a static analysis tool for finding vulnerabilities in C/C++ source code
Go to file
David A. Wheeler b7e8ebe3df
entrypoint.sh: Make minor improvements (#54)
* entrypoint.sh: Make minor improvements

Modify entrypoint.sh, used by the Dockerfile.

The original version *ALWAYS* echoed a success,
even if the command did NOT succeed for some reason.
Instead of printing the spurious message, just show the output and
let the exit value get communicated back to the caller.
This is especially important for CI/CD, since we want the CI/CD
system to get the exit value (e.g., so it can report failure if there
was a failure).

This version also displays the results to standard out, so it's
easier to immediately see the output from a CI/CD run.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2021-06-29 18:51:44 -04:00
.github/workflows scan specific file so the workflow will not report any error 2021-06-24 12:02:17 -07:00
test Release version 2.0.18 2021-06-24 20:24:57 -04:00
.gitignore Broaden an ignore rule 2018-03-15 22:49:45 -06:00
CONTRIBUTING.md Update documentation 2019-01-21 17:30:28 -05:00
COPYING Initial import 2007-01-16 02:44:45 +00:00
ChangeLog Release version 2.0.18 2021-06-24 20:24:57 -04:00
Dockerfile update actions files and readme. 2021-06-24 11:56:59 -07:00
INSTALL.md Update documentation 2019-01-21 17:30:28 -05:00
MANIFEST.in Fix SourceForge #18 Renamed file still referenced by other files 2018-10-06 18:46:09 -04:00
README.md update readme 2021-06-24 15:01:02 -07:00
action.yml update actions files and readme. 2021-06-24 11:56:59 -07:00
announcement Initial import 2007-01-16 02:44:45 +00:00
cwe.l Add ability to list CWEs in source code 2014-07-13 09:44:34 -04:00
entrypoint.sh entrypoint.sh: Make minor improvements (#54) 2021-06-29 18:51:44 -04:00
flawfinder.1 Update flawfinder.1 date 2021-06-03 11:11:21 -04:00
flawfinder.py Release version 2.0.18 2021-06-24 20:24:57 -04:00
flawfinder.spec Release version 2.0.18 2021-06-24 20:24:57 -04:00
makefile Release version 2.0.18 2021-06-24 20:24:57 -04:00
pylintrc Mass reformat of flawfinder source code to better comply with PEP 8 2017-07-30 20:06:39 -04:00
release_process.md Change version 2.0.15->2.0.16 2021-05-31 15:31:37 -04:00
setup.cfg Fix SourceForge #18 Renamed file still referenced by other files 2018-10-06 18:46:09 -04:00
setup.py Release version 2.0.18 2021-06-24 20:24:57 -04:00

README.md

About

This is "flawfinder" by David A. Wheeler.

Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws. It can be a useful tool for examining software for vulnerabilities, and it can also serve as a simple introduction to static source code analysis tools more generally. It is designed to be easy to install and use. Flawfinder supports the Common Weakness Enumeration (CWE) and is officially CWE-Compatible.

For more information, see the project website

Platforms

Flawfinder is designed for use on Unix/Linux/POSIX systems (including Cygwin, Linux-based systems, MacOS, and various BSDs) as a command line tool. It requires either Python 2.7 or Python 3.

Installation

If you just want to use it, you can install flawfinder with Python's "pip" or with your system's package manager (flawfinder has packages for many systems). It also supports easy installation following usual make install source installation conventions. The file INSTALL.md has more detailed installation instructions. You don't HAVE to install it to run it, but it's easiest that way.

Usage

To run flawfinder, just give it a list of source files or directories to example. For example, to examine all files in "src/" and down recursively:

flawfinder src/

To examine all files in the current directory and down recursively:

flawfinder ./

Hits (findings) are given a risk level from 0 (very low risk) to 5 (high risk), By default, findings of risk level 1 or higher are shown. You can show only the hits of risk level 4 or higher in the current directory and down this way:

flawfinder --minlevel 4 ./

The manual page (flawfinder.1 or flawfinder.pdf) describes how to use flawfinder (including its various options) and related information (such as how it supports CWE). For example, the --html option generates output in HTML format. The --help option gives a brief list of options.

Character Encoding Errors

Flawfinder must be able to correctly interpret your source code's character encoding. In the vast majority of cases this is not a problem, especially if the source code is correctly encoded using UTF-8 and your system is configured to use UTF-8 (the most common situation by far).

However, it's possible for flawfinder to halt if there is a character encoding problem and you're running Python3. The usual symptom is error meesages like this: Error: encoding error in FILENAME 'ENCODING' codec can't decode byte ... in position ...: invalid start byte

Unfortunately, Python3 fails to provide useful built-ins to deal with this. Thus, it's non-trivial to deal with this problem without depending on external libraries (which we're trying to avoid).

If you have this problem, see the flawfinder manual page for a collection of various solutions. One of the simplest is to simply convert the source code and system configuration to UTF-8. You can convert source code to UTF-8 using tools such as the system tool iconv or the Python program cvt2utf; you can install cvt2utf using pip install cvt2utf.

Under the hood

More technically, flawfinder uses lexical scanning to find tokens (such as function names) that suggest likely vulnerabilities, estimates their level of risk (e.g., by the text of function calls), and reports the results. Flawfinder does not use or have access to information about control flow, data flow, or data types. Thus, flawfinder will necessarily produce many false positives for vulnerabilities and fail to report many vulnerabilities. On the other hand, flawfinder can find vulnerabilities in programs that cannot be built or cannot be linked. Flawfinder also doesn't get as confused by macro definitions and other oddities that more sophisticated tools have trouble with.

Flawfinder Github Action

Usage

See action.yml

Create a .yml file under .github/workflows with the following contents:

Basic:

- name: Flawfinder
  uses: david-a-wheeler/flawfinder@v1.0
  with:
    arguments: '--sarif ./'
    output: 'flawfinder_results.sarif'

Input options:

Contributions

We love contributions! For more information on contributing, see the file CONTRIBUTING.md.

License

Flawfinder is released under the GNU GPL license version 2 or later (GPL-2.0+). See the COPYING file for license information.