Skip to content

Commit 57f0635

Browse files
kdudkakdudka
committed
cwe-mapper: do not assign unrelated CWEs for GCC and ShellCheck
Due to historical reasons, we distinguish checkers (a.k.a. rules) by the checker field for Coverity only. For other tools we map this to the key events, such as `warning[-Wshadow]` in case of gcc. The CWE mapping is defined for checker/keyEvent pairs. For Coverity, it is fine to assign CWE based on checker only in case the exact pair is not matched. For other tools, it does not make any sense, because the checker field maps to the tool and the actual checkers (rules) can be distinguished by the key event only. This is a follow-up to commit 142ee3f, which landed when we had CWE mapping for Coverity and Cppcheck only. Reported-by: Steve Grubb Closes: #52
1 parent 466c252 commit 57f0635

File tree

3 files changed

+102
-221
lines changed

3 files changed

+102
-221
lines changed

‎src/cwe-mapper.cc

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919

2020
#include "cwe-mapper.hh"
2121

22+
#include "parser-common.hh"
23+
2224
#include <cstdio>
2325

2426
// /////////////////////////////////////////////////////////////////////////////
@@ -28,8 +30,19 @@ struct CweMap::Private {
2830
typedef std::map<std::string, TNumByEvent> TMapByChk;
2931

3032
TMapByChk mapByChk;
33+
ImpliedAttrDigger digger;
34+
35+
bool detectedByTool(Defect def, const char *tool);
3136
};
3237

38+
bool CweMap::Private::detectedByTool(Defect def, const char *tool)
39+
{
40+
// detect tool in case it is not explicitly specified
41+
this->digger.inferToolFromChecker(&def);
42+
43+
return (def.tool == tool);
44+
}
45+
3346
CweMap::CweMap():
3447
d(new Private)
3548
{
@@ -106,13 +119,15 @@ bool CweMap::assignCwe(Defect &def) const
106119
std::cerr << "warning: CWE not found: checker = " << def.checker
107120
<< ", event = " << evt.event << "\n";
108121

109-
if (def.checker == "CPPCHECK_WARNING") {
110-
// we cannot fallback to a random CWE that Cppcheck has mapping for
122+
if (d->detectedByTool(def, "coverity")) {
123+
// we assign per-checker CWE only for Coverity
124+
cweIt = row.begin();
125+
}
126+
else {
127+
// for other tools there is no fallback if the event is not found
111128
cweDst = 0;
112129
return false;
113130
}
114-
115-
cweIt = row.begin();
116131
}
117132

118133
const int cweSrc = cweIt->second;

‎tests/cslinker/0001-smoke/cwe-map.csv

Lines changed: 65 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@
2020
"BAD_LOCK_OBJECT","lock_on_assigned_field","CWE-543"
2121
"BAD_LOCK_OBJECT","single_thread_lock","CWE-543"
2222
"BAD_OVERRIDE","bad_override","CWE-398"
23+
"BAD_SHIFT","large_shift","CWE-682"
24+
"BAD_SHIFT","negative_shift","CWE-682"
2325
"BAD_SIZEOF","bad_sizeof","CWE-467"
2426
"BUFFER_SIZE","buffer_size","CWE-120"
2527
"BUFFER_SIZE","overlapping_buffer","CWE-474"
@@ -45,6 +47,7 @@
4547
"COMPILER_WARNING","warning[-Wnull-dereference]","CWE-476"
4648
"COMPILER_WARNING","warning[-Wpointer-compare]","CWE-569"
4749
"COMPILER_WARNING","warning[-Wreturn-local-addr]","CWE-562"
50+
"COMPILER_WARNING","warning[-Wswitch]","CWE-1023"
4851
"COMPILER_WARNING","warning[-Wtautological-compare]","CWE-569"
4952
"COMPILER_WARNING","warning[-Wuninitialized]","CWE-457"
5053
"COMPILER_WARNING","warning[-Wunused-but-set-variable]","CWE-563"
@@ -56,6 +59,7 @@
5659
"COMPILER_WARNING","warning[-Wunused-result]","CWE-252"
5760
"COMPILER_WARNING","warning[-Wunused-value]","CWE-563"
5861
"COMPILER_WARNING","warning[-Wunused-variable]","CWE-563"
62+
"COMPILER_WARNING","warning[-Wwrite-strings]","CWE-710"
5963
"CONSTANT_EXPRESSION_RESULT","always_true_or","CWE-569"
6064
"CONSTANT_EXPRESSION_RESULT","bit_and_with_zero","CWE-569"
6165
"CONSTANT_EXPRESSION_RESULT","extra_high_bits","CWE-569"
@@ -100,12 +104,11 @@
100104
"CPPCHECK_WARNING","error[insecureCmdLineArgs]","CWE-120"
101105
"CPPCHECK_WARNING","error[integerOverflow]","CWE-190"
102106
"CPPCHECK_WARNING","error[invalidFunctionArgBool]","CWE-686"
103-
"CPPCHECK_WARNING","error[invalidFunctionArg ]","CWE-628"
107+
"CPPCHECK_WARNING","error[invalidFunctionArg]","CWE-628"
104108
"CPPCHECK_WARNING","error[invalidPointer]","CWE-664"
105109
"CPPCHECK_WARNING","error[invalidScanfFormatWidth]","CWE-120"
106110
"CPPCHECK_WARNING","error[IOWithoutPositioning]","CWE-227"
107111
"CPPCHECK_WARNING","error[iterators]","CWE-664"
108-
"CPPCHECK_WARNING","error[iterators]","CWE-MAP-NOMATCH"
109112
"CPPCHECK_WARNING","error[leakNoVarFunctionCall]","CWE-401"
110113
"CPPCHECK_WARNING","error[leakReturnValNotUsed]","CWE-252"
111114
"CPPCHECK_WARNING","error[mallocOnClassError]","CWE-665"
@@ -124,6 +127,8 @@
124127
"CPPCHECK_WARNING","error[obsoleteFunctions]","CWE-477"
125128
"CPPCHECK_WARNING","error[operatorEq]","CWE-480"
126129
"CPPCHECK_WARNING","error[outOfBounds]","CWE-805"
130+
"CPPCHECK_WARNING","error[overlappingWriteUnion]","CWE-758"
131+
"CPPCHECK_WARNING","error[overlappingWriteFunction]","CWE-758"
127132
"CPPCHECK_WARNING","error[passedByValue]","CWE-686"
128133
"CPPCHECK_WARNING","error[pointerArithBool]","CWE-571"
129134
"CPPCHECK_WARNING","error[pointerOutOfBounds]","CWE-823"
@@ -165,8 +170,8 @@
165170
"CPPCHECK_WARNING","error[uninitdata]","CWE-456"
166171
"CPPCHECK_WARNING","error[uninitstring]","CWE-170"
167172
"CPPCHECK_WARNING","error[uninitStructMember]","CWE-909"
168-
"CPPCHECK_WARNING","error[uninitvar]","CWE-456"
169-
"CPPCHECK_WARNING","error[uninitVar]","CWE-456"
173+
"CPPCHECK_WARNING","error[uninitvar]","CWE-457"
174+
"CPPCHECK_WARNING","error[uninitVar]","CWE-457"
170175
"CPPCHECK_WARNING","error[unknownEvaluationOrder]","CWE-768"
171176
"CPPCHECK_WARNING","error[unsignedPositive]","CWE-571"
172177
"CPPCHECK_WARNING","error[unusedScopedObject]","CWE-826"
@@ -186,7 +191,6 @@
186191
"CPPCHECK_WARNING","warning[invalidScanfArgType_int]","CWE-686"
187192
"CPPCHECK_WARNING","warning[invalidScanfArgType_s]","CWE-686"
188193
"CPPCHECK_WARNING","warning[nullPointer]","CWE-476"
189-
"CPPCHECK_WARNING","warning[pureVirtualCall]","CWE-MAP-NOMATCH"
190194
"CTOR_DTOR_LEAK","ctor_dtor_leak","CWE-772"
191195
"DC.STREAM_BUFFER","dont_call","CWE-120"
192196
"DC.WEAK_CRYPTO","dont_call","CWE-327"
@@ -250,6 +254,7 @@
250254
"LOCK_INVERSION","getlock","CWE-833"
251255
"MISSING_BREAK","fallthrough","CWE-484"
252256
"MISSING_LOCK","missing_lock","CWE-667"
257+
"MISSING_MOVE_ASSIGNMENT","missing_move_assignment","CWE-710"
253258
"MISSING_RETURN","missing_return","CWE-710"
254259
"NEGATIVE_RETURNS","negative_returns","CWE-394"
255260
"NEGATIVE_RETURNS","var_tested_neg","CWE-394"
@@ -336,27 +341,28 @@
336341
"SECURE_TEMP","secure_temp","CWE-377"
337342
"SHELLCHECK_WARNING","error[SC1008]","CWE-398"
338343
"SHELLCHECK_WARNING","error[SC1019]","CWE-398"
339-
"SHELLCHECK_WARNING","error[SC1020]","CWE-398"
344+
"SHELLCHECK_WARNING","error[SC1020]","CWE-569"
345+
"SHELLCHECK_WARNING","error[SC1035]","CWE-569"
340346
"SHELLCHECK_WARNING","error[SC1036]","CWE-398"
341347
"SHELLCHECK_WARNING","error[SC1061]","CWE-398"
342348
"SHELLCHECK_WARNING","error[SC1062]","CWE-398"
343349
"SHELLCHECK_WARNING","error[SC1064]","CWE-398"
344350
"SHELLCHECK_WARNING","error[SC1065]","CWE-398"
345-
"SHELLCHECK_WARNING","error[SC1068]","CWE-398"
351+
"SHELLCHECK_WARNING","error[SC1068]","CWE-456"
346352
"SHELLCHECK_WARNING","error[SC1071]","CWE-398"
347353
"SHELLCHECK_WARNING","error[SC1072]","CWE-398"
348354
"SHELLCHECK_WARNING","error[SC1073]","CWE-398"
349355
"SHELLCHECK_WARNING","error[SC1075]","CWE-398"
350356
"SHELLCHECK_WARNING","error[SC1087]","CWE-398"
351357
"SHELLCHECK_WARNING","error[SC1088]","CWE-398"
352358
"SHELLCHECK_WARNING","error[SC1089]","CWE-398"
353-
"SHELLCHECK_WARNING","error[SC1097]","CWE-398"
359+
"SHELLCHECK_WARNING","error[SC1097]","CWE-482"
354360
"SHELLCHECK_WARNING","error[SC1101]","CWE-398"
355361
"SHELLCHECK_WARNING","error[SC1113]","CWE-398"
356362
"SHELLCHECK_WARNING","error[SC1127]","CWE-398"
357363
"SHELLCHECK_WARNING","error[SC1128]","CWE-398"
358364
"SHELLCHECK_WARNING","error[SC2045]","CWE-398"
359-
"SHELLCHECK_WARNING","error[SC2068]","CWE-398"
365+
"SHELLCHECK_WARNING","error[SC2068]","CWE-88"
360366
"SHELLCHECK_WARNING","error[SC2070]","CWE-398"
361367
"SHELLCHECK_WARNING","error[SC2071]","CWE-398"
362368
"SHELLCHECK_WARNING","error[SC2076]","CWE-398"
@@ -366,85 +372,92 @@
366372
"SHELLCHECK_WARNING","error[SC2105]","CWE-398"
367373
"SHELLCHECK_WARNING","error[SC2127]","CWE-398"
368374
"SHELLCHECK_WARNING","error[SC2142]","CWE-398"
369-
"SHELLCHECK_WARNING","error[SC2145]","CWE-398"
370-
"SHELLCHECK_WARNING","error[SC2148]","CWE-398"
375+
"SHELLCHECK_WARNING","error[SC2145]","CWE-138"
376+
"SHELLCHECK_WARNING","error[SC2148]","CWE-758"
377+
"SHELLCHECK_WARNING","error[SC2168]","CWE-1126"
371378
"SHELLCHECK_WARNING","error[SC2173]","CWE-398"
372379
"SHELLCHECK_WARNING","error[SC2199]","CWE-398"
373-
"SHELLCHECK_WARNING","error[SC2218]","CWE-398"
374-
"SHELLCHECK_WARNING","error[SC2242]","CWE-398"
375-
"SHELLCHECK_WARNING","warning[SC1007]","CWE-398"
380+
"SHELLCHECK_WARNING","error[SC2218]","CWE-758"
381+
"SHELLCHECK_WARNING","error[SC2242]","CWE-393"
382+
"SHELLCHECK_WARNING","warning[SC1007]","CWE-480"
376383
"SHELLCHECK_WARNING","warning[SC1010]","CWE-398"
377384
"SHELLCHECK_WARNING","warning[SC1011]","CWE-398"
378385
"SHELLCHECK_WARNING","warning[SC1078]","CWE-398"
379-
"SHELLCHECK_WARNING","warning[SC1083]","CWE-398"
386+
"SHELLCHECK_WARNING","warning[SC1083]","CWE-569"
380387
"SHELLCHECK_WARNING","warning[SC1090]","CWE-398"
381388
"SHELLCHECK_WARNING","warning[SC1098]","CWE-398"
382389
"SHELLCHECK_WARNING","warning[SC2010]","CWE-398"
383-
"SHELLCHECK_WARNING","warning[SC2027]","CWE-398"
384-
"SHELLCHECK_WARNING","warning[SC2034]","CWE-398"
390+
"SHELLCHECK_WARNING","warning[SC2011]","CWE-398"
391+
"SHELLCHECK_WARNING","warning[SC2027]","CWE-149"
392+
"SHELLCHECK_WARNING","warning[SC2034]","CWE-563"
385393
"SHELLCHECK_WARNING","warning[SC2038]","CWE-398"
386-
"SHELLCHECK_WARNING","warning[SC2039]","CWE-398"
394+
"SHELLCHECK_WARNING","warning[SC2039]","CWE-475"
387395
"SHELLCHECK_WARNING","warning[SC2041]","CWE-398"
388-
"SHELLCHECK_WARNING","warning[SC2043]","CWE-398"
396+
"SHELLCHECK_WARNING","warning[SC2043]","CWE-1164"
389397
"SHELLCHECK_WARNING","warning[SC2044]","CWE-398"
390398
"SHELLCHECK_WARNING","warning[SC2045]","CWE-398"
391-
"SHELLCHECK_WARNING","warning[SC2046]","CWE-398"
392-
"SHELLCHECK_WARNING","warning[SC2048]","CWE-398"
399+
"SHELLCHECK_WARNING","warning[SC2046]","CWE-156"
400+
"SHELLCHECK_WARNING","warning[SC2048]","CWE-569"
393401
"SHELLCHECK_WARNING","warning[SC2050]","CWE-398"
394-
"SHELLCHECK_WARNING","warning[SC2053]","CWE-398"
402+
"SHELLCHECK_WARNING","warning[SC2051]","CWE-398"
403+
"SHELLCHECK_WARNING","warning[SC2053]","CWE-153"
395404
"SHELLCHECK_WARNING","warning[SC2060]","CWE-398"
396405
"SHELLCHECK_WARNING","warning[SC2061]","CWE-398"
397406
"SHELLCHECK_WARNING","warning[SC2062]","CWE-398"
398-
"SHELLCHECK_WARNING","warning[SC2064]","CWE-398"
399-
"SHELLCHECK_WARNING","warning[SC2065]","CWE-398"
400-
"SHELLCHECK_WARNING","warning[SC2069]","CWE-398"
407+
"SHELLCHECK_WARNING","warning[SC2064]","CWE-569"
408+
"SHELLCHECK_WARNING","warning[SC2065]","CWE-697"
409+
"SHELLCHECK_WARNING","warning[SC2069]","CWE-783"
401410
"SHELLCHECK_WARNING","warning[SC2088]","CWE-398"
402-
"SHELLCHECK_WARNING","warning[SC2089]","CWE-398"
403-
"SHELLCHECK_WARNING","warning[SC2090]","CWE-398"
404-
"SHELLCHECK_WARNING","warning[SC2091]","CWE-398"
405-
"SHELLCHECK_WARNING","warning[SC2092]","CWE-398"
406-
"SHELLCHECK_WARNING","warning[SC2093]","CWE-398"
411+
"SHELLCHECK_WARNING","warning[SC2089]","CWE-569"
412+
"SHELLCHECK_WARNING","warning[SC2090]","CWE-569"
413+
"SHELLCHECK_WARNING","warning[SC2091]","CWE-829"
414+
"SHELLCHECK_WARNING","warning[SC2092]","CWE-829"
415+
"SHELLCHECK_WARNING","warning[SC2093]","CWE-561"
407416
"SHELLCHECK_WARNING","warning[SC2097]","CWE-398"
408417
"SHELLCHECK_WARNING","warning[SC2098]","CWE-398"
409418
"SHELLCHECK_WARNING","warning[SC2100]","CWE-398"
410419
"SHELLCHECK_WARNING","warning[SC2112]","CWE-398"
411420
"SHELLCHECK_WARNING","warning[SC2113]","CWE-398"
412421
"SHELLCHECK_WARNING","warning[SC2114]","CWE-398"
413422
"SHELLCHECK_WARNING","warning[SC2115]","CWE-398"
414-
"SHELLCHECK_WARNING","warning[SC2120]","CWE-398"
415-
"SHELLCHECK_WARNING","warning[SC2121]","CWE-398"
416-
"SHELLCHECK_WARNING","warning[SC2124]","CWE-398"
417-
"SHELLCHECK_WARNING","warning[SC2125]","CWE-398"
418-
"SHELLCHECK_WARNING","warning[SC2128]","CWE-398"
419-
"SHELLCHECK_WARNING","warning[SC2140]","CWE-398"
420-
"SHELLCHECK_WARNING","warning[SC2153]","CWE-398"
421-
"SHELLCHECK_WARNING","warning[SC2154]","CWE-398"
422-
"SHELLCHECK_WARNING","warning[SC2155]","CWE-398"
423+
"SHELLCHECK_WARNING","warning[SC2120]","CWE-685"
424+
"SHELLCHECK_WARNING","warning[SC2121]","CWE-456"
425+
"SHELLCHECK_WARNING","warning[SC2124]","CWE-569"
426+
"SHELLCHECK_WARNING","warning[SC2125]","CWE-569"
427+
"SHELLCHECK_WARNING","warning[SC2128]","CWE-670"
428+
"SHELLCHECK_WARNING","warning[SC2140]","CWE-149"
429+
"SHELLCHECK_WARNING","warning[SC2153]","CWE-457"
430+
"SHELLCHECK_WARNING","warning[SC2154]","CWE-457"
431+
"SHELLCHECK_WARNING","warning[SC2155]","CWE-571"
423432
"SHELLCHECK_WARNING","warning[SC2156]","CWE-398"
424433
"SHELLCHECK_WARNING","warning[SC2163]","CWE-398"
425-
"SHELLCHECK_WARNING","warning[SC2164]","CWE-398"
426-
"SHELLCHECK_WARNING","warning[SC2165]","CWE-398"
427-
"SHELLCHECK_WARNING","warning[SC2166]","CWE-398"
428-
"SHELLCHECK_WARNING","warning[SC2167]","CWE-398"
434+
"SHELLCHECK_WARNING","warning[SC2164]","CWE-252"
435+
"SHELLCHECK_WARNING","warning[SC2165]","CWE-1095"
436+
"SHELLCHECK_WARNING","warning[SC2166]","CWE-477"
437+
"SHELLCHECK_WARNING","warning[SC2167]","CWE-1095"
429438
"SHELLCHECK_WARNING","warning[SC2172]","CWE-398"
430-
"SHELLCHECK_WARNING","warning[SC2174]","CWE-398"
439+
"SHELLCHECK_WARNING","warning[SC2174]","CWE-277"
431440
"SHELLCHECK_WARNING","warning[SC2178]","CWE-398"
432441
"SHELLCHECK_WARNING","warning[SC2183]","CWE-398"
433442
"SHELLCHECK_WARNING","warning[SC2184]","CWE-398"
434443
"SHELLCHECK_WARNING","warning[SC2186]","CWE-398"
435-
"SHELLCHECK_WARNING","warning[SC2188]","CWE-398"
444+
"SHELLCHECK_WARNING","warning[SC2188]","CWE-569"
436445
"SHELLCHECK_WARNING","warning[SC2198]","CWE-398"
437-
"SHELLCHECK_WARNING","warning[SC2206]","CWE-398"
438-
"SHELLCHECK_WARNING","warning[SC2207]","CWE-398"
439-
"SHELLCHECK_WARNING","warning[SC2209]","CWE-398"
446+
"SHELLCHECK_WARNING","warning[SC2206]","CWE-140"
447+
"SHELLCHECK_WARNING","warning[SC2207]","CWE-140"
448+
"SHELLCHECK_WARNING","warning[SC2209]","CWE-456"
440449
"SHELLCHECK_WARNING","warning[SC2211]","CWE-398"
441450
"SHELLCHECK_WARNING","warning[SC2214]","CWE-398"
442451
"SHELLCHECK_WARNING","warning[SC2217]","CWE-398"
443-
"SHELLCHECK_WARNING","warning[SC2221]","CWE-398"
444-
"SHELLCHECK_WARNING","warning[SC2222]","CWE-398"
452+
"SHELLCHECK_WARNING","warning[SC2221]","CWE-569"
453+
"SHELLCHECK_WARNING","warning[SC2222]","CWE-569"
445454
"SHELLCHECK_WARNING","warning[SC2229]","CWE-398"
446455
"SHELLCHECK_WARNING","warning[SC2238]","CWE-398"
447456
"SHELLCHECK_WARNING","warning[SC2240]","CWE-398"
457+
"SHELLCHECK_WARNING","warning[SC2247]","CWE-398"
458+
"SHELLCHECK_WARNING","warning[SC2254]","CWE-691"
459+
"SHELLCHECK_WARNING","warning[SC2256]","CWE-398"
460+
"SHELLCHECK_WARNING","warning[SC2258]","CWE-398"
448461
"SIGN_EXTENSION","sign_extension","CWE-194"
449462
"SIZECHECK","ampersand_in_size","CWE-131"
450463
"SIZECHECK","incorrect_multiplication","CWE-131"
@@ -459,8 +472,6 @@
459472
"STACK_USE","stack_use_local_overflow","CWE-400"
460473
"STACK_USE","stack_use_overflow","CWE-400"
461474
"STRAY_SEMICOLON","stray_semicolon","CWE-398"
462-
"STREAM_FORMAT_STATE","format_changed","CWE-MAP-NOMATCH"
463-
"STREAM_FORMAT_STATE","format_restored","CWE-MAP-NOMATCH"
464475
"STRING_NULL","string_null","CWE-170"
465476
"STRING_OVERFLOW","fixed_size_dest","CWE-120"
466477
"STRING_OVERFLOW","parameter_as_source","CWE-120"
@@ -476,6 +487,7 @@
476487
"UNCAUGHT_EXCEPT","exception_thrown","CWE-248"
477488
"UNCAUGHT_EXCEPT","rethrow","CWE-248"
478489
"UNEXPECTED_CONTROL_FLOW","do_while_false_condition","CWE-398"
490+
"UNICONTROL_WARNING","warning","CWE-94"
479491
"UNINIT_CTOR","member_not_init_in_gen_ctor","CWE-456"
480492
"UNINIT_CTOR","uninit_member","CWE-456"
481493
"UNINIT","uninit_use","CWE-457"
@@ -495,6 +507,7 @@
495507
"USE_AFTER_FREE","pass_freed_arg","CWE-416"
496508
"USE_AFTER_FREE","use_after_free","CWE-416"
497509
"USE_AFTER_FREE","use_closed_file","CWE-672"
510+
"USELESS_CALL","side_effect_free","CWE-252"
498511
"VARARGS","missing_va_end","CWE-237"
499512
"VARARGS","va_arg","CWE-237"
500513
"VOLATILE_ATOMICITY","stale_update","CWE-366"

0 commit comments

Comments
 (0)