@codacy/tools-flawfinder-2

Table of Contents

• Overview
• Updating patterns
• Updating the Flawfinder version
• Development
• Notes for maintainers

Overview

C/C++ security scanner using the Flawfinder Python script. Uses the CLI execution strategy -- spawns flawfinder via spawnTool() and parses its SARIF JSON output.

Updating patterns

# Re-fetch pattern metadata from the Codacy API
pnpm prefetch

# Commit the result
git add src/patterns.json

Pattern IDs follow the format flawfinder_strcpy, flawfinder_gets, etc.

Updating the Flawfinder version

1. Update preferredVersion in src/adapter.ts
2. Update the PIP_PACKAGE constant version pin in src/adapter.ts
3. Run pnpm prefetch to check for new/removed rules
4. Run pnpm test to verify compatibility
5. If the major version changes, create a new adapter package (flawfinder-3/)

Development

pnpm build    # Build with tsup
pnpm test     # Run tests (requires flawfinder in PATH or venv)

Installing flawfinder -- the adapter can auto-install via pip install into an isolated venv, or you can install manually:

# Via pip (recommended)
pip install flawfinder==2.0.20

# macOS
brew install flawfinder

# Ubuntu/Debian
apt-get install flawfinder

Notes for maintainers

• Flawfinder is a pure Python script with no compiled dependencies beyond the standard library.
• Installation uses an isolated venv at ~/.codacy/runtimes/flawfinder/venv/ to avoid polluting the system Python.
• The adapter uses --sarif for SARIF v2.1.0 JSON output and --falsepositive to exclude likely false positives (matching the legacy Codacy wrapper behavior).
• Flawfinder has no configuration file -- all options are CLI flags. checkLocalConfigurationFile always returns { found: false }.
• Pattern filtering is done post-hoc since flawfinder has no flag to select individual rules.
• Exit code 0 = success. Exit code 15 = encoding error. Exit code 16 = CLI option error.
• The --minlevel flag is not set, so flawfinder uses its default minimum level of 1 (matching the legacy wrapper).
• SARIF parsing extracts runs[0].results[]. Each result's ruleId is the function name (e.g. "strcpy", "gets").
• The version regex handles both Flawfinder version 2.0.19 and variations in output format.