JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.
If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.
If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.
| CodeSonar® 9.2p0 | CONFIDENTIAL | CodeSecure Inc |
This section lists the parameters that can be set through a CodeSonar general template or general project configuration file.
| Analysis Properties | ||
|---|---|---|
| ANALYSIS_NAME | Specifies a name for the analysis. | |
| ASSIGN_COND_MODE | Determines the scenarios under which Assignment in Conditional warnings are generated. | |
| EXPLORE_SELF_ASSIGNMENT | Specifies whether or not the analysis should explore the possibility of self assignment. | |
| FILE_LISTING_UNDEF_PROCS | For Source Listing pages: specifies whether calls to undefined functions should be specially marked. | |
| GLOBAL_FUNCTION_POINTER_MODE | Specifies whether and how the CodeSonar analysis will propagate function pointers through global variables. | |
| GLOBAL_TAINT_MODE | Specifies how taint propagates through global variables. | |
| LOOP_TAINT_TRANSFER | Specifies whether or not the analysis should transfer taint to loop variables when they are compared to tainted values. | |
| MANAGED_OBJECTS_IO_CHECKSUMS | Specifies whether checksums should be computed/checked when performing I/O in master processes. Generally only necessary if the hardware or network is unreliable. | |
| MANAGED_OBJECTS_IO_KERNEL_BUFFERING | Specifies whether kernel page buffering should be enabled for files that are buffered in userland (according to MANAGED_OBJECTS_IO_BUFFER_CAPACITY), in master processes. | |
| MANAGED_OBJECTS_PROTECT_PAGES | Specifies whether in-memory pages of managed objects should be protected when not in immediate use in master processes. | |
| OFFLINE | Specify whether the CodeSonar build/analysis will be performed offline. | |
| PREPROCESS_ALWAYS | Specifies whether or not preprocessed versions of all compilation units will be saved. | |
| PREPROCESS_IF_FAIL | Specifies whether or not preprocessed versions of compilation units containing parse errors will be saved. | |
| RELAXED_TOPDOWN_FUNCPTR_RESOLUTION | Specifies whether or not CodeSonar can immediately exploit knowledge of function pointer resolvents that might not be known when using other possible parallel analysis schedules. | |
| ROLLBACK_SUMMARIES_ON_ABORT | Specifies whether or not function summaries will be rolled back if TIME_LIMIT_INTRA_EXPLORE expires. | |
| SEARCH_BOUND_NOISE_THRESHOLD | Control the "noisiness" of the path search. | |
| SLAVE_MANAGED_OBJECTS_IO_CHECKSUMS | Specifies whether checksums should be computed/checked when performing I/O in slave processes. Generally only necessary if the hardware or network is unreliable. | |
| SLAVE_MANAGED_OBJECTS_IO_KERNEL_BUFFERING | Specifies whether kernel page buffering should be enabled for files that are buffered in userland (according to SLAVE_MANAGED_OBJECTS_IO_BUFFER_CAPACITY), in slave processes. | |
| SLAVE_MANAGED_OBJECTS_PROTECT_PAGES | Specifies whether in-memory pages of managed objects should be protected when not in immediate use in slave processes. | |
| UNINITIALIZED_GLOBALS | Specifies whether global variables without explicit initialization should be treated as uninitialized and therefore subject to Uninitialized Variable warnings. | |
| VERBOSITY | Specifies status message verbosity | |
| XML_DUMP_MODE | Specifies whether analysis daemon should write the content of a warning to an XML file when it sends the warning to the hub. | |
| Analysis Resource and Effort Limits | ||
| ALWAYS_EXPAND_FUNCTIONS | Specifies certain functions by name that should always be expanded when CALL_SITE_EXPANSIONS is not None. | |
| ARRAY_CTOR_CALL_LIMIT | Specifies an upper bound on the number of constructor calls CodeSonar is willing to make for each end of an array. | |
| AST_DEPTH_LIMIT | Specifies an upper bound on the depth of expression ASTs. | |
| CALL_SITE_EXPANSIONS | Specifies the extent to which the CodeSonar analysis will expand call sites for full analysis instead of using summaries to approximate the behavior of the call. | |
| CALL_SITE_EXPANSION_BOUND | Places a bound on the nesting depth of call site expansions (nested "+" widgets in warning reports). | |
| CONSTEXPR_CALL_DEPTH_LIMIT | Specifies an upper bound on the depth of constexpr calls that can be folded | |
| CSHARP_ANALYSIS_JVM_CONCURRENCY | Specifies the number of CPUs that the JVM executing the C# analysis is allowed to use. | |
| CSHARP_ANALYSIS_MAX_MEMORY | In combination with CSHARP_ANALYSIS_MEMORY_MANAGEMENT, specifies the maximum amount of memory that the C# build/analysis can use in megabytes (MiB). | |
| CSHARP_ANALYSIS_MEMORY_MANAGEMENT | In combination with CSHARP_ANALYSIS_MAX_MEMORY, specifies how the C# build/analysis will manage its memory limit. | |
| CSHARP_LAUNCHER_MEMORY | Specifies the maximum amount of memory that the C# build/analysis launcher can use in megabytes (MiB). | |
| DATA_RACE_BARRIER_PERIOD | Controls a trade off between analysis performance and Data Race false negatives. | |
| ERROR_LIMIT_PER_COMPILATION | Specifies the maximum number of parse errors allowed in a compilation before the compilation is excluded from the analysis. | |
| EXPLORE_MORE_LOOP_PATHS | Specifies whether or not the analysis should consider an extended set of loop execution scenarios. | |
| IMPLICIT_INITIALIZER_ELT_LIMIT | Specifies an upper bound on the number of implicitly-zero-initialized array elements from a curly-brace initializer CodeSonar will explicitly track, on each end of the implicitly-initialized segment of the array. | |
| INITIALIZER_LIMIT | Specifies an upper bound on the number of elements in an initializer. | |
| JAVA_ANALYSIS_JVM_CONCURRENCY | Specifies the number of CPUs that the JVM executing the Java analysis is allowed to use. | |
| JAVA_ANALYSIS_MAX_MEMORY | In combination with JAVA_ANALYSIS_MEMORY_MANAGEMENT, specifies the maximum amount of memory that the Java build/analysis can use in megabytes (MiB). | |
| JAVA_ANALYSIS_MEMORY_MANAGEMENT | In combination with JAVA_ANALYSIS_MAX_MEMORY, specifies how the Java build/analysis will manage its memory limit. | |
| JAVA_LAUNCHER_MEMORY | Specifies the maximum amount of memory that the Java build/analysis launcher can use in megabytes (MiB). | |
| LOOP_COUNTER_DISTRUST | Specifies how suspicious CodeSonar should be about the value of loop counters in loops whose exact iteration counts are not known. | |
| MANAGED_OBJECTS_IO_BUFFER_CAPACITY | Specifies the amount of memory (in Megabytes) to allocate for I/O buffering in master processes. | |
| MANAGED_OBJECTS_RESIDENT_LIMIT | Specifies the amount of memory (in Megabytes) to allocate for managed IR objects in master processes. | |
| MAX_ATTEMPTED_SIMILAR_PATHS | Bounds the number of potentially similar warnings that CodeSonar will attempt to refine. Both successfully refined warnings and dismissed warnings count against this limit. | |
| MAX_CFG_EDGES | Specifies an approximate upper bound on the number of CFG edges a procedure can have. | |
| MAX_CFG_NODES | Specifies an approximate upper bound on the number of CFG nodes a procedure can have. | |
| MAX_CHECKED_FUNCTION_POINTER_RESOLVENTS | Specifies an upper bound on the number of targets that a function pointer or virtual call site may resolve to in order for interprocedural checking to be performed through that call. | |
| MAX_CHECKED_INPUTS_PER_PROCEDURE | Specifies how many inputs to a procedure can be checked at call sites. | |
| MAX_CHECKS_PER_INPUT | Controls the maximum number of interprocedural checks that will be stored per input per procedure. When analyzing call sites to procedures, the tool examines whether these checks are satisfied in order to flag interprocedural vulnerabilities. | |
| MAX_CHECK_COMPLEXITY | Specifies the maximum complexity of an expression in an interprocedural check. | |
| MAX_CLOBBERED_FIELDS | When a non-const pointer to an object escapes analysis, specifies a bound on the number of transitive fields of that object that the analysis should treat as potentially changed to an unknown value. | |
| MAX_CONCURRENT_BUILD_PROCESSES | Limits the number of concurrent processes in the CodeSonar project build phase. Note that concurrent CodeSonar project building only occurs insofar as your normal build system invokes the compiler concurrently. | |
| MAX_COPIED_FIELDS | Specifies a bound on the number of transitive fields of a type (such as a class or struct) that the CodeSonar analysis will copy by-value when simulating a corresponding by-value copy operation in the software under analysis. | |
| MAX_EXPRESSION_COMPLEXITY | A threshold for expression complexity. | |
| MAX_GLOBAL_CHECK_AGE | Specifies how many levels up the call graph interprocedural checks on global variables can be propagated. | |
| MAX_MATCH_LENGTH | When performing source replacement with SOURCE_PATTERN_REPLACEMENT, this is the size (in bytes) of the buffer used to hold the part of the source file currently undergoing matching. | |
| MAX_MODIFIED_VALUES | Specifies a per-procedure bound on the number of modified values (outputs) that CodeSonar will keep track of in procedure summaries. | |
| MAX_POINTER_ANALYSIS_PASSES | Specifies an upper bound on the number of analysis passes that will take place in the pointer analysis phase. | |
| MAX_SIMILAR_PATHS | Bounds the number of similar warnings that CodeSonar will report. Only successfully refined warnings count against this limit. | |
| MAX_SUMMARIES_PER_PROCEDURE | Controls how many summaries per procedure will be stored in memory. | |
| MINIMUM_GOOD_COMPILATIONS | At least this percentage of the project compilation units must be "good compilations", meaning that they have no more parse errors than the limit specified by ERROR_LIMIT_PER_COMPILATION. | |
| PATH_FINDING_EFFORT | Once a set of paths believed to contain at least one vulnerability is obtained, this many paths from the set will be searched before moving on. | |
| PATH_SHORTENING_EFFORT | Once a set of paths believed to contain at least one vulnerability is obtained, and we have found a particular dangerous path within the set, this many total paths will be searched in an effort to find additional similar warnings within the set, or shorter versions of the same warning. Similar, in this context, is defined as a warning that violates the same (interprocedural) contract. | |
| SEARCH_BOUND | Number of paths under simultaneous consideration when exploring a procedure. | |
| SLAVE_MANAGED_OBJECTS_IO_BUFFER_CAPACITY | Specifies the amount of memory (in Megabytes) to allocate for I/O buffering in slave processes. | |
| SLAVE_MANAGED_OBJECTS_RESIDENT_LIMIT | Specifies the amount of memory (in Megabytes) to allocate for managed IR objects in slave processes. | |
| TAINTED_BUF_TRIGGER_ON_UNKNOWN_BUFFERS | Specifies whether CodeSonar will issue Tainted Buffer Access warnings when the accessed buffer cannot be identified (and so its size cannot be determined). | |
| TAINT_CALLSITE_EXPANSION_EFFORT | Bound effort for expanding callsites during taint refinement. | |
| TAINT_MAX_ATTEMPTED_SIMILAR_PATHS | Bounds the number of potentially similar taint warnings that CodeSonar will attempt to refine. Both successfully refined warnings and dismissed warnings count against this limit. | |
| TAINT_MAX_CHECKED_INPUTS_PER_PROCEDURE | For the taint analysis, specifies how many inputs to a procedure can be checked at call sites. | |
| TAINT_MAX_CHECKED_LOCATIONS_PER_INPUT | For the taint analysis, specifies how many usages of a particular input to a procedure can be checked at call sites. | |
| TAINT_MAX_CHECKED_TAINT_KINDS_PER_PROCEDURE | For the taint analysis, specifies the maximum number of taint kinds for which there can be checks against a single procedure's inputs. | |
| TAINT_MAX_EXPRESSION_COMPLEXITY | For the taint analysis, a threshold for expression complexity. | |
| TAINT_MAX_MODIFIED_VALUES | For the taint analysis, specifies a per-procedure bound on the number of modified values (outputs and side effects) that CodeSonar will keep track of in procedure summaries. | |
| TAINT_MAX_SET_CARDINALITY | For the taint analysis, specifies the maximum size of a points-to set. | |
| TAINT_MAX_SIMILAR_PATHS | Bounds the number of similar taint warnings that CodeSonar will report. Only successfully refined warnings count against this limit. | |
| TAINT_MAX_WARNING_PATH_LENGTH | For warnings implemented by taint analysis, specifies the maximum number of program points along an execution path that will be considered. | |
| TAINT_RANK_BONUS | Specifies whether to adjust the rank of a warning if values relevant to the warning are tainted. | |
| TAINT_SEARCH_BOUND | Bound for searching paths during taint refinement. | |
| TAINT_TRIGGER_ON_GLOBALS | For the taint analysis, specifies whether global inputs to procedures (as opposed to parameter inputs) should be checked for taint, provided the procedure uses them in ways where they should not be tainted. | |
| TRANSACTION_BUFFER_SIZE_LIMIT | Specifies the maximum amount of memory (in megabytes) to allocate in the analysis master for a pending transaction. | |
| Analysis-Side Filtering | ||
| METRIC_FILTER | Allows metrics to be turned on/off, either for an entire metric class or for specific files, procedures, or compilation units. | |
| SKIP_ANALYSIS_OF | Use to specify that certain sets of procedures should not be analyzed. | |
| SYSTEM_INCLUDE_PATHS | Specifies file system paths which contain system include headers. | |
| WARNING_FILTER | Allows warnings to be modified before they are submitted to the hub, or discarded entirely without being submitted. | |
| Treatment of Language Constructs | ||
| ASSUME_FUNCPTR_PARAMETERS_MAYBE_FREED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_FUNCPTR_PARAMETERS_MAYBE_INITIALIZED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_FUNCPTR_PARAMETERS_MAYBE_MODIFIED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_OTHER_PARAMETERS_MAYBE_FREED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_OTHER_PARAMETERS_MAYBE_INITIALIZED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_OTHER_PARAMETERS_MAYBE_MODIFIED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_UNDEFINED_PARAMETERS_MAYBE_FREED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_UNDEFINED_PARAMETERS_MAYBE_INITIALIZED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_UNDEFINED_PARAMETERS_MAYBE_MODIFIED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_VARARG_PARAMETERS_MAYBE_FREED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_VARARG_PARAMETERS_MAYBE_INITIALIZED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| ASSUME_VARARG_PARAMETERS_MAYBE_MODIFIED | For cases where CodeSonar cannot determine this directly, these parameters specify the effects that certain called functions may be assumed to have on their parameters and memory locations that are transitively reachable from those parameters (pointer targets, structure fields, and so on). | |
| FLOAT_IS_ADVERSARIAL | Specifies whether all floating point values should be considered adversarial. | |
| IGNORE_CPP_CODE | Specifies whether or not the CodeSonar analysis should check C++ compilation units. | |
| INFER_CONST | Specifies whether to treat globals and statics as const if they are initialized (explicitly or implicitly) but never assigned to. | |
| MALLOC_FAILURE_BEHAVIOR | Specifies the treatment of allocators such as malloc/calloc/alloca/realloc/new/new[] on failure. | |
| MAX_PERCENT_F_CHARACTERS | Maximum number of characters that %f in printf-family functions will expand to, not including the decimal point or the minus sign. | |
| MAX_PERCENT_LF_CHARACTERS | Maximum number of characters that %lf in printf-family functions will expand to, not including the decimal point or the minus sign. | |
| METHOD_INVOCATION_DEREFERENCE_BEHAVIOR | Specifies whether C++ method invocations should always be treated as if they dereference this at the method invocation site. | |
| MUTEX_FAILURE_BEHAVIOR | Specifies the treatment of lock acquisition and release functions such as pthread_mutex_lock on failure. | |
| NEW_FAILURE_BEHAVIOR | Specifies the treatment of new/new[] on failure. | |
| NO_IMPLICIT_DEFAULT_FOR_ENUM_SWITCH | States that an implicit default clause should not be generated when a switch statement is being parsed. | |
| UNDEFINED_FUNCTIONS_HAVE_SIDE_EFFECTS | Specifies whether or not undefined functions should be considered as having side effects by the Condition Contains Side Effects check. | |
| VOLATILE_TREATMENT | Specifies whether reads through volatile types always result in unknown values. | |
| Metric-Related | ||
| METRIC_DERIVED_DEF | Creates new derived metrics, which are computed by mathematically manipulating values of already existing metrics. | |
| METRIC_FILTER | Allows metrics to be turned on/off, either for an entire metric class or for specific files, procedures, or compilation units. | |
| METRIC_WARNING_BASE_RANK | Specifies a warning condition for a metric; if that condition is met, a warning is reported. | |
| METRIC_WARNING_CATEGORIES | Specifies a warning condition for a metric; if that condition is met, a warning is reported. | |
| METRIC_WARNING_CLASS_NAME | Specifies a warning condition for a metric; if that condition is met, a warning is reported. | |
| METRIC_WARNING_CONDITION | Specifies a warning condition for a metric; if that condition is met, a warning is reported. | |
| METRIC_WARNING_RANK | Specifies a warning condition for a metric; if that condition is met, a warning is reported. | |
| METRIC_WARNING_SIGNIFICANCE | Specifies a warning condition for a metric; if that condition is met, a warning is reported. | |
| Analysis Time Limits | ||
| CPU_SPEED_ADJUSTMENT | Specifies the relative speed of the machine or machines running the analysis. | |
| CSHARP_ANALYSIS_PREPROCESSING_TIMEOUT | Specifies a timeout (in seconds) for the preprocessing phase of the C# build/analysis. | |
| CSHARP_ANALYSIS_TIMEOUT | Specifies a timeout (in seconds) for the overall C# build/analysis. | |
| DAEMON_TIMEOUT | Seconds of inactivity before the analysis daemon shuts down to conserve system resources. | |
| DP_REFINEMENT_APPROXIMATE_TIMEOUT | Specifies the timeout for the decision procedure when performing approximate refinement on warnings. | |
| DP_REFINEMENT_EXACT_TIMEOUT | Specifies the timeout for the decision procedure when performing exact refinement. | |
| FOREGROUND_DAEMON_TIMEOUT | Seconds of inactivity when running in foreground mode before the analysis daemon shuts down to conserve system resources. | |
| JAVA_ANALYSIS_TIMEOUT | Specifies a timeout (in seconds) for the overall Java build/analysis. | |
| TAINT_PLUS_DP_REFINEMENT_TIMEOUT | Specifies the timeout for the decision procedure when performing refinement for "taint+dp" warnings. | |
| TIME_LIMIT_DATA_RACE_PATH_SEARCH | Bounds the time that data race analysis can spend in any subunit of work (threadA, threadB, memory_location). | |
| TIME_LIMIT_DATA_RACE_PATH_SEARCH_PER_PROCEDURE | Used to compute overall time budget for data race refinement. | |
| TIME_LIMIT_INTER_CLASSIFY | Seconds the analysis may spend determining whether potential interprocedural vulnerabilities warrant further examination, per procedure. | |
| TIME_LIMIT_INTRA_CLASSIFY | Seconds the analysis may spend determining whether potential intraprocedural vulnerabilities warrant further examination, per procedure. | |
| TIME_LIMIT_INTRA_EXPLORE | Seconds the analysis may spend doing intraprocedural exploration in a single procedure. | |
| TIME_LIMIT_LEAK_CLASSIFY | Seconds the analysis may spend determining whether potential Leak cases warrant further examination, per procedure. | |
| TIME_LIMIT_LEAK_REFINE | Seconds the analysis may spend refining potential Leak cases, per procedure. | |
| TIME_LIMIT_LIVEVAR | Bounds the time that analysis can spend figuring out live variables in a single procedure. | |
| TIME_LIMIT_PROP_EXHAUSTIVE | Seconds the analysis may spend determining which parts of a procedure have been exhaustively explored. | |
| TIME_LIMIT_REFINE | Seconds the analysis may spend refining potential intra- and interprocedural vulnerabilities, per procedure. | |
| TIME_LIMIT_RESOLVE | Seconds the analysis may spend resolving potential intra- and interprocedural vulnerabilities, per procedure. | |
| TIME_LIMIT_TAINT_REFINE | Bounds the time that taint analysis can spend refining taint warnings in a procedure. | |
| TIME_LIMIT_TAINT_REFINE_PER_PROCEDURE | Used to compute overall time budget for taint refinement. | |
| Designating Specially-Treated Functions | ||
| ALLOCATOR_FUNCTIONS | Specifies allocator functions. Currently only used by the Dynamic Allocation After Initialization check. | |
| ASSERT_FAIL_FUNCTIONS | Specifies functions that will be treated as assertions by the Not Enough Assertions check | |
| BAD_FUNCTION_BASE_RANK | Use the BAD_FUNCTION_* family of parameters to define warning classes that indicate the use of specific (prohibited) functions. | |
| BAD_FUNCTION_CATEGORIES | Use the BAD_FUNCTION_* family of parameters to define warning classes that indicate the use of specific (prohibited) functions. | |
| BAD_FUNCTION_INFO | Use the BAD_FUNCTION_* family of parameters to define warning classes that indicate the use of specific (prohibited) functions. | |
| BAD_FUNCTION_LINK | Use the BAD_FUNCTION_* family of parameters to define warning classes that indicate the use of specific (prohibited) functions. | |
| BAD_FUNCTION_MESSAGE | Use the BAD_FUNCTION_* family of parameters to define warning classes that indicate the use of specific (prohibited) functions. | |
| BAD_FUNCTION_RANK | Use the BAD_FUNCTION_* family of parameters to define warning classes that indicate the use of specific (prohibited) functions. | |
| BAD_FUNCTION_REGEX | Use the BAD_FUNCTION_* family of parameters to define warning classes that indicate the use of specific (prohibited) functions. | |
| BAD_FUNCTION_SIGNIFICANCE | Use the BAD_FUNCTION_* family of parameters to define warning classes that indicate the use of specific (prohibited) functions. | |
| DYN_INIT_FUNCTIONS | Specifies functions that may directly or transitively call allocator functions without triggering a Dynamic Allocation After Initialization warning. | |
| FORMAT_STRING_CHECKER_CHECKED_FUNCS | Specifies function/argument combinations for Format String and Format String Type Error to check. | |
| FORMAT_STRING_CHECKER_IGNORED_FUNCS | Used by Format String and Format String Type Error to specify function/argument combinations that the analysis will NOT check. | |
| LOCK_FUNCTIONS | Used by the CONCURRENCY.LOCK.* checks to identify functions that should be treated as if they directly acquire locks. | |
| LOOP_ONLY_FUNCS | Used by Inappropriate Call Outside Loop to specify functions whose calls should be enclosed in a loop. | |
| PASS_OVER_TRUST_BOUNDARY_CHECKED_FUNCS | Specifies a function/argument combination for functions that pass data over trust boundaries. | |
| PROGRAM_ENTRY_POINTS | Specifies additional functions that should be considered as program entry points. Currently only the Dynamic Allocation After Initialization and Dynamic Thread Creation checks use this parameter. | |
| RETURN_CHECKER_BUILT_IN_CHECKED_FUNCS | Specifies exceptions to the statistical analysis for Ignored Return Value. In particular, specifies:
|
|
| RETURN_CHECKER_BUILT_IN_CHECKED_PURE_FUNCS | Specifies exceptions to the statistical analysis for Ignored Return Value. In particular, specifies:
|
|
| RETURN_CHECKER_CHECKED_FUNCS | Specifies exceptions to the statistical analysis for Ignored Return Value. In particular, specifies:
|
|
| RETURN_CHECKER_CHECKED_PURE_FUNCS | Specifies exceptions to the statistical analysis for Ignored Return Value. In particular, specifies:
|
|
| RETURN_CHECKER_CHECKED_PURE_SOME_PATHS_FUNCS | Specifies exceptions to the statistical analysis for Ignored Return Value. In particular, specifies:
|
|
| RETURN_CHECKER_IGNORED_FUNCS | Used by Ignored Return Value to specify exceptions to the statistical analysis: functions whose return values can be ignored without triggering a warning. | |
| SEMOPEN_FUNCTIONS | Used by the lock-related checks to identify the procedures used to open named semaphores | |
| THREAD_CREATION_FUNCTIONS | Specifies thread creation functions. Currently only used by the Dynamic Thread Creation check. | |
| THREAD_ENTRY_METHOD_NAMES | For programs that use an object-oriented multithreading API. Specifies which method on an object should be considered the "entry method" when the object (or a reference to it) is specified as a thread entry point. | |
| THREAD_INIT_FUNCTIONS | Specifies functions that may directly or transitively call thread creation functions without triggering a Dynamic Thread Creation warning. | |
| UNLOCK_FUNCTIONS | Used by the CONCURRENCY.LOCK.* checks to identify functions that should be treated as if they directly release locks. | |
| Warning-Class-Specific Settings | ||
| COMMENTED_OUT_CODE_MAX_RATIO | Specify upper and lower bounds on the "operator"/"non-operator" character ratio that will be treated as indicating the presence of code for Commented-out Code checks. | |
| COMMENTED_OUT_CODE_MIN_RATIO | Specify upper and lower bounds on the "operator"/"non-operator" character ratio that will be treated as indicating the presence of code for Commented-out Code checks. | |
| COMMENTED_OUT_CODE_SIZE_THRESHOLD | Specifies a comment size threshold for reporting Commented-out Code warnings. | |
| DIV_BY_ZERO_CRASHES | Specifies whether integer division by zero terminates execution or merely results in an unknown value. | |
| DIV_OVERFLOW_CRASHES | Specifies whether signed integer division overflow (e.g., -1 / MIN_INT) should be treated as if it terminates execution, when using 32-bit or wider division. | |
| FORMAT_STRING_CHECKER_CONFIDENCE | Specifies the confidence interval for statistically identifying functions that are usually passed a format string in the k'th parameter position for some k. | |
| FORMAT_STRING_CHECKER_DISCARD_CONFIDENCE | Specifies the confidence interval for statistically determining that a candidate Format String warning can be discarded immediately (that is, before all function calls have been analyzed). | |
| FORMAT_STRING_CHECKER_RATIO | Specifies the threshold for reporting Format String warnings. | |
| MAX_ALLOCATION_SIZE | Specifies the largest allocation size that can be successfully satisfied on the target platform. | |
| MAX_FUNCTION_LENGTH | Used by the Function Too Long check: specifies the maximum allowable length of a function. | |
| MAX_NUM_PARAMS | Specifies the maximum allowable numbers of parameters a function can have to comply with the Too Many Parameters check. | |
| MAX_PERMITTED_DEREFS | Used by the Too Many Dereferences check: specifies the maximum number of dereferencing levels permitted on a single item. | |
| MAX_PERMITTED_INDIRECTION_IN_DECLARATION | Specifies the maximum levels of indirection allowed in a declaration to comply with the Too Much Indirection in Declaration check. | |
| MIN_ASSERTS | Used by the Not Enough Assertions check: specifies the minimum number of assertions each function must contain. | |
| MIN_ASSERTS_FUNCTION_LENGTH | Used by the Not Enough Assertions check: specifies the minimum length a function must have to be subject to the check. | |
| NULL_POINTER_DEREF_CRASHES | Specifies whether dereferences of addresses below the NULL_POINTER_THRESHOLD will terminate execution. | |
| NULL_POINTER_THRESHOLD | Determines what qualifies as a Null Pointer Dereference | |
| OBJSLICE_WARN_NEW_MEMBER_ONLY | Specifies whether Object Slicing warnings should be issued only in the case where the derived class has additional data members not found in the converted-to base class. | |
| OVERFLOWN_SIZE_UPPER_BOUND | Specifies an upper bound on the allowed "size" in some integer overflow warning classes. If the resulting "size" will always exceed the upper bound, then the warning will be dropped. | |
| RETURN_CHECKER_CONFIDENCE | Specifies the confidence interval for statistically identifying functions whose return value is usually checked. | |
| RETURN_CHECKER_DISCARD_CONFIDENCE | Specifies the confidence interval for statistically determining that a candidate Ignored Return Value warning can be discarded immediately (that is, before all function calls have been analyzed). | |
| RETURN_CHECKER_RATIO | Specifies the threshold for reporting Ignored Return Value warnings. | |
| SCOPE_CHECK_SUGGESTS_LOCAL_STATIC | Determines how the analysis will report variables that can be local static but are declared with file or global scope. | |
| STACK_DEPTH_THRESHOLD | Used by the Excessive Stack Depth check: specifies the maximum allowable depth of the call stack, in bytes. | |
| SWITCH_LABEL_CARDINALITY_THRESHOLD | The threshold below which a switch statement has too few cases to trigger switch With Non-enum Expression warning. | |
| SWITCH_LABEL_DENSITY_THRESHOLD | The threshold below which the cases in a switch statement are too sparse to trigger a switch With Non-enum Expression warning. | |
| Fine Tuning for Warnings | ||
| DATA_RACE_MAX_RELATED_PATHS | Controls how many related Data Race warnings get reported. Can greatly influence runtime. | |
| DATA_RACE_PATH_FINDING_EFFORT | Used by the Data Race analysis to limit the amount of effort spent searching for a feasible path in a particular set of potential paths. | |
| DFS_MAX_LOCAL_VISITED | Used by the Recursion, Dynamic Allocation After Initialization, and Dynamic Thread Creation checks: specifies a bound on the number of procedures visited by a single local depth-first search | |
| DFS_MAX_VISITED_COEFFICIENT | Used by the Recursion, Dynamic Allocation After Initialization, and Dynamic Thread Creation checks to compute an upper bound on the number of procedures the depth-first search in these checks can visit in an incremental run. | |
| DFS_MAX_VISITED_CONSTANT | Used by the Recursion, Dynamic Allocation After Initialization, and Dynamic Thread Creation checks to compute an upper bound on the number of procedures the depth-first search in these checks can visit in an incremental run. | |
| DISABLED_TAINT_KINDS | Specifies a set of taint kinds that should be ignored by the taint analysis. | |
| DP_REFINEMENT_APPROXIMATE | Specifies whether or not the analysis will apply "approximate" decision procedure refinement to warning paths. Decision procedure refinement aims to filter out some warnings that cannot occur in practice. | |
| DP_REFINEMENT_APPROXIMATE_DISMISS | Specifies whether or not warnings will be dismissed outright if approximate refinement determines that they cannot occur. | |
| DP_REFINEMENT_APPROXIMATE_DISMISS_TIMEOUT | Specifies whether or not warnings will be dismissed if the decision procedure times out during approximate refinement. | |
| DP_REFINEMENT_EXACT | Specifies whether or not the analysis will apply "exact" decision procedure refinement to warning paths. Decision procedure refinement aims to filter out some warnings that cannot occur in practice. | |
| DP_REFINEMENT_EXACT_DISMISS | Specifies whether or not warnings will be dismissed outright if exact refinement determines that they cannot occur. | |
| DP_REFINEMENT_EXACT_DISMISS_TIMEOUT | Specifies whether or not warnings will be dismissed if the decision procedure times out during exact refinement. | |
| FORMAT_STRING_WARN_ON_EQUAL_SIZE | Specifies whether or not a Format String Type Error warning should be issued when the integer kind of the type of an argument does not match the integer kind of the format string specifier, but the two integer kinds have equal sizes. | |
| FORMAT_STRING_WARN_ON_SIGN_MISMATCH | Specifies whether or not a Format String Type Error warning should be issued when the sign of the type of an argument does not match the sign of the format string specifier. | |
| MISRA_SHIFT_AMOUNT_EXCEEDS_BIT_WIDTH | Specifies whether Shift Amount Exceeds Bit Width checks should follow MISRA rules (as opposed to the C standards) for determining whether an arithmetic-shift operation exceeds the number of bits occupied by the left-hand operand of the operation. | |
| POINTED_TO_CAPACITY_DEFAULTS_TO_TYPE_BOUNDARY | When the address of a portion of an aggregate is taken, and CodeSonar is not intraprocedurally aware of the size of the underlying allocation, should the "2$Buffer Overrun" warning class checker treat the pointer's capacity as the capacity of the portion (as opposed to the capacity of the underlying allocation)? | |
| REFINE_LEAKS_THOROUGHLY | Setting to "No" will prevent CodeSonar from dismissing likely leak false positives. | |
| REPORT_IMPLIED_EQUALITY | Specifies whether or not implied unsafe behavior due to equality/disequality is sufficient cause to issue warnings. | |
| REPORT_IMPLIED_INEQUALITY | Specifies whether or not implied unsafe behavior due to inequality is sufficient cause to issue warnings. | |
| REPORT_INTER_PARTIAL_UQ_WARNINGS | Determines whether exhaustive interprocedural exploration is required before reporting warnings in classes for which something must hold on all paths. | |
| REPORT_PARTIAL_NTAD_WARNINGS | Determines whether exhaustive exploration is required before issuing a Null Test After Dereference warning. | |
| REPORT_REDUNDANT_CONDITIONS_BASED_ON_CONSTANTS | Specifies whether or not CodeSonar will issue Redundant Condition warnings for conditions testing constant values. | |
| REPORT_SIMILAR_WARNINGS | Specifies whether or not the analysis should report all members of each warning group detected (as opposed to a single representative instance per group). | |
| REPORT_TEMPLATE_UQ_WARNINGS | Determines whether warnings will be reported in templated functions when the warning class is one of those that requires some condition to hold on all paths. | |
| REPORT_UNUSED_ASSIGNMENTS_FROM_CONSTANTS | Specifies whether or not CodeSonar will issue Unused Value warnings for values that arise from constant assignments. | |
| TAINT_PLUS_DP_REFINEMENT | Specifies whether or not the analysis will apply decision procedure refinement for "taint+dp" warnings. | |
| TAINT_PLUS_DP_REFINEMENT_DISMISS | Specifies whether or not "taint+dp" warnings will be dismissed outright if refinement determines that they cannot occur. | |
| TAINT_PLUS_DP_REFINEMENT_DISMISS_TIMEOUT | Specifies whether or not "taint+dp" warnings will be dismissed if the decision procedure times out during refinement of a taint/decision procedure warning. | |
| TYPE_OVERRUN_ON_LAST_ARRAY_FIELD | Specifies whether or not Type Overrun warnings will be issued for a variable length array at the end of a class, struct, or union. | |
| UNDEF_FUNCS_EXHAUSTIVE | Determines whether calls to undefined functions and function pointer calls are considered exhaustively explored. | |
| UNDER_BY_ONE | Specifies whether or not to report Buffer Underrun and Type Underrun warnings when there is a guard that almost contradicts the warning, but not quite, but simultaneously there is not evidence that the index can take on the dangerous value. | |
| UNSIGNED_BRACKET_INEQUALITY | Specifies whether or not CodeSonar will infer that unsigned comparison against an upper bound also implies a lower bound of zero. | |
| WARN_MORE_LOOP_LEAKS | Normally, leak warnings on paths that iterate around a loop multiple times are suppressed. Setting to "Yes" will disable the suppression. | |
| WARN_MORE_LOOP_UVARS | Specifies whether the tracking of variable initialization in loops is tuned to potentially report more Uninitialized Variable warnings. | |
| WARN_POINTER_AT_END | Specifies whether Pointer Past End of Object warnings should be issued for pointers that point to exactly the end of an object. | |
| JAVA | ||
| JAVA_ANALYSIS_TIMEOUT | Specifies a timeout (in seconds) for the overall Java build/analysis. | |
| CSHARP | ||
| CSHARP_ANALYSIS_PREPROCESSING_TIMEOUT | Specifies a timeout (in seconds) for the preprocessing phase of the C# build/analysis. | |
| CSHARP_ANALYSIS_TIMEOUT | Specifies a timeout (in seconds) for the overall C# build/analysis. | |
| Hub and Web GUI | ||
| ABRIDGE_HTML | Determines whether HTML warning reports may abridge procedure listings in order to show only the most relevant parts. | |
| COLLAPSE_PROCEDURES | Specifies whether multiple instances of the same procedure should be collapsed into a single instance for viewing purposes. This primarily affects templated functions which are instantiated with multiple template arguments, and also static inline functions. | |
| FILE_LISTING_UNDEF_PROCS | For Source Listing pages: specifies whether calls to undefined functions should be specially marked. | |
| WEB_CONSOLE | Specifies whether the Python Console will be made available for the analysis (provided the hub is running with debug features enabled). | |
| Operations on Un-Preprocessed Files | ||
| MAX_MATCH_LENGTH | When performing source replacement with SOURCE_PATTERN_REPLACEMENT, this is the size (in bytes) of the buffer used to hold the part of the source file currently undergoing matching. | |
| SOURCE_MODIFIERS | An alternative to SOURCE_PATTERN_REPLACEMENT for specifying regular expression based replacements in the source code. | |
| SOURCE_PATCH_DIRECTORIES | Specifies directories under which patches to source are located. | |
| SOURCE_PATTERN | An alternative to SOURCE_PATTERN_REPLACEMENT for specifying regular expression based replacements in the source code. | |
| SOURCE_PATTERN_REPLACEMENT | Specifies a regular expression based replacement to be carried out over the source code being analyzed (before parsing occurs). | |
| SOURCE_REPLACEMENT | An alternative to SOURCE_PATTERN_REPLACEMENT for specifying regular expression based replacements in the source code. | |
| SOURCE_REPLACE_COMMAND | Specifies a text-replacement command to be executed on each source file being analyzed (before parsing occurs). | |
| Govern the Build/Analysis | ||
| BADFS_NOSLEEP | Specifies whether or not to give users a chance to stop the build when we detect that the file system the project is being put on could cause reliability or performance problems. | |
| CFLAGS_APPEND | Modify the CFLAGs being passed to the parser. | |
| CFLAGS_PREPEND | Modify the CFLAGs being passed to the parser. | |
| CODEWARRIOR_INSTALLS | For use with CodeWarrior installations that use DLLs (see CodeSonar with CodeWarrior: DLL Approach): specifies CodeWarrior install directories so that compiler IDE plug-ins can be identified for interception. | |
| CODEWARRIOR_PLUGINS | For use with CodeWarrior installations that use DLLs (see CodeSonar with CodeWarrior: DLL Approach): specifies individual CodeWarrior compiler IDE plug-ins for interception. | |
| COMPILER_MODELS | Defines a map from compiler executable basenames to compiler models. If your compiler executable basename is not listed below as a 'default', then you should add an entry mapping it to the compiler model it is most similar to. | |
| CREATE_CONSOLE | Specifies whether or not to always create a hidden conhost.exe process when one does not already exist when launching compiler processes. | |
| CSHARP_ANALYSIS_ADVANCED_INJECTION | Specifies whether or not the C# build/analysis will perform advanced checking for injection-related issues. | |
| CSHARP_ANALYSIS_CONCURRENCY_CALLS | When CSHARP_ANALYSIS_CONCURRENCY_GUARDS_MODE=byValue, specifies whether or not the analysis will treat method calls on guarded variables as dereferences of those variables. | |
| CSHARP_ANALYSIS_CONCURRENCY_GUARDS_MODE | Specifies how checks for concurrency warning classes should interpret [GuardedBy] attributes. | |
| CSHARP_ANALYSIS_DEEP_NULLNESS_CONSERVATIVE_CHECK | Specifies whether or not the analysis should treat all inputs received by the application as if they might be null. | |
| CSHARP_ANALYSIS_ENABLE_ASSERTIONS | Specifies whether or not the C# build/analysis will treat assertion statements as if they are executed. | |
| CSHARP_ANALYSIS_ENTRY_POINTS_MODE | Specifies how the C# build/analysis will determine the application's entry points: the methods that can be invoked by the runtime environment and that should be considered starting points of the analysis. | |
| CSHARP_ANALYSIS_FAST_DEEP_CHECK | For warning classes whose checks can involve additional supporting analyses, specifies whether or not those additional analyses should be skipped (generally in order to save time). | |
| CSHARP_ANALYSIS_FIELD_SENSITIVE | Specifies whether or not the C# build/analysis will track information about individual fields of each object. | |
| CSHARP_ANALYSIS_FIELD_VISIBILITY | For warning classes related to field visibility, specifies the field visibility types that will be considered by the warning class checks. | |
| CSHARP_ANALYSIS_FRAMEWORK | Inform the C# build/analysis about the runtime environment of the analyzed application. | |
| CSHARP_ANALYSIS_INITIALIZATION_CHECK | Specifies whether or not a preliminary "class initialization analysis" will be performed before checks for those warning classes that may benefit from it. | |
| CSHARP_ANALYSIS_JVM_OPTIONS | Specifies options to the JVM that will execute the C# build/analysis. | |
| CSHARP_ANALYSIS_MERGE_CREATION_POINTS | Specifies whether or not the C# build/analysis will collapse bytecode instructions that create objects of the same type inside the same class. | |
| CSHARP_ANALYSIS_PEDANTIC_MODE | Specifies whether or not CodeSonar should perform more pedantic checking for certain C# warning classes. | |
| CSHARP_ANALYSIS_STRICT_MODE | Specifies whether or not CodeSonar should perform stricter checking for certain C# warning classes. | |
| CSHARP_ANALYSIS_TRUST_DATABASE | Specifies whether or not the C# taint analysis should trust data that originates from database queries, rather than treating it as tainted. | |
| CSHARP_ANALYSIS_TRUST_DEVICE | Specifies whether or not the C# taint analysis should trust data that originates from the specific device running the application, rather than treating it as tainted. | |
| CSHARP_ANALYSIS_TRUST_ENVIRONMENT | Specifies whether or not the C# taint analysis should trust data that originates from the environment or from system properties, rather than treating it as tainted. | |
| CSHARP_ANALYSIS_TRUST_USER_INPUT | Specifies whether or not the C# taint analysis should trust data that originates from web requests or console input, rather than treating it as tainted. | |
| CSHARP_FLAGS_APPEND | Modify the set of options being passed to the C# build/analysis. | |
| CSHARP_FLAGS_PREPEND | Modify the set of options being passed to the C# build/analysis. | |
| CSHARP_LAUNCHER_JVM_OPTIONS | Customize the execution of the JVM that will execute the C# build/analysis launcher. | |
| CSHARP_PLUGINS | A list of plug-in .NET assemblies. | |
| CSHARP_PLUGIN_DOTNET_VERSION | The version of the .NET framework used to build the assemblies specified by CSHARP_PLUGINS (if any). | |
| DISABLED_COMPILERS | Forces the project builder to ignore certain compilers that it would, by default, notice. | |
| DRY_RUN | Dry runs are useful for counting lines and locating parse errors without running the CodeSonar analysis, and therefore without consuming licensed lines. | |
| EDG_FRONTEND_OPTIONS_APPEND | Specifies front end options to append to the front end command line. | |
| EDG_FRONTEND_OPTIONS_PREPEND | Specifies front end options to prepend to the front end command line, in front of any CodeSurfer build options specified. | |
| ERROR_SUBMISSION_LIMIT_PER_COMPILATION | Specifies the maximum number of parse errors submitted to the hub for a compilation. | |
| FORCE_ENVIRONMENT | Specifies whether or not to prevent the software build system (for example, make) from writing over environment variables necessary for proper process hooking on POSIX systems. | |
| FOREGROUND | Specifies whether or not a "codesonar analyze" command will run the analysis in the codesonar analyze process itself. | |
| HOLD_STDIO | Specifies whether or not to hold the stdout, stderr, and stdin streams open. | |
| HOOK_BLACKLIST | Instructs CodeSonar not to monitor certain executables or their subprocesses. | |
| HUB_ADDRESS | Specifies the hub address CodeSonar should use. | |
| IGNORED_COMPILATIONS | Specifies files whose compilations should be ignored. | |
| IGNORED_COMPILATION_COMMANDS | Specifies compilation commands that should be ignored. | |
| INCREMENTAL_BUILD | Specifies whether or not the build/analysis will be incremental. | |
| INVOKE_COMPILER_FIRST | Specifies whether or not to invoke the real compiler before invoking the CodeSonar parser. | |
| JAVA_ANALYSIS_ADVANCED_INJECTION | Specifies whether or not the Java build/analysis will perform advanced checking for injection-related issues. | |
| JAVA_ANALYSIS_CONCURRENCY_CALLS | When JAVA_ANALYSIS_CONCURRENCY_GUARDS_MODE=byValue, specifies whether or not the analysis will treat method calls on guarded variables as dereferences of those variables. | |
| JAVA_ANALYSIS_CONCURRENCY_GUARDS_MODE | Specifies how checks for concurrency warning classes should interpret @GuardedBy annotations. | |
| JAVA_ANALYSIS_DEEP_NULLNESS_CONSERVATIVE_CHECK | Specifies whether or not the analysis should treat all inputs received by the application as if they might be null. | |
| JAVA_ANALYSIS_ENABLE_ASSERTIONS | Specifies whether or not the Java build/analysis will treat assertion statements as if they are executed. | |
| JAVA_ANALYSIS_ENTRY_POINTS_MODE | Specifies how the Java build/analysis will determine the application's entry points: the methods that can be invoked by the runtime environment and that should be considered starting points of the analysis. | |
| JAVA_ANALYSIS_FAST_DEEP_CHECK | For warning classes whose checks can involve additional supporting analyses, specifies whether or not those additional analyses should be skipped (generally in order to save time). | |
| JAVA_ANALYSIS_FIELD_SENSITIVE | Specifies whether or not the Java build/analysis will track information about individual fields of each object. | |
| JAVA_ANALYSIS_FIELD_VISIBILITY | For warning classes related to field visibility, specifies the field visibility types that will be considered by the warning class checks. | |
| JAVA_ANALYSIS_FRAMEWORK | Inform the Java build/analysis about the runtime environment of the analyzed application. | |
| JAVA_ANALYSIS_INITIALIZATION_CHECK | Specifies whether or not a preliminary "class initialization analysis" will be performed before checks for those warning classes that may benefit from it. | |
| JAVA_ANALYSIS_JVM_OPTIONS | Specifies options to the JVM that will execute the Java build/analysis. | |
| JAVA_ANALYSIS_MERGE_CREATION_POINTS | Specifies whether or not the Java build/analysis will collapse bytecode instructions that create objects of the same type inside the same class. | |
| JAVA_ANALYSIS_PEDANTIC_MODE | Specifies whether or not CodeSonar should perform more pedantic checking for certain Java warning classes. | |
| JAVA_ANALYSIS_REQUIRE_ANDROID_MANIFEST | For Android checks that rely on manifest data, specifies whether or not at least one Android manifest must be submitted in order for the check to be performed. | |
| JAVA_ANALYSIS_STRICT_MODE | Specifies whether or not CodeSonar should perform stricter checking for certain Java warning classes. | |
| JAVA_ANALYSIS_TRUST_DATABASE | Specifies whether or not the Java taint analysis should trust data that originates from database queries, rather than treating it as tainted. | |
| JAVA_ANALYSIS_TRUST_DEVICE | Specifies whether or not the Java taint analysis should trust data that originates from the specific device running the application, rather than treating it as tainted. | |
| JAVA_ANALYSIS_TRUST_ENVIRONMENT | Specifies whether or not the Java taint analysis should trust data that originates from the environment or from system properties, rather than treating it as tainted. | |
| JAVA_ANALYSIS_TRUST_EXTERNAL_STREAMS | Specifies whether or not the Java taint analysis should trust data that originates from external streams or sockets, rather than treating it as tainted. | |
| JAVA_ANALYSIS_TRUST_USER_INPUT | Specifies whether or not the Java taint analysis should trust data that originates from web requests or console input, rather than treating it as tainted. | |
| JAVA_FLAGS_APPEND | Modify the set of options being passed to the Java build/analysis. | |
| JAVA_FLAGS_PREPEND | Modify the set of options being passed to the Java build/analysis. | |
| JAVA_LAUNCHER_JVM_OPTIONS | Customize the execution of the JVM that will execute the Java build/analysis launcher. | |
| JAVA_PLUGIN_CLASSES | Specifies a Java plug-in by naming the Java class whose main() method should be invoked. | |
| JAVA_PLUGIN_CLASSPATH | Specifies the Java classpath for all Java plug-ins. | |
| JAVA_PLUGIN_JVM | Specifies the JVM DLL or shared object to use for all Java plug-ins. | |
| JAVA_PLUGIN_JVM_FLAGS | Specifies additional flags passed to the JVM. | |
| OVERRIDE_COMPILER_CONF | Specifies whether or not compiler models will override type kinds specified in the compiler-specific configuration file with information obtained by invoking the native compiler. It is up to the compiler model implementation to respect this parameter. Currently only the gcc model uses this parameter. | |
| PARAMETER_EVALUATION_ORDER | Specifies the order of evaluation of function parameters. | |
| PLUGINS | Specifies filenames of C++, Python, and C plug-ins to load. | |
| RETAIN_UNNORMALIZED_C_AST | Specifies whether or not CodeSonar will keep the full unnormalized AST information associated with a C/C++ project. | |
| TOLERATE_PARSE_ERRORS | If errors were encountered in parsing the code, specifies whether or not the analysis will run anyway | |
| UNIX_TEXT_MODE | Specifies whether or not to perform crlf -> lf translations on stdout and stderr and do the inverse on stdin. | |
| USE_SERVICES | [Windows only] Specifies whether or not the CodeSonar launch daemon process will be created as a Windows service. | |
| VIRTUAL_COMPILER_PROXY | [Windows only] Specifies whether or not CodeSonar on Windows should virtually proxy compiler executables in order to detect compiler executions. | |
| Additional Outputs from the Build/Analysis | ||
| EMIT_PROCEDURE_SIDE_EFFECTS | Specifies whether or not CodeSonar will output an XML file showing the variables modified by each procedure. | |
| FATSTATS_DUMP_FILE | Use to gather diagnostic information for CodeSonar support. | |
| HOOK_LOG | Specifies a log file for hook* sub-commands. | |
| LOG_COMPILER_ARGUMENT_FILES | Specifies whether or not to log the contents of argument files processed by compiler models to the Native Compilation Details Log. | |
| REACHABILITY_DUMP_FILE | Specifies an output file for diagnostic reachability information. | |
| Other Parameters | ||
| ALLOW_INCOMPATIBLE_SYMANTEC | Specifies whether CodeSonar should be willing to run beside known-incompatible versions of Symantec Endpoint Protection. Certain versions of Symantec Endpoint Protection can trigger Windows kernel deadlock in the presence of CodeSonar. | |
| ANALYSIS_MASTER_KEEPALIVE_PERIOD | Specifies how often the analysis master will broadcast keepalive requests to all analysis slaves. | |
| ANALYSIS_MASTER_LISTEN_INTERFACE | Specifies the address on which the analysis master will listen during the analysis mode phase of the CodeSonar analysis. | |
| ANALYSIS_MASTER_USE_TLS | Specifies whether analysis master<->slave sockets should use TLS. | |
| ANALYSIS_SLAVES | Specifies whether or not the analysis mode phase of the CodeSonar analysis will run in parallel. For local-requesting analysis masters (REQUEST_REMOTE_ANALYSIS_SLAVES=No), additionally specifies a bound below which the analysis master may automatically start new slaves as needed. | |
| ANALYSIS_SLAVE_TIMEOUT | The number of seconds an analysis slave will wait for network operations with the analysis master to time out. | |
| BOOL_TYPES | Specifies a set of types and values that are to be considered as Boolean for the purpose of the MISRA C checks. | |
| BUILD_MASTER_LISTEN_INTERFACE | Specifies the address on which the build master process will listen while it is in build mode (to build the project). | |
| COMPILER_MODEL_PLUGINS | Provide paths to additional compiler model plugins. | |
| CSHARP_ANALYSIS_TRUST_EXTERNAL_STREAMS | Specifies whether or not the C# taint analysis should trust data that originates from external streams or sockets, rather than treating it as tainted. | |
| DAEMON_MASTER_KEEPALIVE_PERIOD | Specifies how often the daemon master will broadcast keepalive requests to all daemon slaves. | |
| DAEMON_MASTER_LISTEN_INTERFACE | Specifies the address on which the daemon master will listen during the daemon mode phase of the CodeSonar analysis. | |
| DAEMON_MASTER_USE_TLS | Specifies whether daemon master<->slave sockets should use TLS. | |
| DAEMON_SLAVES | Specifies whether or not the daemon mode phase of the CodeSonar analysis will run in parallel. For local-requesting daemon masters (REQUEST_REMOTE_DAEMON_SLAVES=No), additionally specifies a bound below which the daemon master may automatically start new slaves as needed. | |
| DAEMON_SLAVE_TIMEOUT | The number of seconds a daemon slave will wait for network operations with the daemon master to time out. | |
| FUNCTION_MAP | Tells CodeSonar that function A works like function B. | |
| FUNCTION_POINTER_RESOLUTION | Enable function pointer resolution. | |
| HARDCODED_ARGS_BASE_RANK | Use the HARDCODED_ARGS_* family of parameters to define warning classes that indicate the use of hardcoded arguments to functions whose arguments should not be hardcoded. | |
| HARDCODED_ARGS_CATEGORIES | Use the HARDCODED_ARGS_* family of parameters to define warning classes that indicate the use of hardcoded arguments to functions whose arguments should not be hardcoded. | |
| HARDCODED_ARGS_CLASS_NAME | Use the HARDCODED_ARGS_* family of parameters to define warning classes that indicate the use of hardcoded arguments to functions whose arguments should not be hardcoded. | |
| HARDCODED_ARGS_LIST | Use the HARDCODED_ARGS_* family of parameters to define warning classes that indicate the use of hardcoded arguments to functions whose arguments should not be hardcoded. | |
| HARDCODED_ARGS_REGEX | Use the HARDCODED_ARGS_* family of parameters to define warning classes that indicate the use of hardcoded arguments to functions whose arguments should not be hardcoded. | |
| HARDCODED_ARGS_SIGNIFICANCE | Use the HARDCODED_ARGS_* family of parameters to define warning classes that indicate the use of hardcoded arguments to functions whose arguments should not be hardcoded. | |
| HUB_UPLOAD_STREAMS | Specifies how many concurrent upload streams may be used to upload warnings to the hub. | |
| LAUNCHD_GROUP | Specifies the parent launchd group for new CodeSonar launch daemons. | |
| LAUNCHD_KEY | Specifies extra key data for CodeSonar launch daemon identification. | |
| LOCK_MAX_PENDING_WARNINGS_PER_PROCEDURE | Bounds the number of potential lock-related warnings that CodeSonar will consider during the analysis of any particular function. | |
| MAX_ANALYSIS_SLAVES | Specifies an upper bound on the total number of CodeSonar analysis slaves. | |
| MAX_DAEMON_SLAVES | Specifies an upper bound on the total number of CodeSonar daemon slaves. | |
| MAX_FAILED_UNITS_OF_WORK | Specifies how many units of work may be failed before the master should terminate the analysis. | |
| MAX_PARSE_SLAVES | Specifies an upper bound on the total number of parse slaves that may be attached to the parse master during the parse mode phase of the CodeSonar analysis. | |
| MAX_SOCKET_LISTEN_BACKLOG | Specifies the size limit for a socket's listen queue. | |
| MEMORY_PER_ANALYSIS_PROCESS | Used to compute analysis slave and daemon slave limits when other settings specify that these computations should be made automatically. | |
| MEMORY_PER_PARSE_PROCESS | Used to compute parse slave limits when other settings specify that these computations should be made automatically. | |
| PARSE_MASTER_KEEPALIVE_PERIOD | Specifies how often the parse master will broadcast keepalive requests to all parse slaves. | |
| PARSE_MASTER_LISTEN_INTERFACE | Specifies the address on which the parse master will listen during the parse mode phase of the CodeSonar analysis. | |
| PARSE_MASTER_USE_TLS | Specifies whether parse master<->slave sockets should use TLS. | |
| PARSE_SLAVES | Specifies whether or not the parse mode phase of the CodeSonar analysis will run in parallel. For local-requesting parse masters (REQUEST_REMOTE_PARSE_SLAVES=No), additionally specifies a bound below which the parse master may automatically start new slaves as needed. | |
| PARSE_SLAVE_TIMEOUT | The number of seconds a parse slave will wait for network operations with the parse master to time out. | |
| PRJ_FILES_SIZE_PREDICTION_LINEAR_MODEL_INTERCEPT | For remote-managed analyses, specify the parameters in the linear model used to estimate the disk requirements for the analysis directory. | |
| PRJ_FILES_SIZE_PREDICTION_LINEAR_MODEL_SLOPE | For remote-managed analyses, specify the parameters in the linear model used to estimate the disk requirements for the analysis directory. | |
| PROCEDURE_METRIC_TIMEOUT | Seconds spent computing a metric for a single procedure before the operation is aborted. | |
| REACHABILITY_ROOTS | Specifies the procedures from which reachability information is computed. | |
| REFINEMENT_BARRIER_PERIOD | Controls a trade off between analysis performance and false negatives for taint-related warnings. | |
| REMOTE_ANALYSIS_LAUNCHD | Specifies that the CodeSonar analyze interval should be remote-managed, using the specified launch daemon. | |
| REMOTE_ANALYSIS_SLAVES_LAUNCHDS | Specifies the launch daemon or daemons from which analysis slaves may be requested. | |
| REMOTE_DAEMON_LAUNCHD | Specifies that the CodeSonar analysis should be remote-managed after it transitions to daemon mode, using the specified launch daemon. | |
| REMOTE_DAEMON_SLAVES_LAUNCHDS | Specifies the launch daemon or daemons from which daemon slaves may be requested. | |
| REMOTE_PARSE_SLAVES_LAUNCHDS | Specifies the launch daemon or daemons from which parse slaves may be requested. | |
| REQUEST_REMOTE_ANALYSIS_SLAVES | Specifies whether or not automatically-started analysis slaves can be distributed through the hub's analysis cloud. | |
| REQUEST_REMOTE_DAEMON_SLAVES | Specifies whether or not automatically-started daemon slaves can be distributed through the hub's analysis cloud. | |
| REQUEST_REMOTE_PARSE_SLAVES | Specifies whether or not automatically-started parse slaves can be distributed through the hub's analysis cloud. | |
| SOURCE_MAX_REACHABLE_FROM_LIBRARIES | Provides a safeguard against misidentifying a large portion of source code as reachable from libraries. | |
| SOURCE_MIN_REACHABLE_FROM_ROOTS | Provides a safeguard against misidentifying a large portion of source code as unreachable. | |
| SRCROOT_PATHS | Specifies base directories for the CodeSonar SARIF generator to use when relativizing file paths. | |
| TAINT_BLOCK_PROPAGATION_FUNCS | Specifies how a function propagates data, and the taint on that data, into a structured memory block. | |
| TAINT_HIGHLIGHTING | Enable taint highlighting in the hub GUI. | |
| TIME_LIMIT_RENDER | Seconds the analysis may spend rendering intra- and interprocedural vulnerabilities, per procedure. | |
| UNIT_OF_WORK_ISOLATION | Specifies whether or not each analysis slave should only perform one unit of work before terminating itself. | |
| UNIT_OF_WORK_RETRIES | Specifies how many times the build/analysis master process (parse master, analysis master, or daemon master) should retry a failing unit of work before giving up on it and moving on. | |
| Designating Specially-Treated Macros | ||
| BAD_MACRO_BASE_RANK | Use the BAD_MACRO_* family of parameters to define warning classes that indicate the use of specific (prohibited) macros. | |
| BAD_MACRO_CATEGORIES | Use the BAD_MACRO_* family of parameters to define warning classes that indicate the use of specific (prohibited) macros. | |
| BAD_MACRO_CLASS | Use the BAD_MACRO_* family of parameters to define warning classes that indicate the use of specific (prohibited) macros. | |
| BAD_MACRO_FILENAME | Use the BAD_MACRO_* family of parameters to define warning classes that indicate the use of specific (prohibited) macros. | |
| BAD_MACRO_INFO | Use the BAD_MACRO_* family of parameters to define warning classes that indicate the use of specific (prohibited) macros. | |
| BAD_MACRO_LINK | Use the BAD_MACRO_* family of parameters to define warning classes that indicate the use of specific (prohibited) macros. | |
| BAD_MACRO_NAME | Use the BAD_MACRO_* family of parameters to define warning classes that indicate the use of specific (prohibited) macros. | |
| BAD_MACRO_SIGNIFICANCE | Use the BAD_MACRO_* family of parameters to define warning classes that indicate the use of specific (prohibited) macros. | |
To report problems with this documentation, please visit https://support.codesecure.com/.