FLAWFINDER(1) Flawfinder FLAWFINDER(1) (NAME) flawfinder - (<<>>) (SYNOPSIS) flawfinder [--help|-h] [--version] [--listrules] [--allowlink] [--followdotdir] [--nolink] [--patch=filename|-P filename] [--inputs|-I] [ --minlevel=X | -m X ] [--falsepositive|-F] [--neverignore|-n] [--regex=PATTERN | -e PATTERN] [--context|-c] [--columns|-C] [--csv] [--dataonly|-D] [--html|-H] [--immediate|-i] [--sarif] [--singleline|-S] [--omittime] [--quiet|-Q] [--error-level=LEVEL] [--loadhitlist=F] [--savehitlist=F] [--diffhitlist=F] [--] [ ]+ (DESCRIPTION) flawfinder C/C++ . flawfinder . C/C++ ( ) . flawfinder ( <<.>> ) flawfinder C/C++ . flawfinder (build) . unified diff ( "diff -u" GNU "svn diff" "git diff") (patch) --patch (-P) . flawfinder <<>> (hits findings ) . ( ) ( ) . . . flawfinder gettext ( ) gettext . flawfinder _T() _TEXT() . flawfinder . flawfinder --minlevel . () (CWE Common Weakness Enumeration) . flawfinder CWE (CWE-Compatible). "[MS-banned]" http://msdn.microsoft.com/en-us/library/bb288454.aspx . . flawfinder . flawfinder . --inputs . flawfinder . ( ) . : o // Flawfinder: ignore o /* Flawfinder: ignore */ "Flawfinder:" "ITS4:" "RATS:" . --neverignore flawfinder ( --neverignore !). flawfinder << >> (ruleset) . C/C++ . --listrules . ( ) <<>> (hit) << >> (hitlist) . ( --savehitlist) ( --loadhitlist) ( --diffhitlist). flawfinder . flawfinder ( ) ( ) . flawfinder RATS ITS4 . flawfinder . splint gcc clang flawfinder (control flow) (data flow) (data types) . flawfinder (false positive) . flawfinder (link) . ( ) . flawfinder . flawfinder . flawfinder C++ . C++ (parse) . flawfinder (namespaces) (class scopes) . flawfinder (heuristics) . flawfinder C++ << C C++>> C++ < >> . flawfinder . flawfinder . ( C/C++ ) flawfinder . flawfinder C/C++ . flawfinder ".c" ".h" ".ec" ".ecp" ".pgc" ".C" ".cpp" ".CPP" ".cxx" ".c++" ".cc" ".CC" ".pcc" ".hpp" ".H" C/C++ . <<->> (standard input) . ( named pipes) (symbolic links) ( --allowlink )..PP (hits) ( -D ). ( wc -l ) (SLOC) . SLOC () . minlevel ( ) . <<[0] 0 [1] 9>> . ( 3+ ). <<[0+] 37>> ( 0+ <<>> ). KSLOC << >> SLOC . (symlinks) . ( <> ) . ( --minlevel ). : . Flawfinder (continuous integration) . --error-level --error-level=4 flawfinder . Flawfinder GNU GPL (GPLv2+) . Flawfinder ITS4 ( Open Source Definition) ( Free Software Foundation) . Flawfinder ITS4 . RATS Flawfinder RATS . (BRIEF TUTORIAL) flawfinder . C/C++ xyzzy ( ) ( ). (Unix-like) Linux OpenBSD MacOS X . xyzzy flawfinder ( <> ): flawfinder xyzzy | less . ( ) flawfinder . Flawfinder . --minlevel . (false positives) -F . Secure Programming HOWTO https://dwheeler.com/secure-programs . . . /* Flawfinder: ignore */ . . Flawfinder --inputs : flawfinder --inputs xyzzy Flawfinder (IDE) . Flawfinder HTML ( ) OASIS Static Analysis Results Interchange Format (SARIF). . (OPTIONS) Flawfinder : . flawfinder <> POSIX ( ) . Flawfinder GNU ( --option) <> GNU C Library Reference Manual <> GNU Coding Standards . <<--name=value>> <<-name value>> . GNU ..SS " (Documentation)" --help -h (). --version () . --listrules ( tokens) ( () CWE ) Tab. . . -D . 1.29 flawfinder Tab . (Selecting Input Data) --allowlink . . /etc/passwd ( ) flawfinder << >> . ( ). flawfinder ( /dev/zero C:\mystuff\com1) . 1.01 flawfinder . --followdotdir "." . ( .git/ .svn/) ( .makepp) . --nolink . . --patch=patchfile -P patchfile (patch) . unified diff ( GNU "diff -u old new" "svn diff" "git diff [commit]"). Flawfinder . ( ). . / (\ /). unified diff ( GNU diff svn diff git diff ) . . --neverignore . : -P flawfinder . . -P ( ) . (Selecting Hits to Display) --inputs -I minlevel 0 . --minlevel=X -m X X (hitlist). 0 (`` '') 5 (`` '') 1 . --falsepositive -F . "(" . "access" . #define . --neverignore -n ``ignore'' . --regexp=PATTERN -e PATTERN PATTERN . "CWE-120" ``--regex CWE-120'' . grep ..SS " (Selecting Output Format)" --columns -C ( ) ( ). ( ) . --context -c (context) << >>/ . . --csv (CSV). . ( ). --quiet --dataonly . : "File" "Line" "Column" ( ) "Level" ( ) "Category" flawfinder "Name" "Warning" "Suggestion" "Note" "CWEs" CWE "Context" "Fingerprint" SHA-256 ( ). Python3 UTF-8 . --dataonly -D (header) (footer). --quiet . --html -H HTML . --immediate -i ( ). --sarif OASIS Static Analysis Results Interchange Format (SARIF) ( JSON). SARIF 2.1.0 ( ) << >> . SARIF "Flawfinder" . flawfinder (rank) SARIF ( ) (level) SARIF : Flawfinder 0: SARIF rank 0.0, SARIF level note, Flawfinder 1: SARIF rank 0.2, SARIF level note, Flawfinder 2: SARIF rank 0.4, SARIF level note, Flawfinder 3: SARIF rank 0.6, SARIF level warning, / Flawfinder 4: SARIF rank 0.8, SARIF level error, / Flawfinder 5: SARIF rank 1.0, SARIF level error, / Yong Yan SARIF flawfinder! SARIF : --singleline -S . . --omittime . flawfinder . --quiet -Q ( ) . --error-level=LEVEL (false) LEVEL . diffhitlist . (CI) "flawfinder: ignore" . LEVEL . flawfinder (true) ..SS " (Hitlist Management)" --savehitlist=F (<< >> hitlist) F . --loadhitlist=F F . . . Python savehitlist flawfinder Python 3 flawfinder Python 2 . --diffhitlist=F ( ) F . F --savehitlist . . --loadhitlist F . --loadhitlist F . <<>> . (Character Encoding Errors) flawfinder Python . . flawfinder Python 2 . flawfinder Python 3 . Python 3 UTF-8 . UTF-8 Python 3 . flawfinder Python 3 (crash). () ( ). ( ) . flawfinder : Error: encoding error in ,1.c 'utf-8' codec can't decode byte 0xff in position 45: invalid start byte UnicodeDecodeError . : ( ): UTF-8 ( LC_ALL LC_CTYPE) UTF-8 Python3 ( ) . PYTHONUTF8=0 Python3 flawfinder : "PYTHONUTF8=0 python3 flawfinder ...". ( ): . BLAH flawfinder : "PYTHONUTF8=0 LC_ALL=C.BLAH python3 flawfinder ...". "C" =LC_ALL ( "en_US") . : ( UTF-8 Windows-1252 ) ISO-8859-1 (Latin-1) . << ASCII >> . : "PYTHONUTF8=0 LC_ALL=C.ISO-8859-1 python3 flawfinder ...". "PYTHONUTF8=0" . "C" =LC_ALL ( "en_US") . : UTF-8 . "iconv" cvt2utf . ( cvt2utf "pip install cvtutf" ). . . : flawfinder Python 2 Python 3 : "python2 flawfinder ...". : UTF-8 (CI) UTF-8 . . . . (EXAMPLES) flawfinder . . flawfinder (IDE) flawfinder vim emacs ..SS " " flawfinder /usr/src/linux-3.16 C/C++ /usr/src/linux-3.16 ( ) . flawfinder . flawfinder --error-level=4 . C/C++ ( ) ( ) . flawfinder . flawfinder --minlevel=4 . C/C++ ( ) ( ) . flawfinder --inputs mydir C/C++ mydir ( ) ( ). flawfinder --neverignore mydir C/C++ mydir . flawfinder --csv . ( ) CSV. flawfinder ( ) . flawfinder -QD mydir mydir ( ). CSV . -C (--columns) -S (--singleline) . flawfinder -QDSC mydir mydir ( ). . flawfinder . flawfinder --quiet --html --context mydir > results.html C/C++ mydir HTML . ( SourceForge Savannah) . flawfinder --quiet --savehitlist saved.hits *.[ch] .c .h . ( ) saved.hits . flawfinder --diffhitlist saved.hits *.[ch] .c .h saved.hits . saved.hits <<>> . flawfinder --patch recent.patch . recent.patch . flawfinder --regex "CWE-120|CWE-126" src/ src CWE-120 CWE-126 . vim vim "quickfix" flawfinder . flawfinder . flawfinder ( ) vim . vim ( ) flawfinder ( vim). flawfinder FLAWFILE ( "flawfile") vim -q : "vim -q flawfile". ( flawfinder vim) . flawfinder ":!flawfinder-command > FLAWFILE" ":cf FLAWFILE". flawfinder makefile ( "flaw") ":make flaw" . flawfinder . (-S) : flawfinder -SQD . . ":cn" ":cN" ":cr" . ":copen" "quickfix window" ( quickfix) ":cclose" quickfix . . ..SS " emacs (Invoking from emacs)" / emacs << grep>> (grep mode) << compile>> (compile mode) flawfinder . flawfinder . <> <> . <> . compile mode emacs flawfinder . grep mode "M-x grep" flawfinder . compile mode "M-x compile" flawfinder . (meta key) ( ESC ). emacs "grep" "compile" RETURN . grep mode ESC x g r e p RETURN . . : flawfinder -SQDC . . quiet dataonly emacs . () C/C++ . flawfinder emacs . C-x ` (Control-x ) . C-u C-x ` ( control-u control-x ) . *compilation* *grep* return . ( : compilation compile-goto-error .) Mouse-2 ( *compilation* ). grep mode emacs . emacs "grep-regexp-alist" . Emacs "grep" "compilation-error-regexp-alist" . (Invoking from Integrated Development Environments - IDEs) () IDE (plug-ins) . (COMMON WEAKNESS ENUMERATION - CWE) (Common Weakness Enumeration CWE) " ... " (https://cwe.mitre.org/about/faq.html). CWE https://cwe.mitre.org . Flawfinder CWE CWE (CWE-Compatible) . Common Weakness Enumeration (CWE) CWE . CWE-120 CWE " " ( " " Classic Buffer Overflow). CWE . HTML CWE MITRE . flawfinder CWE-Output . CWE flawfinder . CWE CWE . CWE-20 ( ) "CWE-676, CWE-120" CWE . flawfinder CWE/SANS (https://cwe.mitre.org/top25) . CWE CWE-120 ( ). flawfinder CWE . flawfinder CWE "more-general/more-specific" CWE "!" . CWE CWE . "CWE-119!/CWE-120" CWE-119 CWE-120 CWE-119 . "CWE-362/CWE-367!" CWE-367 CWE-362 . (syntax) 1.31 flawfinder 1.31 flawfinder "more-general:more- specific" "more-general!/more-specific" "more- general/more-specific" "more-general/more- specific!" . 1.31 "!" ( ). CWE . 2.7 CWE ( ) . CWE CWE . CWE (/ ) CWE-676 ( ) . . Flawfinder () . CWE CWE CWE . CWE "make show-cwes" . CWE . flawfinder flawfinder CWE . flawfinder CWE . CWE (false positive) flawfinder (false negative) . Flawfinder CWE (/ ) ( << (BUGS)>> ). Flawfinder CWE ( CWE flawfinder "*" CWE/SANS ): o CWE-20: (Improper Input Validation) o CWE-22: ("Path Traversal") o CWE-78: ("OS Command Injection")* o CWE-119: ( *CWE-120 CWE-119!/CWE-120 ) o CWE-120: ("Classic Buffer Overflow")* o CWE-126: (Buffer Over-read) o CWE-134: (Uncontrolled Format String)* o CWE-190: (Integer Overflow or Wraparound)* o CWE-250: (Execution with Unnecessary Privileges) o CWE-327: (Use of a Broken or Risky Cryptographic Algorithm)* o CWE-362: ("Race Condition") o CWE-377: (Insecure Temporary File) o CWE-676: (Use of Potentially Dangerous Function)* o CWE-732: (Incorrect Permission Assignment for Critical Resource)* o CWE-785: ( *CWE-120 CWE-120/CWE-785 ) o CWE-807: (Reliance on Untrusted Inputs in a Security Decision)* o CWE-829: (Inclusion of Functionality from Untrusted Control Sphere)* "--regex" (-e) CWE . (regular expression) CWE : "--regex "CWE-120|CWE-126"". CWE "|" ( "|" ). Flawfinder CWE-Searchable ..PP CWE <<--regex>> ( <<-e>>) . (regular expression) . <> <> . file1 <> CWE . CWE ( flawfinder ) <<--listrules>> . ( ) ( CWE ). CWE . ( ) CWE-327 : <>. <> CWE . --listrules CWE CWE CWE . flawfinder ( ) . CWE CWE flawfinder ( ) . CWE flawfinder CWE . CWE Python . <> . CWE <> CWE . <> ( ) CWE . . (SECURITY) . . . . . . . . flawfinder ( ) . ( ) . . ( ) . ( .) flawfinder . . ( ). . --allowlink ( /etc/passwd) . ( GitHub SourceForge Savannah) ( ) flawfinder . flawfinder ( ) . . . Cygwin . Cygwin ( Windows) flawfinder . Windows ( MS-DOS ). Windows MS-DOS ( <>) (full pathname) . Windows MS-DOS . Flawfinder ( ) . Cygwin Cygwin Windows (hang) . . << >> : CON PRN AUX CLOCK$ NUL COM1-COM9 LPT1-LPT9 ( <>) ( ). (hitlists) . . <> . Flawfinder ( ). flawfinder ..SH " (BUGS)" Flawfinder . (false positive) . Flawfinder Flawfinder (link) (build) . Flawfinder C/C++ . C++ C C++ . Flawfinder cin >> charbuf charbuf char . Flawfinder (type information) <<>>>> <<>>>> . . "hits" Flawfinder ( ) . C . C ( ). C ( C ). . C++ (namespaces) . --falsepositive . Flawfinder . (parsing) #ifdef .. #else Flawfinder . . . . Flawfinder <<#if>> <<#ifdef>> . <<#if VALUE>> VALUE 0 . <<#ifdef VALUE>> VALUE . Flawfinder Flawfinder . . Flawfinder <<#if 0>> <<#endif>> . <<#if 0>> ( ) : () ( ) () . <<#if 0>> . . Flawfinder . gettext(" ) Flawfinder gettext . gettext("hi") + function("bye") . gettext() . (character arrays) (statically defined) . Flawfinder . Flawfinder ( ) ( ) . Flawfinder (application code) . ( ) . . Flawfinder ( filename:linenumber :columnnumber) . /newline linefeed (:) . Flawfinder . Flawfinder CSV ( ). . . (newline) linefeed . : MacOS Windows/MS-DOS Windows/MS-DOS CON: URI/URL . (space) (tab) Flawfinder . Flawfinder (localization) . Flawfinder . Flawfinder ( ) ( ). Flawfinder <<>> . Flawfinder . Flawfinder . ..SH " (SEE ALSO)" flawfinder https://dwheeler.com/flawfinder . Secure Programming HOWTO https://dwheeler.com/secure-programs. (AUTHOR) David A. Wheeler (dwheeler@dwheeler.com). Flawfinder 3 May 2026 FLAWFINDER(1)