Merge ~alexmurray/ubuntu-security-tools:uaudit-add-dlint into ubuntu-security-tools:master

[Alex Murray]

Add support for using dlint to analyse python code

[Seth Arnold (seth-arnold)]

Heh, at first I thought this was the deb dlint package, to check zone files. That seemed unlikely..

How do the snap vs deb installation sources get handled? eg there's no cppcheck snap, but:

static_analysis_tools = [
    StaticAnalysisTool("cppcheck",
                       cmd=['cppcheck', '--max-configs=15', '-j 8', '-q', '.'],
                       summary=['grep', '-c', '^[a-z]', OUTPUT_FILE]),

this doesn't seem to override source named parameter/field to request a deb installation source.

Thanks

[Alex Murray (alexmurray)]

Since I want to try and use a common version of cppcheck no matter which Ubuntu release a security team member is running then I haven't overridden cppcheck to use the deb - this way we get consistent analysis results no matter who is doing the audit.

[Alex Murray (alexmurray)]

Oh my mistake - I thought there was a cppcheck snap - ignore that comment then - so yes you are right, cppcheck should override to install the deb.

Unmerged commits

666de84... by Alex Murray on 2022-07-18

uaudit: Add additional python static analysis via dlint

Signed-off-by: Alex Murray <email address hidden>

7b38254... by Alex Murray on 2022-07-18

uaudit: Run static analysis tools with full paths to source code

This should in general then produce output files containing the full paths
to the various files in the source code tree to make jumping to the various
errors easier.

Signed-off-by: Alex Murray <email address hidden>

diff --git a/audits/uaudit b/audits/uaudit
index 75e9594..b6909a9 100755
--- a/audits/uaudit
+++ b/audits/uaudit
@@ -71,7 +71,7 @@ class StaticAnalysisTool(object):
 static_analysis_tools = [
     StaticAnalysisTool("cppcheck",
                        cmd=['cppcheck', '--max-configs=15', '-j 8', '-q', '.'],
-                       summary=['grep', '-c', '^[a-z]', OUTPUT_FILE]),
+                       summary=['grep', '-c', '^/', OUTPUT_FILE]),
     StaticAnalysisTool("bandit",
                        # output in a format which we can easily read (-f
                        # custom) and which doesn't truncate results (ie -n
@@ -92,8 +92,11 @@ static_analysis_tools = [
                                       "eval: (setq-local compilation-error-regexp-alist " +
                                       "        '((\"^Line: \\\\([[:digit:]]+\\\\)$\" brakeman-backward-search-filename 1)));"),
                        summary=['grep', '-c', '^Message:', OUTPUT_FILE]),
+    StaticAnalysisTool("dlint",
+                       cmd=['dlint', '.'],
+                       summary=['grep', '-c', '^/', OUTPUT_FILE]),
     StaticAnalysisTool("flawfinder",
-                       summary=['grep', '-c', '^[a-z]', OUTPUT_FILE]),
+                       summary=['grep', '-c', '^/', OUTPUT_FILE]),
     StaticAnalysisTool("shellcheck",
                        cmd=["shellcheck.sh"],
                        summary=['grep', '-c', '^\\./', OUTPUT_FILE]),
@@ -577,10 +580,11 @@ def audit_code(audit_dir, details, disable_coverity=False):
         if os.path.exists(tool_fn):
             warn("Skipping %s. '%s' already exists" % (tool.name, tool_fn))
         else:
-            rc, out = cmd(tool.exec_cmd())
+            cwd = os.getcwd()
+            rc, out = cmd([cwd if i == '.' else i for i in tool.exec_cmd()])
             if rc != 0:
                 warn("Problem %sing code: %s" % (tool.name, str(rc)))
-            out = tool.header.replace("$PWD", os.getcwd()) + out
+            out = tool.header.replace("$PWD", cwd) + out
             write_file(tool_fn, out)
 
         rc, summary = cmd(tool.summary_cmd(tool_fn))