5d81aa5b98
- Memory safety: 7/30 covered (7 new detectors added this session) - Injection/taint: 1/25 covered — high-impact gap - Phase 1: 8 syntactic detectors (deprecated APIs, format strings, weak crypto) - Phase 2: 5 Z3-powered (path/command/SQL injection, tainted format, process) - What fold does better: Z3-proved findings, semantic equivalence, binary scanning
62 lines
2.9 KiB
Markdown
62 lines
2.9 KiB
Markdown
# CodeQL C/C++ Query Catalog vs fold Detectors — Gap Matrix
|
|
|
|
> Generated 2026-05-29. Comparison of CodeQL's ~200 C/C++ queries against fold's 29 detectors.
|
|
|
|
## Coverage Summary
|
|
|
|
| Category | CodeQL Queries | fold Has | fold Missing |
|
|
|----------|---------------|----------|-------------|
|
|
| Memory safety | ~30 | 7 | 23 |
|
|
| Injection / taint | ~25 | 1 | 24 |
|
|
| Data flow | ~20 | 0 | 20 |
|
|
| Information disclosure | ~15 | 0 | 15 |
|
|
| Resource management | ~12 | 3 | 9 |
|
|
| Concurrency | ~8 | 0 | 8 |
|
|
| Style / best practice | ~40 | 0 | 40 |
|
|
| Cryptography | ~10 | 0 | 10 |
|
|
| Command injection | ~5 | 0 | 5 |
|
|
| **Total** | **~200** | **11** | **~130** |
|
|
|
|
## Key Gaps fold Could Address
|
|
|
|
### Phase 1 — Syntactic (RecursiveASTVisitor, no Z3)
|
|
|
|
| CodeQL Query | fold Detector | Notes |
|
|
|-------------|---------------|-------|
|
|
| cpp/badly-bounded-write | `deprecated-strcpy` | Detect `strcpy`, `strcat`, `sprintf` usage |
|
|
| cpp/dangerous-function-overflow | `deprecated-api` | Extend existing detector |
|
|
| cpp/incorrect-allocation-error-handling | `unchecked-malloc` | Check malloc return for nullptr |
|
|
| cpp/suspicious-pointer-scaling | `pointer-arithmetic` | Detect suspicious arithmetic on typed pointers |
|
|
| cpp/weak-cryptographic-algorithm | `weak-crypto` | MD5, SHA1, DES in security contexts |
|
|
| cpp/hardcoded-credentials | `hardcoded-credential` | String constants matching credential patterns |
|
|
| cpp/uncontrolled-format-string | `format-string` | printf(user_input) patterns |
|
|
| cpp/cleartext-storage | `cleartext-storage` | Sensitive data written without encryption |
|
|
|
|
### Phase 2 — Z3-powered
|
|
|
|
| CodeQL Query | fold Z3 Detector | Notes |
|
|
|-------------|-----------------|-------|
|
|
| cpp/path-injection | Path traversal with origin tracking | Extend existing taint origin |
|
|
| cpp/command-injection | Command injection with origin tracking | Extend existing |
|
|
| cpp/sql-injection | SQL injection | String concatenation + DB call patterns |
|
|
| cpp/uncontrolled-process-operation | Process injection | Similar to command injection |
|
|
| cpp/tainted-format-string | Format string with taint | Z3 proves format string is user-controlled |
|
|
|
|
### Phase 3 — Architecture expansion
|
|
|
|
| CodeQL Query | What fold needs |
|
|
|-------------|----------------|
|
|
| cpp/overrun-write | Buffer size tracking in Z3 (OOB already tracks arrays) |
|
|
| cpp/overrun-write | Extend HeapModel for buffer sizes |
|
|
| cpp/user-controlled-bypass | Full taint tracking across TUs |
|
|
| All concurrency queries | Thread interleaving model (beyond fold's current scope) |
|
|
|
|
## What fold Already Does Better Than CodeQL
|
|
|
|
| Capability | fold | CodeQL |
|
|
|-----------|------|--------|
|
|
| Z3-proved findings | Yes (proved confidence) | No (all findings are heuristic) |
|
|
| Dead branch detection | Yes (UNSAT path) | Yes (unreachable code) |
|
|
| Semantic equivalence | Yes (Type-4 clones via Z3) | No |
|
|
| Binary scanning | Yes (r2 + dlopen fuzzing) | No |
|
|
| Bound model guarantees | Yes (bounded, explicit) | No (unbounded, may miss) |
|