Flawfinder

https://dwheeler.com/flawfinder
Admin
Flawfinder is a security analysis tool that examines C/C++ source code and reports potential...
Tokens:4,670
Snippets:71
Trust Score:10
Update:6 months ago
Show doc for...
Tokens:
Raw
### Install flawfinder from source tarball (quick start)

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Quickly install flawfinder from the source tarball by unpacking it and running 'make install'. The 'prefix=/usr' argument installs to /usr; omit it to install in /usr/local. 'sudo' is required if not already root.

```bash
sudo make prefix=/usr install
```

--------------------------------

### Install flawfinder in /usr

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Install flawfinder with the program in /usr/bin and the manual page in /usr/man. This can be achieved using either the 'prefix' or 'INSTALL_DIR' make variables.

```bash
make prefix=/usr install
```

```bash
make INSTALL_DIR=/usr install
```

--------------------------------

### Default flawfinder installation

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Perform a default installation of flawfinder after becoming root. This installs the executable and man page in their standard locations.

```bash
su
make install
```

--------------------------------

### Install Flawfinder Python Extension

Source: https://dwheeler.com/flawfinder

Install the Python extension for Flawfinder. This command is used after the main installation on Unix-like systems.

```bash
sudo make PYTHONEXT=.py install
```

--------------------------------

### Install flawfinder using pip

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Use this command to install the latest released version of flawfinder via pip. Ensure Python 2.7 or a 3.x version is installed.

```bash
pip install flawfinder
```

--------------------------------

### Install flawfinder with custom prefix and man directory

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Install flawfinder with binaries in /usr/bin and manuals under /usr/local/share/man. This configuration is common for Red Hat Linux.

```bash
make prefix=/usr mandir=/usr/local/share/man install
```

--------------------------------

### Install flawfinder with custom Python extension on Cygwin

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Install flawfinder on Cygwin using 'make install' while specifying a custom Python extension. This is necessary for Cygwin environments.

```bash
make PYTHONEXT=.py install
```

--------------------------------

### Command Line Argument Parsing

Source: https://dwheeler.com/flawfinder/test.c

Example of using getopt_long for command line argument processing.

```c
int getopt_example(int argc,char *argv[]) {
    while ((optc = getopt_long (argc, argv, "a",longopts, NULL )) != EOF) {
    }
}
```

--------------------------------

### Install flawfinder in /usr on Cygwin

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Install flawfinder in the /usr directory on a Cygwin system, specifying the custom Python extension.

```bash
make prefix=/usr PYTHONEXT=.py install
```

--------------------------------

### Directly execute flawfinder

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Run the flawfinder program directly from the unpacked directory without a formal installation. Provide the files or directory to analyze as arguments.

```bash
./flawfinder files_or_directory
```

--------------------------------

### Run Flawfinder on Windows

Source: https://dwheeler.com/flawfinder

Example command to run Flawfinder on Windows using Python. Specify the Python executable, the script, and the target folder. The output can be saved to a hit file.

```cmd
C:\Python27\Python.exe flawfinder –H --savehitlist=ReportFolder\hitReport.hit C:\MySourcesFolder
```

--------------------------------

### Common C String and I/O Vulnerabilities

Source: https://dwheeler.com/flawfinder/test.c

Examples of potentially unsafe string manipulation and I/O functions often flagged by security scanners.

```c
/* This is a strcpy test. */

int demo(char *a, char *b) {
 strcpy(a, "\n"); // Did this work?
 strcpy(a, gettext("Hello there")); // Did this work?
 strcpy(b, a);
 sprintf(s, "\n");
 sprintf(s, "hello");
 sprintf(s, "hello %s", bug);
 sprintf(s, gettext("hello %s"), bug);
 sprintf(s, unknown, bug);
 printf(bf, x);
 scanf("%d", &x);
 scanf("%s", s);
 scanf("%10s", s);
 scanf("%s", s);
 gets(f); // Flawfinder: ignore
 printf("\\");
 /* Flawfinder: ignore */
 gets(f);
 gets(f);
 /* These are okay, but flawfinder version < 0.20 incorrectly used
    the first parameter as the parameter for the format string */
 syslog(LOG_ERR,"cannot open config file (%s): %s",filename,strerror(errno))
 syslog(LOG_CRIT,"malloc() failed");
 /* But this one SHOULD trigger a warning. */
 syslog(LOG_ERR, attacker_string);

}
```

--------------------------------

### Suppressing Flawfinder Warnings

Source: https://dwheeler.com/flawfinder

Examples of using the 'Flawfinder: ignore' directive to suppress security warnings in C code. These examples illustrate how the directive is appended to lines of code to prevent the tool from reporting potential vulnerabilities.

```C
   char tmp[256]; /* Flawfinder: ignore */
   strcpy(tmp, pScreenSize); /* Flawfinder: ignore */
```

```C
   sprintf(pTmp,  /* Flawfinder: ignore */
```

```C
   strncpy(buf, pos, len); /* Flawfinder: ignore */
```

--------------------------------

### Basic C Program Structure

Source: https://dwheeler.com/flawfinder/test.c

A simple C program demonstrating basic preprocessor directives and a main function.

```c
/* Test flawfinder.  This program won't compile or run; that's not necessary
   for this to be a useful test. */

#include <stdio.h>
#define hello(x) goodbye(x)
#define WOKKA "stuff"

main() {
 printf("hello\n");
}
```

--------------------------------

### Buffer Management and Windows API Usage

Source: https://dwheeler.com/flawfinder/test.c

Demonstrates various buffer handling functions and Windows-specific API calls with potential security risks.

```c
demo2() {
  char d[20];
  char s[20];
  int n;

  _mbscpy(d,s); /* like strcpy, this doesn't check for buffer overflow */
  memcpy(d,s);
  CopyMemory(d,s);
  lstrcat(d,s);
  strncpy(d,s);
  _tcsncpy(d,s);
  strncat(d,s,10);
  strncat(d,s,sizeof(d)); /* Misuse - this should be flagged as riskier. */
  _tcsncat(d,s,sizeof(d)); /* Misuse - flag as riskier */
  n = strlen(d);
  /* This is wrong, and should be flagged as risky: */
  MultiByteToWideChar(CP_ACP,0,szName,-1,wszUserName,sizeof(wszUserName));
  /* This is also wrong, and should be flagged as risky: */
  MultiByteToWideChar(CP_ACP,0,szName,-1,wszUserName,sizeof wszUserName);
  /* This is much better: */
  MultiByteToWideChar(CP_ACP,0,szName,-1,wszUserName,sizeof(wszUserName)/sizeof(wszUserName[0]));
  /* This is much better: */
  MultiByteToWideChar(CP_ACP,0,szName,-1,wszUserName,sizeof wszUserName /sizeof(wszUserName[0]));
  /* This is an example of bad code - the third paramer is NULL, so it creates
     a NULL ACL.  Note that Flawfinder can't detect when a
     SECURITY_DESCRIPTOR structure is manually created with a NULL value
     as the ACL; doing so would require a tool that handles C/C++
     and knows about types more that flawfinder currently does.
     Anyway, this needs to be detected: */
  SetSecurityDescriptorDacl(&sd,TRUE,NULL,FALSE);
  /* This one is a bad idea - first param shouldn't be NULL */
  CreateProcess(NULL, "C:\\Program Files\\GoodGuy\\GoodGuy.exe -x", "");
  /* Test interaction of quote characters */
  printf("%c\n", 'x');
  printf("%c\n", '"');
  printf("%c\n", '"');
  printf("%c\n", '\'');
  printf("%c\n", '\177');
  printf("%c\n", '\xfe');
  printf("%c\n", '\xd');
  printf("%c\n", '\n');
  printf("%c\n", '\\');
  printf("%c\n", "'");
}
```

--------------------------------

### Run Flawfinder on a directory

Source: https://dwheeler.com/flawfinder

Execute this command to scan a specific directory containing C/C++ source code for security weaknesses.

```bash
    flawfinder _directory_with_source_code_
```

--------------------------------

### File I/O Operations

Source: https://dwheeler.com/flawfinder/test.c

Basic file opening and closing operations.

```c
int testfile() {
  FILE *f;
  f = fopen("/etc/passwd", "r"); 
  fclose(f);
}
```

--------------------------------

### Macro-based Assertion

Source: https://dwheeler.com/flawfinder/test.c

A custom assertion macro implementation for debugging.

```c
#define assert(x) {\
 if (!(x)) {\
 fprintf(stderr,"Assertion failed.\n"\
 "File: %s\nLine: %d\n"\
 "Assertion: %s\n\n"\
 ,__FILE__,__LINE__,#x);\
 exit(1);\
 };\
 }
```

--------------------------------

### Extract and Navigate Flawfinder Archive

Source: https://dwheeler.com/flawfinder

Use these commands on Unix-like systems to extract the downloaded Flawfinder tarball and navigate into the source directory.

```bash
tar xvzf flawfinder-*.tar.gz
cd flawfinder-*
```

--------------------------------

### Uncompress flawfinder tarball (alternative)

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Alternative commands to uncompress the flawfinder tarball if the standard 'tar xvzf' command does not work. This involves separate gunzip and tar commands.

```bash
gunzip flawfinder*.tar.gz
```

```bash
tar xvf flawfinder*.tar
```

--------------------------------

### Uncompress flawfinder tarball (GNU tar)

Source: https://dwheeler.com/flawfinder/INSTALL.txt

Use this command to uncompress the flawfinder tarball on GNU-based systems. After uncompressing, navigate into the created directory.

```bash
tar xvzf flawfinder*.tar.gz
```

--------------------------------

### False Positive Testing

Source: https://dwheeler.com/flawfinder/test.c

Code snippet designed to test if the scanner correctly identifies non-vulnerable code.

```c
int accesstest() {
  int access = 0; /* Not a function call.  Should be caught by the
                     false positive test, and NOT labelled as a problem. */
}
```
Tokens:
Raw