Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/purpose-5.74.0/autotests/alternativesmodeltest.cpp
Examining data/purpose-5.74.0/autotests/menutest.h
Examining data/purpose-5.74.0/autotests/alternativesmodeltest.h
Examining data/purpose-5.74.0/autotests/menutest.cpp
Examining data/purpose-5.74.0/tests/menudemo.cpp
Examining data/purpose-5.74.0/tests/tool/main.cpp
Examining data/purpose-5.74.0/src/alternativesmodel.cpp
Examining data/purpose-5.74.0/src/widgets/menu.cpp
Examining data/purpose-5.74.0/src/widgets/menu.h
Examining data/purpose-5.74.0/src/externalprocess/processjob.cpp
Examining data/purpose-5.74.0/src/externalprocess/purposeprocess_main.cpp
Examining data/purpose-5.74.0/src/externalprocess/processjob.h
Examining data/purpose-5.74.0/src/jobcontroller.h
Examining data/purpose-5.74.0/src/pluginbase.cpp
Examining data/purpose-5.74.0/src/job.cpp
Examining data/purpose-5.74.0/src/quick/purposequickplugin.h
Examining data/purpose-5.74.0/src/quick/purposequickplugin.cpp
Examining data/purpose-5.74.0/src/helper.cpp
Examining data/purpose-5.74.0/src/helper.h
Examining data/purpose-5.74.0/src/pluginbase.h
Examining data/purpose-5.74.0/src/alternativesmodel.h
Examining data/purpose-5.74.0/src/fileitemactionplugin/sharefileitemaction.h
Examining data/purpose-5.74.0/src/fileitemactionplugin/sharefileitemaction.cpp
Examining data/purpose-5.74.0/src/configuration.cpp
Examining data/purpose-5.74.0/src/configuration.h
Examining data/purpose-5.74.0/src/jobcontroller.cpp
Examining data/purpose-5.74.0/src/job.h
Examining data/purpose-5.74.0/src/plugins/phabricator/tests/testphabricator.cpp
Examining data/purpose-5.74.0/src/plugins/phabricator/quick/difflistmodel.cpp
Examining data/purpose-5.74.0/src/plugins/phabricator/quick/phabricatorrc.cpp
Examining data/purpose-5.74.0/src/plugins/phabricator/quick/phabricatorquickplugin.cpp
Examining data/purpose-5.74.0/src/plugins/phabricator/quick/difflistmodel.h
Examining data/purpose-5.74.0/src/plugins/phabricator/quick/phabricatorrc.h
Examining data/purpose-5.74.0/src/plugins/phabricator/quick/phabricatorquickplugin.h
Examining data/purpose-5.74.0/src/plugins/phabricator/phabricatorjobs.cpp
Examining data/purpose-5.74.0/src/plugins/phabricator/phabricatorjobs.h
Examining data/purpose-5.74.0/src/plugins/phabricator/phabricatorplugin.cpp
Examining data/purpose-5.74.0/src/plugins/kdeconnect_sms/kdeconnectsmsplugin.cpp
Examining data/purpose-5.74.0/src/plugins/youtube/youtubeplugin.cpp
Examining data/purpose-5.74.0/src/plugins/youtube/youtubejobcomposite.h
Examining data/purpose-5.74.0/src/plugins/youtube/youtubejob.h
Examining data/purpose-5.74.0/src/plugins/youtube/youtubejobcomposite.cpp
Examining data/purpose-5.74.0/src/plugins/youtube/youtubejob.cpp
Examining data/purpose-5.74.0/src/plugins/nextcloud/nextcloudjob.h
Examining data/purpose-5.74.0/src/plugins/nextcloud/nextcloudplugin.cpp
Examining data/purpose-5.74.0/src/plugins/nextcloud/nextcloudjob.cpp
Examining data/purpose-5.74.0/src/plugins/email/emailplugin.cpp
Examining data/purpose-5.74.0/src/plugins/ktp-sendfile/ktpsendfileplugin.cpp
Examining data/purpose-5.74.0/src/plugins/kdeconnect/kdeconnectplugin.cpp
Examining data/purpose-5.74.0/src/plugins/saveas/saveasplugin.cpp
Examining data/purpose-5.74.0/src/plugins/imgur/imgurplugin.cpp
Examining data/purpose-5.74.0/src/plugins/imgur/mpform.h
Examining data/purpose-5.74.0/src/plugins/imgur/mpform.cpp
Examining data/purpose-5.74.0/src/plugins/reviewboard/reviewboardjobs.h
Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/rbrepositoriesmodel.cpp
Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardquickplugin.h
Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/rbreviewslistmodel.cpp
Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/rbrepositoriesmodel.h
Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardrc.h
Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardrc.cpp
Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/rbreviewslistmodel.h
Examining data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardquickplugin.cpp
Examining data/purpose-5.74.0/src/plugins/reviewboard/reviewboardplugin.cpp
Examining data/purpose-5.74.0/src/plugins/reviewboard/reviewboardjobs.cpp
Examining data/purpose-5.74.0/src/plugins/pastebin/pastebinplugin.cpp
Examining data/purpose-5.74.0/src/plugins/bluetooth/bluetoothplugin.cpp
Examining data/purpose-5.74.0/src/plugins/telegram/debug.h
Examining data/purpose-5.74.0/src/plugins/telegram/telegramplugin.cpp
FINAL RESULTS:
data/purpose-5.74.0/src/helper.cpp:31:19: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!typeFile.open(QFile::ReadOnly)) {
data/purpose-5.74.0/src/helper.cpp:54:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (f.open(QIODevice::ReadOnly)) {
data/purpose-5.74.0/src/plugins/imgur/mpform.cpp:103:20: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!imageFile.open(QIODevice::ReadOnly))
data/purpose-5.74.0/src/plugins/reviewboard/quick/reviewboardrc.cpp:27:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!f.open(QFile::ReadOnly | QFile::Text)) {
data/purpose-5.74.0/src/plugins/reviewboard/reviewboardjobs.cpp:29:21: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool corr=f.open(QFile::ReadOnly | QFile::Text);
data/purpose-5.74.0/src/externalprocess/purposeprocess_main.cpp:58:29: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
pos += m_socket.read(dataArray.data() + pos, qMin(m_socket.bytesAvailable(), bytes-pos));
data/purpose-5.74.0/src/externalprocess/purposeprocess_main.cpp:93:77: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
toSend[QString::fromLatin1(prop.name())] = fromVariant(prop.read(m_job));
data/purpose-5.74.0/src/plugins/phabricator/phabricatorjobs.cpp:131:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
m_diffURI = arcOutput.mid(diffOffset + strlen(diffOpCode)).split(QChar::LineFeed).at(0);
data/purpose-5.74.0/src/plugins/phabricator/phabricatorjobs.cpp:171:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
m_diffURI = arcOutput.mid(diffOffset + strlen(diffOpCode)).split(QChar::LineFeed).at(0);
ANALYSIS SUMMARY:
Hits = 9
Lines analyzed = 5888 in approximately 0.27 seconds (21743 lines/second)
Physical Source Lines of Code (SLOC) = 4358
Hits@level = [0] 0 [1] 4 [2] 5 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 9 [1+] 9 [2+] 5 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 2.06517 [1+] 2.06517 [2+] 1.14732 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.