLING_POINTER_DEREFERENCE": "CWE-416",
+        "DIVIDE_BY_ZERO": "CWE-369",
+        "MEMORY_LEAK*": "CWE-401",
+        "*UNNECESSARY_COPY*": "CWE-1006",
+        "STACK_VARIABLE_ADDRESS_ESCAPE": "CWE-562",
+        "CONSTANT_ADDRESS_DEREFERENCE*": "CWE-587",
+        "PULSE_CONST_REFABLE": "CWE-398",
+        "MUTUAL_RECURSION_CYCLE": "CWE-674",
+    },
+    "rats": {
+        "memcpy": "CWE-120",
+        "read": "CWE-120",
+        "system": "CWE-78",
+        "fixed size local buffer": "CWE-119",
+        "strncpy": "CWE-120",
+        "fgets": "CWE-120",
+        "realpath": "CWE-120",
+        "fgetc": "CWE-120",
+        "fork": "CWE-662",
+        "rmdir": "CWE-362",
+        "strlen": "CWE-126",
+        "*scanf": "CWE-134",
+        "unlink": "CWE-362",
+        "open": "CWE-362",
+        "opendir": "CWE-362",
+        "remove": "CWE-362",
+        "execv": "CWE-362",
+        "vfork": "CWE-676",
+        "stat": "CWE-362",
+        "dirname": "CWE-362",
+        "fopen": "CWE-362",
+        "basename": "CWE-362",
+        "lstat": "CWE-362",
+        "mkdir": "CWE-362",
+        "rename": "CWE-362",
+        "ERR_error_string": "CWE-676",
+        "Static Global Buffer": "CWE-119",
+        "getenv": "CWE-20",
+        "*printf": "CWE-134",
+        "chmod": "CWE-362",
+        "chown": "CWE-362",
+        "srand": "CWE-330",
+        "random": "CWE-330",
+        "realloc": "CWE-226",
+        "OPENSSL_free": "CWE-212",
+        "X509_NAME_oneline": "CWE-120",
+    },
+    "flawfinder": {"FF1048": "CWE-330"},
+    "ikos": {
+        "unreachable": "CWE-561",
+        "uninitialized-variable": "CWE-457",
+        "assert": "CWE-617",
+        "division-by-zero": "CWE-369",
+        "shift-count": "CWE-1335",
+        "signed-int-underflow": "CWE-191",
+        "signed-int-overflow": "CWE-190",
+        "unsigned-int-underflow": "CWE-191",
+        "unsigned-int-overflow": "CWE-190",
+        "null-pointer-deref": "CWE-476",
+        "null-pointer-comparison": "CWE-465",
+        "invalid-pointer-comparison": "CWE-465",
+        "pointer-comparison": "CWE-465",
+        "pointer-overflow": "CWE-465",
+        "invalid-pointer-deref": "CWE-971",
+        "unknown-memory-access": "CWE-890",
+        "unaligned-pointer": "CWE-970",
+        "buffer-overflow-gets": "CWE-676",
+        "buffer-overflow": "CWE-119",
+        "ignored-store": "CWE-980",
+        "ignored-memory-copy": "CWE-120",
+        "ignored-free": "CWE-415",
+        "free": "CWE-415",
+    },
+    "cppcheck": {
+        "subtractPointers": "CWE-469",
+        "overlappingWriteFunction": "CWE-970",
+        "uninitMemberVar": "CWE-457",
+        "pointerOutOfBounds": "CWE-465",
+        "knownEmptyContainer": "CWE-476",
+        "cppcheck-arrayIndexOutOfBounds*": "CWE-129",
+        "cppcheck-AssignmentAddressToInteger": "CWE-465",
+        "cppcheck-badBitmaskCheck": "CWE-682",
+        "cppcheck-constStatement": "",
+        "cppcheck-identicalInnerCondition": "CWE-691",
+        "cppcheck-missingInclude": "CWE-1006",
+        "cppcheck-missingIncludeSystem": "CWE-1006",
+        "cppcheck-negativeIndex": "CWE-129",
+        "cppcheck-nullPointer": "CWE-476",
+        "cppcheck-oppositeInnerCondition": "CWE-691",
+        "cppcheck-uninitMemberVar": "CWE-457",
+        "cppcheck-uninitvar": "CWE-457",
+        "cppcheck-unknownMacro": "CWE-1006",
+        "cppcheck-useInitializationList": "CWE-1006",
+        "cppcheck-duplInheritedMember": "CWE-1006",
+        "cppcheck-invalidPrintfArgType_uint": "CWE-681",
+        "cppcheck-nullPointerRedundantCheck": "CWE-476",
+        "cppcheck-passedByValue": "CWE-1006",
+        "cppcheck-returnByReference": "CWE-1006",
+        "cppcheck-stlcstrParam": "CWE-133",
+        "cppcheck-uninitDerivedMemberVar": "CWE-457",
+        "cppcheck-uninitMemberVarPrivate": "CWE-457",
+        "cppcheck-uninitStructMember": "CWE-457",
+        "cppcheck-preprocessorErrorDirective": "CWE-670",
+    },
+    "gcc": {
+        "-Wstringop-overflow=": "CWE-119",
+        "-Warray-bounds=": "CWE-129",
+        "-Wmaybe-uninitialized": "CWE-457",
+        "-Wreturn-type": "CWE-1006",
+        "warning": "CWE-1006",
+        "-Wanalyzer-va-list-use-after-va-end": "CWE-1341",
+        "-Wanalyzer-use-of-pointer-in-stale-stack-frame": "CWE-562",
+        "gcc-double-free": "CWE-415",
+        "gcc-infinite-loop": "CWE-835",
+        "gcc-malloc-leak": "CWE-401",
+        "gcc-null-argument": "CWE-476",
+        "gcc-possible-null-dereference": "CWE-476",
+        "gcc-use-of-uninitialized-value": "CWE-457",
+        "-Werror=shift-count-overflow": "CWE-190",
+        "-Wswitch": "CWE-1006",
+    },
+}