e9e23227cb
- Sprint 1: 4 syntactic detectors (deprecated API, weak crypto, format string, creds) - Sprint 2: 3 Z3-powered (use-after-move, iterator invalidation, SQL injection) - Sprint 3: Bitwuzla multi-solver, TU pre-filter, clone cache - Sprint 4: watch mode, pre-commit hooks, GitHub Code Scanning SARIF
58 lines
2.7 KiB
Markdown
58 lines
2.7 KiB
Markdown
# fold Expansion Roadmap — Security + Performance + Utility
|
|
|
|
> Generated 2026-05-29. Synthesized from 4 gap matrices + performance audit.
|
|
|
|
## Sprint 1 — Quick Wins (~2 weeks, 4 detectors)
|
|
|
|
| Priority | Detector | Type | Lines | Impact |
|
|
|----------|----------|------|-------|--------|
|
|
| 1 | Deprecated API (gets, strcpy, sprintf) | Syntactic | ~80 | Catches CWE-120/676 |
|
|
| 2 | Weak crypto (MD5, SHA1, DES) | Syntactic | ~60 | Replaces Semgrep rule |
|
|
| 3 | Format string (non-literal printf fmt) | Syntactic | ~50 | Catches CWE-134 |
|
|
| 4 | Hardcoded credential patterns | Syntactic | ~40 | Catches CWE-798 |
|
|
|
|
## Sprint 2 — Z3-Powered (~3 weeks, 3 detectors)
|
|
|
|
| Priority | Detector | Type | Lines | Impact |
|
|
|----------|----------|------|-------|--------|
|
|
| 5 | Use-after-move | Z3 (path) | ~150 | Catches C++ move semantics bugs |
|
|
| 6 | Iterator invalidation | Z3 (path) | ~200 | Catches container mutation bugs |
|
|
| 7 | SQL injection taint | Z3 (taint) | ~200 | Requires interprocedural taint |
|
|
|
|
## Sprint 3 — Performance (~2 weeks)
|
|
|
|
| Priority | Optimization | Expected Speedup |
|
|
|----------|-------------|-----------------|
|
|
| 1 | Bitwuzla multi-solver (--solver bitwuzla) | 2-5x on BV queries |
|
|
| 2 | TU pre-filter (skip files with no security ops) | 30% fewer TUs processed |
|
|
| 3 | Clone detector incremental (hash cache) | 50% clone time reduction |
|
|
| 4 | Parallel Z3 per-function (already partially done) | Linear speedup with cores |
|
|
|
|
## Sprint 4 — Utility & Integration (~2 weeks)
|
|
|
|
| Priority | Feature | Impact |
|
|
|----------|---------|--------|
|
|
| 1 | `fold --watch` mode (re-scan on file changes) | Developer workflow |
|
|
| 2 | Pre-commit hook integration (.git/hooks/pre-commit) | CI/CD |
|
|
| 3 | SARIF output formatting for GitHub Code Scanning | GitHub integration |
|
|
| 4 | IDE diagnostics (existing LSP, improve FindingKind mapping) | IDE integration |
|
|
|
|
## Long-Term Architecture
|
|
|
|
| Milestone | Description | Effort |
|
|
|-----------|-------------|--------|
|
|
| M13 | Full interprocedural analysis (cross-function Z3 proofs) | L |
|
|
| M12 | PDG/data-flow precision (prerequisite for M13) | L |
|
|
| M14 | SV-COMP/Juliet at scale (standardized benchmark) | L |
|
|
| Strategic | Bitwuzla as default solver (replaces Z3 for BV) | M |
|
|
| Strategic | Declarative detector DSL (10x detector authoring speed) | XL |
|
|
|
|
## What NOT to Prioritize
|
|
|
|
| Feature | Why Not |
|
|
|---------|--------|
|
|
| Concurrency detectors (RacerD-equivalent) | Requires thread interleaving model — beyond fold's scope |
|
|
| Whole-program taint tracking | Already have per-TU taint; cross-TU is M13 territory |
|
|
| Custom Semgrep rule import | Better to run OpenGrep alongside fold |
|
|
| LLM-based detectors | Research area, not production-ready |
|
|
| DAST integration (ZAP, Burp) | Binary-only fuzzing is fold's niche |
|