# This file was generated from template 'codesonar/presets/cwe2025.conf.in' # # Configuration settings required by warning classes closely mapped to # one or more of the 2025 CWE Top 25 Most Dangerous Software Weaknesses. # # This part of this file was generated from 'cso_wcmanifest.py' # # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Actual Parameter Element may be null (C#)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Actual Parameter Element may be null (Java)" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Array Length Mismatch (Ada)" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') # This check is enabled by default for the language(s) C, C++, x86, x86_64 # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Buffer Overrun" # CWE:20: Improper Input Validation # This check is enabled by default for the language(s) C, C++ # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Cast Alters Value" # CWE:94: Improper Control of Generation of Code ('Code Injection') # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Code Injection (Ada)" # CWE:94: Improper Control of Generation of Code ('Code Injection') # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Code Injection (C#)" # CWE:94: Improper Control of Generation of Code ('Code Injection') # This check is enabled by default for the language(s) Java, Kotlin # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Code Injection (Java)" # CWE:20: Improper Input Validation # This check is enabled by default for the language(s) C, C++ # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Coercion Alters Value" # CWE:78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') # This check is enabled by default for the language(s) C, C++, x86, x86_64 # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Command Injection" # CWE:77: Improper Neutralization of Special Elements used in a Command ('Command Injection') # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Command Injection (Ada)" # CWE:78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Command Injection (C#)" # CWE:78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') # This check is enabled by default for the language(s) Java, Kotlin # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Command Injection (Java)" # CWE:79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Cross Site Scripting (Ada)" # CWE:79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Cross Site Scripting (C#)" # CWE:79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Cross Site Scripting (Java)" # CWE:79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Cross Site Scripting In Error Message Web Page (C#)" # CWE:79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Cross Site Scripting In Error Message Web Page (Java)" # CWE:502: Deserialization of Untrusted Data WARNING_FILTER += allow class="Deserializable Class (Java)" # CWE:20: Improper Input Validation WARNING_FILTER += allow class="Disabled Input Validation (C#)" # CWE:94: Improper Control of Generation of Code ('Code Injection') # This check is enabled by default for the language(s) Python # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Eval Used (Pylint)" # CWE:94: Improper Control of Generation of Code ('Code Injection') # This check is enabled by default for the language(s) Python # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Exec Used (Pylint)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Field Element may be null (deep) (C#)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Field Element may be null (deep) (Java)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Field may be null (deep) (C#)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Field may be null (deep) (Java)" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Inappropriate Array Index (Ada)" # CWE:770: Allocation of Resources Without Limits or Throttling # This check is enabled by default for the language(s) Python # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Method Cache Max Size None (Pylint)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Method Should Not Return null (C#)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Method Should Not Return null (Java)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Kotlin # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Null Check on Mutable Property (detekt)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Null Parameter Dereference (C#)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Null Parameter Dereference (Java)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) C, C++, x86, x86_64 # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Null Pointer Dereference" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Null Pointer Dereference (Ada)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Null Pointer Dereference (C#)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Null Pointer Dereference (Java)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Null Pointer Dereference (deep) (C#)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Null Pointer Dereference (deep) (Java)" # CWE:284: Improper Access Control # This check is enabled by default for the language(s) C, C++, x86, x86_64 # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Null Security Descriptor" # CWE:78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="OS Command Injection (Ada)" # CWE:787: Out-of-bounds Write # CWE:125: Out-of-bounds Read # This check is enabled by default for the language(s) Python # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Potential Index Error (Pylint)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Return Value may Contain null Element (C#)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Return Value may Contain null Element (Java)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Return Value may be null (C#)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Return Value may be null (Java)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Return null Array (C#)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Return null Array (Java)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Return null Boolean (Java)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Return null Optional (Java)" # CWE:89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') # This check is enabled by default for the language(s) C, C++, x86, x86_64 # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="SQL Injection" # CWE:89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="SQL Injection (Ada)" # CWE:89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="SQL Injection (C#)" # CWE:89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') # This check is enabled by default for the language(s) Java, Kotlin # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="SQL Injection (Java)" # CWE:200: Exposure of Sensitive Information to an Unauthorized Actor WARNING_FILTER += allow class="Sensitive Data Written to External Storage (Java)" # CWE:502: Deserialization of Untrusted Data WARNING_FILTER += allow class="Serialization Not Disabled (Java)" # CWE:20: Improper Input Validation # This check is enabled by default for the language(s) C, C++ # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Tainted Buffer Access" # CWE:22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') WARNING_FILTER += allow class="Tainted Filename" # CWE:22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Tainted Filename (Ada)" # CWE:22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Tainted Path (C#)" # CWE:22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') # This check is enabled by default for the language(s) Java, Kotlin # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Tainted Path (Java)" # CWE:200: Exposure of Sensitive Information to an Unauthorized Actor WARNING_FILTER += allow class="Tainted Write" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Unchecked Parameter Dereference" language=c # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) C# # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Unchecked Parameter Dereference (C#)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Unchecked Parameter Dereference (Java)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Unchecked Parameter Dereference (deep) (C#)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Unchecked Parameter Dereference (deep) (Java)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Unchecked Parameter Element Dereference (deep) (C#)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="Unchecked Parameter Element Dereference (deep) (Java)" # CWE:476: NULL Pointer Dereference # This check is enabled by default for the language(s) Kotlin # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Unsafe Call on Nullable Type (detekt)" # CWE:78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') WARNING_FILTER += allow class="Untrusted Process Creation" # CWE:416: Use After Free # This check is enabled by default for the language(s) C, C++, x86, x86_64 # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Use After Free" # CWE:416: Use After Free # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Use After Free (Ada)" # CWE:200: Exposure of Sensitive Information to an Unauthorized Actor # This check is enabled by default for the language(s) Java # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Use of Hardware ID (Java)" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of OemToAnsi" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of OemToChar" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of StrCatChainW" # CWE:863: Incorrect Authorization WARNING_FILTER += allow class="Use of cuserid" # CWE:863: Incorrect Authorization WARNING_FILTER += allow class="Use of getlogin" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of getopt" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of getpass" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') # This check is enabled by default for the language(s) C, C++, x86, x86_64 # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="Use of gets" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of getwd" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of recvmsg" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strcat" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strchr" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strcmp" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strcoll" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strcpy" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strcspn" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strlen" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strpbrk" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strrchr" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strspn" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strstr" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strtok" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of strtrns" # CWE:120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') WARNING_FILTER += allow class="Use of syslog" # CWE:20: Improper Input Validation # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="improper input validation (Ada)" # CWE:200: Exposure of Sensitive Information to an Unauthorized Actor # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="information leak (Ada)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="null Passed to Method (deep) (C#)" # CWE:476: NULL Pointer Dereference WARNING_FILTER += allow class="null Passed to Method (deep) (Java)" # CWE:918: Server-Side Request Forgery (SSRF) # This check is enabled by default for the language(s) Ada # It may remain in effect even if the following line is commented out. WARNING_FILTER += allow class="server side request forgery (Ada)" # # The remainder of this file was generated from template 'codesonar/presets/cwe2025.conf.in' #