5d81aa5b98
- Memory safety: 7/30 covered (7 new detectors added this session) - Injection/taint: 1/25 covered — high-impact gap - Phase 1: 8 syntactic detectors (deprecated APIs, format strings, weak crypto) - Phase 2: 5 Z3-powered (path/command/SQL injection, tainted format, process) - What fold does better: Z3-proved findings, semantic equivalence, binary scanning
2.9 KiB
2.9 KiB
CodeQL C/C++ Query Catalog vs fold Detectors — Gap Matrix
Generated 2026-05-29. Comparison of CodeQL's ~200 C/C++ queries against fold's 29 detectors.
Coverage Summary
| Category | CodeQL Queries | fold Has | fold Missing |
|---|---|---|---|
| Memory safety | ~30 | 7 | 23 |
| Injection / taint | ~25 | 1 | 24 |
| Data flow | ~20 | 0 | 20 |
| Information disclosure | ~15 | 0 | 15 |
| Resource management | ~12 | 3 | 9 |
| Concurrency | ~8 | 0 | 8 |
| Style / best practice | ~40 | 0 | 40 |
| Cryptography | ~10 | 0 | 10 |
| Command injection | ~5 | 0 | 5 |
| Total | ~200 | 11 | ~130 |
Key Gaps fold Could Address
Phase 1 — Syntactic (RecursiveASTVisitor, no Z3)
| CodeQL Query | fold Detector | Notes |
|---|---|---|
| cpp/badly-bounded-write | deprecated-strcpy |
Detect strcpy, strcat, sprintf usage |
| cpp/dangerous-function-overflow | deprecated-api |
Extend existing detector |
| cpp/incorrect-allocation-error-handling | unchecked-malloc |
Check malloc return for nullptr |
| cpp/suspicious-pointer-scaling | pointer-arithmetic |
Detect suspicious arithmetic on typed pointers |
| cpp/weak-cryptographic-algorithm | weak-crypto |
MD5, SHA1, DES in security contexts |
| cpp/hardcoded-credentials | hardcoded-credential |
String constants matching credential patterns |
| cpp/uncontrolled-format-string | format-string |
printf(user_input) patterns |
| cpp/cleartext-storage | cleartext-storage |
Sensitive data written without encryption |
Phase 2 — Z3-powered
| CodeQL Query | fold Z3 Detector | Notes |
|---|---|---|
| cpp/path-injection | Path traversal with origin tracking | Extend existing taint origin |
| cpp/command-injection | Command injection with origin tracking | Extend existing |
| cpp/sql-injection | SQL injection | String concatenation + DB call patterns |
| cpp/uncontrolled-process-operation | Process injection | Similar to command injection |
| cpp/tainted-format-string | Format string with taint | Z3 proves format string is user-controlled |
Phase 3 — Architecture expansion
| CodeQL Query | What fold needs |
|---|---|
| cpp/overrun-write | Buffer size tracking in Z3 (OOB already tracks arrays) |
| cpp/overrun-write | Extend HeapModel for buffer sizes |
| cpp/user-controlled-bypass | Full taint tracking across TUs |
| All concurrency queries | Thread interleaving model (beyond fold's current scope) |
What fold Already Does Better Than CodeQL
| Capability | fold | CodeQL |
|---|---|---|
| Z3-proved findings | Yes (proved confidence) | No (all findings are heuristic) |
| Dead branch detection | Yes (UNSAT path) | Yes (unreachable code) |
| Semantic equivalence | Yes (Type-4 clones via Z3) | No |
| Binary scanning | Yes (r2 + dlopen fuzzing) | No |
| Bound model guarantees | Yes (bounded, explicit) | No (unbounded, may miss) |