Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/purpose-5.74.0/autotests/alternativesmodeltest.cpp Examining data/purpose-5.74.0/autotests/menutest.h Examining data/purpose-5.74.0/autotests/alternativesmodeltest.h Examining data/purpose-5.74.0/autotests/menutest.cpp Examining data/purpose-5.74.0/tests/menudemo.cpp Examining data/purpose-5.74.0/tests/tool/main.cpp Examining data/purpose-5.74.0/src/alternativesmodel.cpp Examining data/purpose-5.74.0/src/widgets/menu.cpp Examining data/purpose-5.74.0/src/widgets/menu.h Examining data/purpose-5.74.0/src/externalprocess/processjob.cpp Examining data/purpose-5.74.0/src/externalprocess/purposeprocess_main.cpp Examining data/purpose-5.74.0/src/externalprocess/processjob.h Examining data/purpose-5.74.0/src/jobcontroller.h Examining data/purpose-5.74.0/src/pluginbase.cpp Examining data/purpose-5.74.0/src/job.cpp Examining data/purpose-5.74.0/src/quick/purposequickplugin.h Examining data/purpose-5.74.0/src/quick/purposequickplugin.cpp Examining data/purpose-5.74.0/src/helper.cpp Examining data/purpose-5.74.0/src/helper.h Examining data/purpose-5.74.0/src/pluginbase.h Examining data/purpose-5.74.0/src/alternativesmodel.h Examining data/purpose-5.74.0/src/fileitemactionplugin/sharefileitemaction.h Examining data/purpose-5.74.0/src/fileitemactionplugin/sharefileitemaction.cpp Examining data/purpose-5.74.0/src/configuration.cpp Examining data/purpose-5.74.0/src/configuration.h Examining data/purpose-5.74.0/src/jobcontroller.cpp Examining data/purpose-5.74.0/src/job.h Examining data/purpose-5.74.0/src/plugins/phabricator/tests/testphabricator.cpp Examining data/purpose-5.74.0/src/plugins/phabricator/quick/difflistmodel.cpp Examining data/purpose-5.74.0/src/plugins/phabricator/quick/phabricatorrc.cpp Examining data/purpose-5.74.0/src/plugins/phabricator/quick/phabricatorquickplugin.cpp Examining data/purpose-5.74.0/src/plugins/phabricator/quick/difflistmodel.h Examining data/purpose-5.74.0/src/plugins/phabricator/quick/phabricatorrc.h Examining data/purpose-5.74.0/src/plugins/phabricator/quick/phabricatorquickplugin.h Examining data/purpose-5.74.0/src/plugins/phabricator/phabricatorjobs.cpp Examining data/purpose-5.74.0/src/plugins/phabricator/phabricatorjobs.h Examining data/purpose-5.74.0/src/plugins/phabricator/phabricatorplugin.cpp Examining data/purpose-5.74.0/src/plugins/kdeconnect_sms/kdeconnectsmsplugin.cpp Examining data/purpose-5.74.0/src/plugins/youtube/youtubeplugin.cpp Examining data/purpose-5.74.0/src/plugins/youtube/youtubejobcomposite.h Examining data/purpose-5.74.0/src/plugins/youtube/youtubejob.h Examining data/purpose-5.74.0/src/plugins/youtube/youtubejobcomposite.cpp Examining data/purpose-5.74.0/src/plugins/youtube/youtubejob.cpp Examining data/purpose-5.74.0/src/plugins/nextcloud/nextcloudjob.h Examining data/purpose-5.74.0/src/plugins/nextcloud/nextcloudplugin.cpp Examining data/purpose-5.74.0/src/plugins/nextcloud/nextcloudjob.cpp Examining data/purpose-5.74.0/src/plugins/email/emailplugin.cpp Examining data/purpose-5.74.0/src/plugins/ktp-sendfile/ktpsendfileplugin.cpp Examining data/purpose-5.74.0/src/plugins/kdeconnect/kdeconnectplugin.cpp Examining data/purpose-5.74.0/src/plugins/saveas/saveasplugin.cpp Examining data/purpose-5.74.0/src/plugins/imgur/imgurplugin.cpp Examining data/purpose-5.74.0/src/plugins/imgur/mpform.h Examining data/purpose-5.74.0/src/plugins/imgur/mpform.cpp Examining data/purpose-5.74.0/src/plugins/reviewboard/reviewboardjobs.h Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/rbrepositoriesmodel.cpp Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardquickplugin.h Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/rbreviewslistmodel.cpp Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/rbrepositoriesmodel.h Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardrc.h Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardrc.cpp Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/rbreviewslistmodel.h Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardquickplugin.cpp Examining data/purpose-5.74.0/src/plugins/reviewboard/reviewboardplugin.cpp Examining data/purpose-5.74.0/src/plugins/reviewboard/reviewboardjobs.cpp Examining data/purpose-5.74.0/src/plugins/pastebin/pastebinplugin.cpp Examining data/purpose-5.74.0/src/plugins/bluetooth/bluetoothplugin.cpp Examining data/purpose-5.74.0/src/plugins/telegram/debug.h Examining data/purpose-5.74.0/src/plugins/telegram/telegramplugin.cpp FINAL RESULTS: data/purpose-5.74.0/src/helper.cpp:31:19: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (!typeFile.open(QFile::ReadOnly)) { data/purpose-5.74.0/src/helper.cpp:54:11: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (f.open(QIODevice::ReadOnly)) { data/purpose-5.74.0/src/plugins/imgur/mpform.cpp:103:20: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (!imageFile.open(QIODevice::ReadOnly)) data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardrc.cpp:27:11: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if(!f.open(QFile::ReadOnly | QFile::Text)) { data/purpose-5.74.0/src/plugins/reviewboard/reviewboardjobs.cpp:29:21: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). bool corr=f.open(QFile::ReadOnly | QFile::Text); data/purpose-5.74.0/src/externalprocess/purposeprocess_main.cpp:58:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). pos += m_socket.read(dataArray.data() + pos, qMin(m_socket.bytesAvailable(), bytes-pos)); data/purpose-5.74.0/src/externalprocess/purposeprocess_main.cpp:93:77: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). toSend[QString::fromLatin1(prop.name())] = fromVariant(prop.read(m_job)); data/purpose-5.74.0/src/plugins/phabricator/phabricatorjobs.cpp:131:52: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). m_diffURI = arcOutput.mid(diffOffset + strlen(diffOpCode)).split(QChar::LineFeed).at(0); data/purpose-5.74.0/src/plugins/phabricator/phabricatorjobs.cpp:171:52: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). m_diffURI = arcOutput.mid(diffOffset + strlen(diffOpCode)).split(QChar::LineFeed).at(0); ANALYSIS SUMMARY: Hits = 9 Lines analyzed = 5888 in approximately 0.27 seconds (21743 lines/second) Physical Source Lines of Code (SLOC) = 4358 Hits@level = [0] 0 [1] 4 [2] 5 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 9 [1+] 9 [2+] 5 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 2.06517 [1+] 2.06517 [2+] 1.14732 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.