8000 Release 6.25.0 · Ericsson/codechecker · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

6.25.0
Compare
Choose a tag to compare
@dkrupp dkrupp released this 10 Mar 12:45
· 154 commits to master since this release
v6.25.0
d1ca304
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🌟 Highlights

Guideline Statistics page under the statistics tab to generate SEI Cert and CWE Top 25 Compliance reports

A new Guideline Statistics page is added under the statistics tab to generate SEI Cert Compliance reports.
image

This page shows the compliance of an analyzed program to a coding guideline (such as SEI Cert C/C++) . It shows all checkers corresponding to a guideline rule, their configuration status (on/off) and all outstanding and closed reports per guideline rule.

It is possible to generate the table into HTML and CSV format.

The first supported guidelines are SEI Cert C and C++ and CWE Top 25

Facebook Infer as a new C/C++ analyzer plugin

Besides clang-tidy, clang static analyzer, cppcheck and gcc, Facebook Infer is a well known open-source static code analyzer tool https://github.com/facebook/infer

CodeChecker will support executing this analyzer. It will not be enabled by default, but is available for testing.

image

PVS Studio report conversion

From now on, it will be possible to convert the reports of the https://pvs-studio.com/en/pvs-studio/ analyzer and handle them with CodeChecker.
PVS-Studio Static Code Analyzer support by @feeelin in #4356

❗ Backward incompatible changes

  • Resolve checker enable/disable ambiguity by @noraz31 in #4377 and by @cservakt in #4392
    CodeChecker analyze emits an error (instead of a warning) when the enabled checkers/profiles/checker prefix groups are given ambiguously. In these cases the ambiguity must be resolved. For example CodeChecker analyze -e security command is ambiguous as security is a checker group (all checkers starting with security. and a profile at the same time. Please define explicitly CodeChecker -e prefix:security if you mean the prefix group, or profile:security if you mean the security profile.

CodeChecker -e clang-diagnostic-format will give an error, because it is ambiguous if the user means the clang-diagnostic-format single checker, or all checkers starting with clang-diagnostic-format. To refer the former, the user must user checker:clang-diagnostic-format or to the latter prefix:clang-diagnostic-format.

If you have such clashing cases, you must resolve them. The following namespaces can be used
prefix: - to mach checkers starting with a prefix
profile: - to match a checker profile
checker: - to match a single checker
guideline: - to match checkers belonging to a guideline
severity: - to match checkers belonging to a given severity.

  • The skip file handling changed! Adding a --drop-reports-from-skipped-files parameter to analyze by @dkrupp in #4332
    After this patch, the skip files will only skip the analysis of the listed files, but will not filter out any reports. This may result in more reports than before.
    By default CodeChecker used to filter out all reports from files which were on the skip list. This can hide true positive reports starting from unskipped code and ending in skipped files (typical with CTU and header related findings).
    This patch removes the default report filtering post processing step from CodeChecker analyze --skip SKIPFILE operation.
    The legacy functionality is still available with the --drop-reports-from-skipped-files parameter.

  • guideline:sei-cert cannot be used anymore. The sei-cert guideline profile was split to guideline:sei-cert-c for the C guideline and guideline:sei-cert-cpp for the C++ guideline. #4400

  • CodeChecker -e W* syntax is not supported anymore. Clang warnings only appear as clang-diagnostic-* checkers and they can be enabled using the standard checker checker on/off mechanism e.g. CodeChecker analyze -e clang-diagnostic-unused-function

  • The --saargs, --tidyargs and --cppcheckargs flags are now deprecated. The corresponding analyzer configuration option should be used instead, e.g. --analyzer-config clangsa:cc-verbatim-args-file=<filename>. The old flags are still working, but will be converted to the new form under the hood.

🐛 Analyzer improvements

  • [fix] Resolve checker enable/disable ambiguity #4392
  • [fix] Don't capture cc1 by the logger. by @bruntib in #4300
  • Add -mmitigate-rop to ignored options by @noraz31 in #4295
  • Removing alpha checkers from the security profile so it can be used in production by @dkrupp in #4284
  • [analyzer] Adds -fno-freestanding to ignored GCC compiler flags by @ArchieAtkinson in #4281
  • [analyzer] Disable clang-diagnostic-error checker by @cservakt in #4325
  • [analyzer] Ignore -fno-printf-return-value by @pdgendt in #4329
  • [anayzer] Fb infer by @stt08 in #4257
  • [feat] Introduce cc-verbatim-args-file @bruntib #4456

💻 CLI/Server improvements

🌳 Environment

📖 Documentation updates

  • Modified documentation to match current procedures for changing schema by @feyruzb in #4366
  • chore: Remove ancient, unused docs/checker_docs.md by @whisperity in #4283
  • additional library was required for venv_dev by @stt08 in #4273

🔨 Other

  • [cfg] Add info for new unix.Chroot Checker by @vabridgers #4391
  • Add test for Disable clang-diagnostic-error checker #4325 by @noraz31 in #4339
  • Github Actions: stop previous jobs when a new one was pushed by @stt08 in #4351
  • Bring code borrowed from http.server in sync with upstream by @Discookie in #4379
  • [test] Fix test with new clang version by @bruntib in #4382
  • [cmd] Display warning instead of debug log for missing diagtool by @bruntib in #4342
  • [test] The assertDictContainsSubset() is depreceted and removed by @bruntib in #4322
  • [fix] fix compare_results.py sciprt by @bruntib in #4319
  • [script] Script for querying all reports by @bruntib in #4245
  • chore(config): Apply invariant fixes from label-tool by @whisperity in #4291
  • [cfg] Upgrade pycodestyle to 2.12.0 by @bruntib in #4264
  • [version] Bump up version 6.25.0 by @bruntib in #4263
  • Highlight page added for CodeChecker 6.24.0 by @dkrupp in #4260
  • [feat] Adding rule title column for Guideline stat @cservakt #4475
  • [fix] CodeChecker checkers --label option:value doesn't list checkers @bruntib #4471
  • Add CWE Top 25 guideline @noraz31 #4467

New Contributors

Full Changelog: v6.24.4...v6.25.0

What's Changed

New Contributors

Full Changelog: v6.25.0-rc1...v6.25.0

Contributors

tomhughes, whisperity, and 17 other contributors
Assets 2
Loading
0