e9e23227cb
- Sprint 1: 4 syntactic detectors (deprecated API, weak crypto, format string, creds) - Sprint 2: 3 Z3-powered (use-after-move, iterator invalidation, SQL injection) - Sprint 3: Bitwuzla multi-solver, TU pre-filter, clone cache - Sprint 4: watch mode, pre-commit hooks, GitHub Code Scanning SARIF
2.7 KiB
2.7 KiB
fold Expansion Roadmap — Security + Performance + Utility
Generated 2026-05-29. Synthesized from 4 gap matrices + performance audit.
Sprint 1 — Quick Wins (~2 weeks, 4 detectors)
| Priority | Detector | Type | Lines | Impact |
|---|---|---|---|---|
| 1 | Deprecated API (gets, strcpy, sprintf) | Syntactic | ~80 | Catches CWE-120/676 |
| 2 | Weak crypto (MD5, SHA1, DES) | Syntactic | ~60 | Replaces Semgrep rule |
| 3 | Format string (non-literal printf fmt) | Syntactic | ~50 | Catches CWE-134 |
| 4 | Hardcoded credential patterns | Syntactic | ~40 | Catches CWE-798 |
Sprint 2 — Z3-Powered (~3 weeks, 3 detectors)
| Priority | Detector | Type | Lines | Impact |
|---|---|---|---|---|
| 5 | Use-after-move | Z3 (path) | ~150 | Catches C++ move semantics bugs |
| 6 | Iterator invalidation | Z3 (path) | ~200 | Catches container mutation bugs |
| 7 | SQL injection taint | Z3 (taint) | ~200 | Requires interprocedural taint |
Sprint 3 — Performance (~2 weeks)
| Priority | Optimization | Expected Speedup |
|---|---|---|
| 1 | Bitwuzla multi-solver (--solver bitwuzla) | 2-5x on BV queries |
| 2 | TU pre-filter (skip files with no security ops) | 30% fewer TUs processed |
| 3 | Clone detector incremental (hash cache) | 50% clone time reduction |
| 4 | Parallel Z3 per-function (already partially done) | Linear speedup with cores |
Sprint 4 — Utility & Integration (~2 weeks)
| Priority | Feature | Impact |
|---|---|---|
| 1 | fold --watch mode (re-scan on file changes) |
Developer workflow |
| 2 | Pre-commit hook integration (.git/hooks/pre-commit) | CI/CD |
| 3 | SARIF output formatting for GitHub Code Scanning | GitHub integration |
| 4 | IDE diagnostics (existing LSP, improve FindingKind mapping) | IDE integration |
Long-Term Architecture
| Milestone | Description | Effort |
|---|---|---|
| M13 | Full interprocedural analysis (cross-function Z3 proofs) | L |
| M12 | PDG/data-flow precision (prerequisite for M13) | L |
| M14 | SV-COMP/Juliet at scale (standardized benchmark) | L |
| Strategic | Bitwuzla as default solver (replaces Z3 for BV) | M |
| Strategic | Declarative detector DSL (10x detector authoring speed) | XL |
What NOT to Prioritize
| Feature | Why Not |
|---|---|
| Concurrency detectors (RacerD-equivalent) | Requires thread interleaving model — beyond fold's scope |
| Whole-program taint tracking | Already have per-TU taint; cross-TU is M13 territory |
| Custom Semgrep rule import | Better to run OpenGrep alongside fold |
| LLM-based detectors | Research area, not production-ready |
| DAST integration (ZAP, Burp) | Binary-only fuzzing is fold's niche |