Extending CodeSonar

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

CodeSonar^® 9.2p0

CONFIDENTIAL

CodeSecure Inc

Extending CodeSonar

CodeSonar provides several mechanisms for defining new warning classes and adding new checks to the analysis.

CodeSonar supports three approaches for implementing custom checks:

Use the extension API to instrument your project source code: either by editing your existing source files or by implementing special code wrappers in new files. The checks will be performed every time the instrumented code undergoes the CodeSonar build-analysis.

Use the plug-in API to write a new plug-in that implements your check, then install the plug-in where CodeSonar can find it. The plug-in is then run every time a build-analysis is performed on any project.

Use configuration file rules to create checks within certain parameterized domains.

To issue warnings whenever a specified function or set of functions is used, define a class using BAD_FUNCTION_* rules.
To issue warnings whenever a specified macro or set of macros is used, define a class using BAD_MACRO_* rules.
To issue warnings whenever the value of a specified metric falls outside a designated bound, define a class using METRIC_WARNING_* rules.
To issue warnings whenever a specified function or set of functions is invoked with a hardcoded argument in a particular position, define a class using HARDCODED_ARGS_* rules.

We list the configuration rule approach here for the sake of completeness: the remainder of this section is concerned with the plug-in and extension APIs.

The plug-in API is more powerful, but it is easier to implement checks with the extension API.

The following table compares and contrasts the two approaches.

	Plug-In API	Extension API
Checks Can Be In	C++, Python, or C	C or C++
Implement New Checks By	Writing plug-ins that attach additional functionality to the CodeSonar analysis phase.	Instrumenting project code with calls to the extension functions/macros.
Available Granularity	Visitors can be defined for a wide range of IR element types, from variables (ABS_LOC) and program points (PDG_VERTEX) to compilation units and programs; they can also be attached to CFG or call graph traversals.	Anything that can be expressed through a warning trigger (which can incorporate CodeSonar attributes, program variables, or both) in the instrumented code.
Include Extensions By	Saving the finished plug-in in directory $CSONAR/codesonar/plugins.	Explicitly building the check code into each project.
Access to Internal Representation?	yes	no
Language Modules Supported	C/C++, C#, Java	C/C++ only
Tutorial	Custom Checking with CodeSonar Plug-Ins	Custom Checking with the Extension API
SaaS Availability	Users cannot directly install custom plug-ins for use with SaaS analysis: contact CodeSecure support for installation assistance.	Can be used with CodeSonar SaaS with no additional requirements.

Plug-In API

Extension API

Checks Can Be In

C++, Python, or C

C or C++

Implement New Checks By

Writing plug-ins that attach additional functionality to the CodeSonar analysis phase.

Instrumenting project code with calls to the extension functions/macros.

Available Granularity

Visitors can be defined for a wide range of IR element types, from variables (ABS_LOC) and program points (PDG_VERTEX) to compilation units and programs; they can also be attached to CFG or call graph traversals.

Anything that can be expressed through a warning trigger (which can incorporate CodeSonar attributes, program variables, or both) in the instrumented code.

Include Extensions By

Saving the finished plug-in in directory $CSONAR/codesonar/plugins.

Explicitly building the check code into each project.

Access to Internal Representation?

yes

Language Modules Supported

C/C++, C#, Java

C/C++ only

Tutorial

Custom Checking with CodeSonar Plug-Ins

Custom Checking with the Extension API

SaaS Availability

Users cannot directly install custom plug-ins for use with SaaS analysis: contact CodeSecure support for installation assistance.

Can be used with CodeSonar SaaS with no additional requirements.

Learn More

Using the CodeSonar Extension API	Describes the functionality available through the Extension API. Includes links to sections on implementing and including extensions.
The Plug-In API	Describes the components and functionality of the Plug-In API. Includes links to sections on writing plug-ins, and to documentation for the Plug-In API contents.

Using the CodeSonar Extension API

Describes the functionality available through the Extension API. Includes links to sections on implementing and including extensions.

The Plug-In API

Describes the components and functionality of the Plug-In API. Includes links to sections on writing plug-ins, and to documentation for the Plug-In API contents.

To report problems with this documentation, please visit https://support.codesecure.com/.