Commit Graph

131 Commits

Author SHA1 Message Date
David A. Wheeler 0cba711317 Version 2.0.14
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2021-01-09 13:55:24 -05:00
David A. Wheeler 3e0c3a4f53 Fix makefile problem and version numbers
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2021-01-09 13:49:12 -05:00
David A. Wheeler 48d45086b2 Ignore LoadLibraryEx if LOAD_LIBRARY_SEARCH_SYSTEM32
Ignore LoadLibraryEx if its third parameter is
LOAD_LIBRARY_SEARCH_SYSTEM32, as this is safe.
This eliminates a false positive.

See:
https://github.com/david-a-wheeler/flawfinder/issues/26

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2021-01-09 13:22:58 -05:00
David A. Wheeler 7321f9f19c Remove InitialCriticalSection
This is no longer a vulnerability on widely-used Windows versions.
See:
https://github.com/david-a-wheeler/flawfinder/issues/19

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2021-01-09 13:04:56 -05:00
David A. Wheeler 41857c6364 Tell users how to disable false positives
If there are >0 hits, tell users how to ignore them in the output.
This resolves:
https://github.com/david-a-wheeler/flawfinder/issues/24

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2021-01-09 12:55:44 -05:00
David A. Wheeler 48ebb4023e Ignore "system::" to reduce false positives
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2021-01-03 14:13:27 -05:00
David A. Wheeler f32f11f092 Add .hpp support for C++
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2021-01-03 13:42:58 -05:00
Duong Do Minh Chau e856bce4e9 Treat ' as digit separator when file extension is .cpp, .cxx, .cc 2020-04-27 20:00:17 +07:00
David A. Wheeler 6d3a04cfef Last-minute tweaks for release
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2020-02-17 10:24:34 -05:00
David A. Wheeler d694a9e766 Provide better error feedback on encoding problems
Python3 has provided the world with endless character encoding problems.
It assumes the world is perfect with perfectly encoded data,
and fails to provide useful ways to deal with messy real-world data.

We can't really solve that, but we can detect the problem and
provide some useful information to users on possible ways to
solve the problem.  Much of this information was already in the
documentation, but many users aren't looking at the documentation.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2020-02-17 10:05:39 -05:00
David A. Wheeler fe78940e6f Add better error message on encoding problems
Python3 doesn't provide easy-to-use built-in libraries to deal
with common encoding issues (e.g., Windows-1252 encoded characters
in a UTF-8 stream), so when we see an encoding error,
provide better information on how to deal with it and
a pointer to the more detailed information in the documentation.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2019-09-22 15:22:17 -04:00
David A. Wheeler 38cfae4000 Update version number to upcoming 2.0.11
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2019-06-23 19:43:09 -04:00
David A. Wheeler 422473be6d Bugfix: when opening diffhitlist, use 'rb' mode
My thanks to Michał Górny, who both reported the problem
and provided the patch. Awesome!

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2019-06-22 14:49:42 -04:00
David A. Wheeler d35fd2718a Update version number now
Update the version number *now* so that we won't
accidentally release two different versions with the same version number.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2019-05-19 22:55:14 -04:00
Labidurie Jerome 280dc4a295 Fix Hitlist comparison by adding __eq__() & __ne__() to Hit class
Signed-off-by: Labidurie Jerome <jerome.labidurie@orange.com>
2019-05-17 10:00:41 +02:00
Markus Elfring 69084a95bb Construction of string literals without using plus operators
The programming language “Python” supports string literal concatenation
without the usage of additional plus operators as standard functionality.
https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation

Thus omit unnecessary operator specifications.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
2019-02-26 13:09:04 +01:00
David A. Wheeler d42ecdba1d Fix indentation (pylint)
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2019-02-25 23:33:57 -05:00
Markus Elfring 3b8ca7b34a Usage of augmented assignment statements
Source code like “var = var + X” was specified at some places so far.
Use augmented assignment statements instead because they are succinct
and can be more efficient.
https://docs.python.org/3/reference/simple_stmts.html#augmented-assignment-statements

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
2019-02-25 21:55:06 +01:00
David A. Wheeler e4f4d4a34b Set version number for next release (2.0.9)
Change the version number *now*, before release, so that we won't
accidentally release software with a duplicate version number later.
Also, tweak the release_process.md documentation to clarify a few things.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2019-01-21 18:54:01 -05:00
David A. Wheeler 49a2289fe3 _ftcsat should be _ftcscat. Thanks to Lucas Ramage
Fix typo in name of "banned" function.  Thanks to Lucas Ramage,
who reported this January 2019.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2019-01-12 11:53:27 -05:00
Michael Clark 3c9bf48736 Fixes #19 - don't warn if memcpy call includes sizeof(first arg)
Also fixes for the test output, comprising the bulk of the patch.
2018-12-19 08:07:47 -05:00
David A. Wheeler fccc59cdcb Update for next version (2.0.8)
Change the version number NOW, so we won't forget later.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-10-08 18:55:52 -04:00
David A. Wheeler 6abb7c524b Fix SourceForge bug #14 No special warning for filename with long dash
This was reported by philipp. After some tweaking I got the warning
to work on both Python 2 and Python 3.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-10-06 19:11:21 -04:00
David A. Wheeler da8b2016e0 Change vesion number to 2.0.7
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-09-30 21:42:56 -04:00
David A. Wheeler 530a88a395 Change www.dwheeler.com to dwheeler.com
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-09-30 21:35:11 -04:00
David A. Wheeler 3021892deb Halt if --listrules and --html are invoked simultaneously
We don't currently support this combination, so error out if it's attempted.
Fixes SourceForge bug report #15 "Incomplete HTML output for list of rules".

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-09-30 21:20:48 -04:00
David A. Wheeler 0eed96c22d Remove unused global variables
This fixes bug report #13, "Unused global variables" from philipp.
Thanks!

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-09-30 21:08:48 -04:00
David A. Wheeler fdd8a3bf47 Do not halt on unterminated parameter list in C code
If we see an unterminated parameter list in the code being analyzed,
continue to warn, but treat it as an empty list and continue.
That say, we can try to process at least some of the code.

This fixes bug report #12 TypeError raised for incomplete source code
from philipp created: 2018-03-10.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-09-30 20:43:13 -04:00
nickthetait 8e12d79029 Fix a comment
Signed-off-by: nickthetait <nicholas.tait@ieee.org>
2018-05-01 21:57:54 -06:00
nickthetait cda1b97c2e Standardize membership checking style
Reported as E713 by pycodestyle

Signed-off-by: nickthetait <nicholas.tait@ieee.org>
2018-03-15 22:49:45 -06:00
nickthetait 7e5531da5b Standardize whitespace between functions
Reported as E305 and E305 by pycodestyle

Signed-off-by: nickthetait <nicholas.tait@ieee.org>
2018-03-15 22:49:22 -06:00
nickthetait aeac180dbb Fix leading whitespace before comments
reported as E261 by pycodestyle
2018-03-15 22:46:01 -06:00
David A. Wheeler d7ce082024 Add "--error-level" option for continuous integration systems
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-01-27 18:11:52 -05:00
David A. Wheeler 34a58911d3 Update version numbers
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-01-26 00:24:39 -05:00
David A. Wheeler 2691ac6de5 Use https:, not http:, for cwe.mitre.org
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-01-25 23:52:35 -05:00
David A. Wheeler 6380038c34 Fix CWE hyperlinks with trailing ! or /
This fixes SF bug #9.

Thanks to philipp for reporting it!

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-01-25 23:48:05 -05:00
David A. Wheeler 9d1378e110 Fix typo in gsignal|ssignal rule
Fix a typo in the gsignal|ssignal rule.
This fixes SF bug #8.

My thanks to philipp for reporting this!

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2018-01-25 23:29:37 -05:00
David A. Wheeler 5aa1dec7f7 Update www.dwheeler.com URLs to use https
The www.dwheeler.com site has long supported https, but I forgot
to change these URLs. Fix that, so that people will use https.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-09-23 20:45:03 -04:00
David A. Wheeler 4d589859dc Change array to tuple
Change possible_levels to a tuple.  Arrays are mutable,
but we never want to mutate this value, so changing it
to a tuple reduces the risk of accidentally mutating it.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-09-23 20:41:45 -04:00
David A. Wheeler 6f513af900 Always report hit counts correctly, even if ignored using -m
This commit means that the output provides useful summary data,
even if the lower-level hits are suppressed.

Note that this does use a little more memory when some hits
are supressed, since the hitlist is fully created even
if only parts are displayed.  However, modern systems have
lots of memory. Hopefully we'll never analyze software
with so many problems that this is a problem itself :-).
If someone ever has that problem, they can output everything
and filter it separately.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-09-23 20:36:50 -04:00
Jon Hood e06e2ba3df update CWE, risk, and discussion for C++14 STL functions 2017-09-14 13:16:22 -05:00
David A. Wheeler 05ad330a53 Merge /u/squinky86/flawfinder-2/ branch master into master
https://sourceforge.net/p/flawfinder/code/merge-requests/2/
2017-09-10 00:45:36 +00:00
Jon Hood 1b7199ea16 add detection of errant equal, mismatch, and is_permutation 2017-09-08 13:20:28 -05:00
Jon Hood e522ea7291 add detection of crypt_r function 2017-09-07 13:47:10 -05:00
David A. Wheeler 24992c0f08 Update version to 2.0.4
My upload intended for pypitest appears to have gone to pypi instead.
To eliminate confusion, I'm bumping the version number so that
any single version number always refers to exactly one program version.

This was done with:
sed -i.bak -e 's/2\.0\.3/2.0.4/g' \
  ChangeLog correct-results.* flawfinder makefile setup.py

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-09-02 20:46:45 -04:00
David A. Wheeler ec31c822dd Mark version as 2.0.3
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-09-02 20:03:44 -04:00
David A. Wheeler d38535419f Update version number to 2.0.2
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-26 17:56:29 -04:00
David A. Wheeler 339763c644 Add test for saving/loading hitlist, add Python3 fixes for it
Test the saving and loading of hitlists.
This detected a Python3 problem, which was easily corrected by
saving and loading in binary "b" format instead of text format.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-26 16:15:17 -04:00
David A. Wheeler 203115edc3 Update book title
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-26 15:28:22 -04:00
David A. Wheeler a19a2bb694 Don't output "saving hitlist..." if quiet
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-26 15:13:35 -04:00