ec8492431c
- Banned functions: 15 rules, 0 fold detectors — largest gap - Crypto misuse: 8 rules completely uncovered - Phase 1: 9 syntactic detectors covering 30+ Semgrep rules - What fold does better: Z3 proofs, CFG analysis, type-aware checking
63 lines
2.9 KiB
Markdown
63 lines
2.9 KiB
Markdown
# Semgrep C/C++ Rules vs fold Detectors — Gap Matrix
|
|
|
|
> Generated 2026-05-29. Maps Semgrep's `p/c` and `p/cpp` rulesets (~80 rules) to fold detectors.
|
|
|
|
## Coverage Summary
|
|
|
|
| Category | Semgrep Rules | fold Has | fold Missing |
|
|
|----------|--------------|----------|-------------|
|
|
| Banned/deprecated functions | ~15 | 0 | 15 |
|
|
| Memory safety | ~10 | 7 | 3 |
|
|
| Injection | ~8 | 1 | 7 |
|
|
| Crypto misuse | ~8 | 0 | 8 |
|
|
| Information disclosure | ~6 | 0 | 6 |
|
|
| Resource management | ~5 | 3 | 2 |
|
|
| Input validation | ~5 | 0 | 5 |
|
|
| Concurrency | ~4 | 0 | 4 |
|
|
| Style/quality | ~20 | 0 | 20 |
|
|
| **Total** | **~80** | **11** | **~70** |
|
|
|
|
## Key Gaps fold Could Close (Phase 1 — Syntactic)
|
|
|
|
Semgrep's strength is pattern-matching. These rules require NO Z3 — just AST pattern matching like fold's existing `deprecated_api.cpp`:
|
|
|
|
| Semgrep Rule | fold Detector | Pattern |
|
|
|-------------|---------------|---------|
|
|
| `c.lang.security.insecure-use-gets` | `deprecated-gets` | `gets(...)` call |
|
|
| `c.lang.security.insecure-use-sprintf` | `deprecated-sprintf` | `sprintf(buf, fmt, ...)` with non-literal fmt |
|
|
| `c.lang.security.insecure-use-strcpy` | `deprecated-strcpy` | `strcpy(dst, src)` call |
|
|
| `c.lang.security.insecure-use-strcat` | `deprecated-strcat` | `strcat(dst, src)` call |
|
|
| `cpp.lang.security.insufficient-key-size` | `weak-crypto` | RSA < 2048, ECC < 256 bit |
|
|
| `c.lang.security.insecure-use-printf-fn` | `format-string` | Non-literal format arg to printf family |
|
|
| `c.lang.security.md5-used-as-password` | `weak-crypto-md5` | MD5() in password/hash context |
|
|
| `c.lang.security.sha1-used-as-password` | `weak-crypto-sha1` | SHA1() in password context |
|
|
|
|
## Semgrep Rules Impossible for fold
|
|
|
|
Patterns requiring whole-program or cross-file context that fold's single-TU design can't express:
|
|
|
|
| Rule | Why Not |
|
|
|------|--------|
|
|
| `insecure-use-memset` | Context-dependent (memset to zero before free is secure, other uses vary) |
|
|
| `detect-http-to-https-redirect` | Requires HTTP protocol semantics |
|
|
| `detect-weak-tls-ciphers` | Requires runtime config analysis |
|
|
|
|
## Recommended Priority
|
|
|
|
| Priority | Rules | Approach | Effort |
|
|
|----------|-------|----------|--------|
|
|
| 1 | Banned functions (5 rules) | Syntactic, extend deprecated_api.cpp | S |
|
|
| 2 | Crypto misuse (3 rules) | Syntactic, new weak-crypto detector | S |
|
|
| 3 | Format string (1 rule) | Syntactic, new format-string detector | S |
|
|
| 4 | Input validation (5 rules) | Partially syntactic, some Z3 | M |
|
|
| 5 | Info disclosure (6 rules) | Mostly contextual | L |
|
|
|
|
## What fold Already Does Better Than Semgrep
|
|
|
|
| Capability | fold | Semgrep |
|
|
|-----------|------|---------|
|
|
| Z3-proved findings | Yes (UNSAT proofs) | No (pattern only) |
|
|
| Control-flow analysis | Yes (CFG + path predicates) | No (single-statement matching) |
|
|
| Type-aware checking | Yes (bit-width, signedness) | No (text only) |
|
|
| Interprocedural analysis | Partial (summaries) | No |
|
|
| Semantic equivalence | Yes (Type-4 clones) | No |
|