Support for flawfinder

[fkromer]

Do you plan to add a plugin for the static analyser for potential CWE security issues in C++ code flawfinder? According to the tools website it is officially CWE-compatible.

[fkromer]

@git-afsantos I want to debug my draft integration of flawfinder. Can you give me some hints how to proceed during plugin development?

[git-afsantos]

@fkromer Sure. There are some things you need to make sure in all cases:

• your new plugin is located within .haros/plugins alongside the others;
• your new plugin contains __init__.py, plugin.py and plugin.yaml;
• the plugin name in plugin.yaml matches the plugin's directory name;
• every rule/metric id you use should be declared in plugin.yaml, under rules or metrics, respectively;
• use the most appropriate analysis scope for the underlying tool - i.e., if the tool takes an entire directory, define package_analysis, if the tool operates on one file at a time file_analysis may be easier.

To try things out, go with something along the lines of haros analyse -w flawfinder_plugin -p my_index.yaml. Trying it out with a relatively small index (one or two packages) and increasing it over time may be easier. Unfortunately, the error reporting for plugins is not very good, but hopefully you can make sense of some stack traces.

Another thing you can do in the first stages is to use print instead of iface.report_violation. This way you have more immediate results on the screen, and you can change it to proper reports later on. Also, this way you do not have to check the resulting JSON files, nor open the visualiser every time.

I can help you out once you hit more specific obstacles.