Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/qterminal-0.14.1/src/bookmarkswidget.cpp Examining data/qterminal-0.14.1/src/bookmarkswidget.h Examining data/qterminal-0.14.1/src/config.h Examining data/qterminal-0.14.1/src/dbusaddressable.cpp Examining data/qterminal-0.14.1/src/dbusaddressable.h Examining data/qterminal-0.14.1/src/fontdialog.cpp Examining data/qterminal-0.14.1/src/fontdialog.h Examining data/qterminal-0.14.1/src/main.cpp Examining data/qterminal-0.14.1/src/mainwindow.cpp Examining data/qterminal-0.14.1/src/mainwindow.h Examining data/qterminal-0.14.1/src/properties.cpp Examining data/qterminal-0.14.1/src/properties.h Examining data/qterminal-0.14.1/src/propertiesdialog.cpp Examining data/qterminal-0.14.1/src/propertiesdialog.h Examining data/qterminal-0.14.1/src/qterminalapp.h Examining data/qterminal-0.14.1/src/tab-switcher.cpp Examining data/qterminal-0.14.1/src/tab-switcher.h Examining data/qterminal-0.14.1/src/tabbar.cpp Examining data/qterminal-0.14.1/src/tabbar.h Examining data/qterminal-0.14.1/src/tabwidget.cpp Examining data/qterminal-0.14.1/src/tabwidget.h Examining data/qterminal-0.14.1/src/terminalconfig.cpp Examining data/qterminal-0.14.1/src/terminalconfig.h Examining data/qterminal-0.14.1/src/termwidget.cpp Examining data/qterminal-0.14.1/src/termwidget.h Examining data/qterminal-0.14.1/src/termwidgetholder.cpp Examining data/qterminal-0.14.1/src/termwidgetholder.h Examining data/qterminal-0.14.1/src/third-party/qxtglobal.h Examining data/qterminal-0.14.1/src/third-party/qxtglobalshortcut.cpp Examining data/qterminal-0.14.1/src/third-party/qxtglobalshortcut.h Examining data/qterminal-0.14.1/src/third-party/qxtglobalshortcut_mac.cpp Examining data/qterminal-0.14.1/src/third-party/qxtglobalshortcut_p.h Examining data/qterminal-0.14.1/src/third-party/qxtglobalshortcut_win.cpp Examining data/qterminal-0.14.1/src/third-party/qxtglobalshortcut_x11.cpp FINAL RESULTS: data/qterminal-0.14.1/src/main.cpp:164:73: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. QString fname = QString::fromLatin1("qterminal_%1.qm").arg(QLocale::system().name().left(5)); data/qterminal-0.14.1/src/main.cpp:79:23: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. next_option = getopt_long(argc, argv, short_options, long_options, NULL); data/qterminal-0.14.1/src/bookmarkswidget.cpp:171:16: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (!f.open(QIODevice::ReadOnly)) data/qterminal-0.14.1/src/main.cpp:152:15: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). style.open(QFile::ReadOnly); data/qterminal-0.14.1/src/propertiesdialog.cpp:377:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (!f.open(QFile::ReadOnly)) data/qterminal-0.14.1/src/propertiesdialog.cpp:392:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (!f.open(QFile::WriteOnly|QFile::Truncate)) ANALYSIS SUMMARY: Hits = 6 Lines analyzed = 6588 in approximately 0.18 seconds (36792 lines/second) Physical Source Lines of Code (SLOC) = 4658 Hits@level = [0] 4 [1] 0 [2] 4 [3] 1 [4] 1 [5] 0 Hits@level+ = [0+] 10 [1+] 6 [2+] 6 [3+] 2 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 2.14684 [1+] 1.28811 [2+] 1.28811 [3+] 0.429369 [4+] 0.214684 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.