Commit Graph

146 Commits

Author SHA1 Message Date
David A. Wheeler a59ca71bc2 Add PYTHON macro to the makefile
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-23 21:02:08 -04:00
David A. Wheeler 596b63164f Update setup.py for PyPI
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-13 17:45:32 -04:00
David A. Wheeler 0a1761b10b Replace some string.find/rfind for Python 2/3 compatibility
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-13 10:11:58 -04:00
David A. Wheeler 94164014da Change string.join => "".join for simultaneous Python 2/3 support
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-12 21:18:11 -04:00
David A. Wheeler 05c238acc6 Modify find/split operations to work on Python 2 and 3
Python 3 only accepts certain syntaxes for find & split.
Thankfully, it's possible to use them in Python 2, so rework
it so we can use the same syntax for both.
This is not detected or fixed by futurize, sadly
(a problem true for many other situations).

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-12 21:12:54 -04:00
David A. Wheeler 8fee8a34bd Remove another use of range (Python 2/3 difference)
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-12 21:01:11 -04:00
David A. Wheeler c2ecdcf89b Remove many uses of range(), a Python 2/3 difference
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-12 20:58:19 -04:00
David A. Wheeler 0f4deebe00 Remove some Python 2/3 inconsistencies
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-12 20:45:05 -04:00
David A. Wheeler 6bb9c5d3c7 Tweak code to eliminate pylint warning
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-12 20:34:04 -04:00
David A. Wheeler eb3631d839 Remove use of Python 2-only __cmp__
Remove use of __cmp__, which is in Python 2 but not in Python 3.
Instead, use sort keys, which work in Python 2 and 3.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-12 20:31:41 -04:00
David A. Wheeler ea67f5dbca Switch all print statements to print() functions
Switch all print statements to print() functions per PEP 3105.
Python 3 *only* supports print() functions, so this begins to
move the code towards simultaneously supporting python 2 and 3.

This implements "stage1" of futurize.  In theory, "stage1" is
supposed to be "low risk", but in fact a *large* number of
manual fixes had to be made to make the program work again.

Python 2's traditional print statement includes the "softspace"
feature. This is "a semi-secret attribute on files currently used to tell
print whether to insert a space before the first item".  The print()
function does not have the "softspace" feature, so there is no direct
translation for any situation that depended on softspaces.
Flawfinder used softspaces extensively, as they were convenient,
so it took a little work to make print() functions work.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-08-12 19:33:49 -04:00
David A. Wheeler f9d6e11cdf Document CSV format further, including the fingerprint
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 23:56:09 -04:00
David A. Wheeler d5c4af4be1 Add "fingerprint" to CSV output
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 23:50:52 -04:00
David A. Wheeler 41ccb9c0ef Add CSV option as a documented example
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 23:39:04 -04:00
David A. Wheeler 5ad5a17034 Make minor improvements to flawfinder man page
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 23:29:36 -04:00
David A. Wheeler 51208ff35b Document the --csv option in the man page and pdf
The CSV option is noted in the ChangeLog, and is explained in --help,
but I forgot to add it to the man page.  This fixes the man page
and its corresponding generated PDF file.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 23:23:18 -04:00
David A. Wheeler fa9e1b0d42 Save CSV file on "make test-is-correct"
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 23:16:40 -04:00
David A. Wheeler 310f850d5b Update version number to 2.0.1
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 23:15:56 -04:00
David A. Wheeler aae3976bcf Note CONTRIBUTING.md in README and ChangeLog
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 20:52:42 -04:00
David A. Wheeler 7a0a1f38a6 Improve documentation about the use of pylint
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 20:47:28 -04:00
David A. Wheeler a19714aa30 Modify some names per pylint recommendations
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 20:29:10 -04:00
David A. Wheeler c4b28d916f Remove/merge duplicate hash entries found by pylint
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 20:22:11 -04:00
David A. Wheeler 6c49d39c61 Fix error (use of undefined variable) found by pylint
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 20:13:37 -04:00
David A. Wheeler 48bad06778 Change old-style class to "new"-style class
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 20:07:58 -04:00
David A. Wheeler 1de04d3dca Mass reformat of flawfinder source code to better comply with PEP 8
This reformats the source code's style to better comply with
Python PEP 8.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 20:06:39 -04:00
David A. Wheeler d06466bd2a Fix minor style issues identified by pylint
Pylint is a static analyzer of Python code.  It seems appropriate
to use a static analyzer to analyze a static analyzer :-).
None of the changes here fix a flaw in flawfinder.
The goal here is to follow PEP 008 more closely in the hope that
the changes make it easier for other developers to improve it further.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 16:49:11 -04:00
David A. Wheeler 595f45ad13 Add information about pylint
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-30 16:35:45 -04:00
David A. Wheeler 9309aa9c63 Add CONTRIBUTING.md documentation
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-29 17:46:15 -04:00
David A. Wheeler 02029816d4 Add rules to detect g_*rand* functions
Thanks to Michael McConville for this suggestion!

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-29 16:35:06 -04:00
David A. Wheeler 6f399a0a25 Add support for generating CSV files
Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-29 16:21:00 -04:00
David A. Wheeler 872109f230 Change version number to 2.0.0 - use Semantic Versioning
This switches flawfinder's version naming conventions to comply with
Semantic Versioning.  We change the first digit to "2" because
there's a subtle change in how CWEs are reported - see the
ChangeLog or documentation for more information.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2017-07-29 13:24:25 -04:00
David A. Wheeler 8f62d4290b flawfinder: remove some trailing whitespace 2014-09-07 14:14:55 -04:00
David A. Wheeler dc04172c52 flawfinder.1: Note that .makepp is also skipped by default 2014-09-07 14:14:34 -04:00
David A. Wheeler 94a20df2ee flawfinder.1: Tweak documentation about flag syntax 2014-09-07 14:05:52 -04:00
David A. Wheeler f6814c97c1 Reduce risk level to 0 of snprintf with constant format string
- snprintf is a useful *countermeasure* for buffer overflows,
    and unlike some alternatives it is standard and *widely* available.
    (strlcpy/strlcat are useful but not standard and not widely available;
    snprintf_s is standard but not widely available).
    Historically we warned about snprintf because old systems didn't
    implement it correctly, but at this point these old systems are
    more historical than anything else.
    Instead, let's specifically *mention* snprintf as a recommended
    potential solution for buffer overflows.
2014-09-01 15:14:55 -04:00
David A. Wheeler 6031b31f8c Add Microsoft banned list for string concatenation 2014-08-09 13:44:32 -04:00
David A. Wheeler aa2277b862 Add Microsoft banned functions for string copy and replacement 2014-08-09 13:32:37 -04:00
David A. Wheeler 0b432d2791 Change syntax of CWE mapping reports for CWE hierarchies (use "!" for map)
- The old syntax was very confusing.  Now just report
    higher-level/lower-level, with "!" after the CWE that is actually
    the mapping.
2014-08-09 13:06:50 -04:00
David A. Wheeler 0d56338062 flawfinder.1: Fix typo 2014-08-04 22:49:19 -04:00
David A. Wheeler 58749e78bc Change version number to 1.32
- Change version number early to prevent accidentally confusing
    this version with a released version.
2014-08-04 22:48:41 -04:00
David A. Wheeler aad0ac207c ChangeLog: Update release date 2014-08-03 18:31:02 -04:00
David A. Wheeler b8567a6702 makefile: Add an optional target to generate HTML documentation 2014-08-03 16:19:55 -04:00
David A. Wheeler bb09b9075b ChangeLog: Document better error reporting 2014-08-03 15:33:38 -04:00
David A. Wheeler 5156456c79 flawfinder: Improve error-handling. Warn of non-existent files (esp long dash)
- Provide a separate warning for filenames listed on the command line
    but do not actually exist.
  - Provide a SPECIAL warning for filenames that begin with
    the UTF-8 sequence of long dashes. Users might
    copy-and-paste from the pdf version of the man page, and that might
    produce long dashes (instead of normal dashes).  This problem
    can be hard to detect, so specially warning about it should help.
2014-08-03 15:29:05 -04:00
David A. Wheeler 547d1f3e17 Sending warnings to stderr, not stdout 2014-08-03 15:10:39 -04:00
David A. Wheeler 36b513af7c flawfinder.1: Update manual page date 2014-08-03 14:53:10 -04:00
David A. Wheeler 0017add313 README: Tweak so intro sentence similar to man page 2014-08-03 14:47:47 -04:00
David A. Wheeler d30fc2c1ac README: Rewrite to explain more. 2014-08-03 14:01:30 -04:00
David A. Wheeler ba844e7eea README: Fix spelling error 2014-08-03 13:18:51 -04:00
David A. Wheeler 2c383e37a7 flawfinder.1: Note that .git and .svn are examples of directories skipped 2014-08-03 13:17:43 -04:00