CVS commit: pkgsrc/security/flawfinder

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/security/flawfinder
From: "Adam Ciarcinski" <adam%netbsd.org@localhost>
Date: Wed, 7 Oct 2026 17:15:41 +0000

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Oct  7 17:15:41 UTC 2026

Modified Files:
        pkgsrc/security/flawfinder: Makefile PLIST distinfo

Log Message:
flawfinder: updated to 2.0.20

2.0.20
  Fix unlikely vulnerabilities (involving malicious filenames/text
  in analyzed systems) and implement various improvements
* Fix security vulnerabilities found by Gemini:
  - Terminal injection in standard output: apply strip_controls() to
    level and category in show().
  - Terminal injection in CSV output: apply strip_controls() to all
    untrusted fields in show_csv() (category, name, warning,
    suggestion, note, context_text).
  - XML injection in SonarQube output: use quoteattr() for all XML
    attributes in output_sonar().
  - Defense-in-depth: restrict setattr in Hit.__init__ to an allowlist
    of known keys used by rule definitions, countering pickle attacks.
    We previously warned to not load untrusted pickle files, but
    completely preventing attacks is better.
  - Shell injection in CI/CD file entrypoint.sh:
    quoted args with "$@" and moved output filename to
    FLAWFINDER_OUTPUT env var in action.yml.
* Fix terminal injection vulnerability via crafted filenames.
  A malicious file whose name contained ANSI escape sequences
  (e.g. ESC[2K CR ESC[32m[OK]...) could cause flawfinder's
  terminal output to be overwritten, e.g., so it falsely appeared
  that no security issues were found. Filenames containing
  control characters are now rejected with a warning.
  As defense in depth, h() and show_csv() also strip control
  characters from filenames before output.
  Reported by Dan Lenz (thank you!!).
* Reject malicious pickles on hitlist load. Hitlists (--loadhitlist,
  --diffhitlist) are now loaded via SafeUnpickler, a restricted
  unpickler that only allows the specific classes and hook functions
  that appear in legitimate hitlists. Arbitrary code execution from
  a crafted hitlist file is blocked. A @hook decorator registers each
  hook function, and a startup check ensures the allowlist stays in
  sync with the ruleset automatically.
* Fix false positive: strlen() on a string literal (e.g.,
  strlen("foo"), strlen(L"wide"), strlen(u8"utf8")) is always safe
  because string literals are guaranteed null-terminated. No warning
  is now issued in this case.
  Fixes https://sourceforge.net/p/flawfinder/bugs/24/
* Fix false positive: equal(), mismatch(), and is_permutation() used
  as identifiers (e.g. enum members) rather than function calls no
  longer produce spurious warnings.
  Fixes https://sourceforge.net/p/flawfinder/bugs/28/
* Fix false positive: std::ranges::equal(), std::ranges::mismatch(),
  and std::ranges::is_permutation() (C++20) check both range lengths
  automatically and are not vulnerable to over-read; they are no
  longer flagged.
  Fixes https://sourceforge.net/p/flawfinder/bugs/29/
* Fix typos in comments (preceeding, posible, theses, levle).
  Fixes https://sourceforge.net/p/flawfinder/bugs/27/
* Added CI workflow (GitHub Actions) to run the test suite on every
  push and pull request.
* Updated pylintrc for pylint 4.x compatibility.
* Added Sonar output format (--sonar). Thanks to Patschkowski.
* Updated CWE list delimiters.
* Added missing CWEs to FF1057 warning text.
* Removed duplicate word in help text.
* Fixed missing closing </li> tags in HTML output.
* Fixed typos in documentation.
* Fix false positives for method and member calls. Functions like
  read(), system(), or StrCat() are no longer flagged when preceded
  by "." or "->", e.g. stream.read(), obj.system(), ptr->read().
  Global calls and explicit global-scope calls (::system()) are still
  flagged. Fixes https://github.com/david-a-wheeler/flawfinder/issues/87
  https://github.com/david-a-wheeler/flawfinder/issues/83
  https://github.com/david-a-wheeler/flawfinder/issues/82
  https://github.com/david-a-wheeler/flawfinder/issues/76
  https://github.com/david-a-wheeler/flawfinder/issues/59
* Warn and skip files with encoding errors instead of aborting the
  entire scan. A count of skipped files is reported at the end and
  flawfinder exits with code 15 if any were skipped. The new
  --error-on-encoding flag restores the old abort-on-first-error
  behavior for strict pipelines.
  Fixes https://github.com/david-a-wheeler/flawfinder/issues/80
  https://github.com/david-a-wheeler/flawfinder/issues/68
* Fix SARIF output to produce valid URIs and helpUri values.
  File paths are now percent-encoded so spaces and special characters
  don't produce malformed URIs. Leading "./" prefixes are stripped so
  paths work correctly with the uriBaseId/SRCROOT placeholder (paths
  beginning with "-" retain "./" to avoid misinterpretation as CLI
  options). The helpUri field now reliably resolves to a CWE URL or
  falls back to a flawfinder rule URL; previously it could produce
  invalid values like ")".
  Fixes https://github.com/david-a-wheeler/flawfinder/issues/78
  https://github.com/david-a-wheeler/flawfinder/issues/67
  https://github.com/david-a-wheeler/flawfinder/issues/66
* Fix swprintf/vswprintf format-string detection. These functions take
  (buf, n, format, ...) so the format string is at position 3, not 2.
  Previously flawfinder inspected the size argument n instead, causing
  false positives on constant formats and missing non-constant ones.
  Fixes https://github.com/david-a-wheeler/flawfinder/issues/43
* Fix false positive: function names inside __attribute__((...)) are
  compiler metadata, not callable expressions,
  and are no longer flagged.
  E.g., __attribute__((format(printf, 1, 2))) no longer triggers a
  format-string warning.
  Fixes https://github.com/david-a-wheeler/flawfinder/issues/27
* Add --exclude PATTERN option (repeatable) to skip files or
  directories whose full path matches a glob pattern, e.g.
  --exclude '*/third_party/*'. Useful for ignoring generated code,
  vendored libraries, or test directories.
  Fixes https://github.com/david-a-wheeler/flawfinder/issues/89
  https://github.com/david-a-wheeler/flawfinder/issues/65


To generate a diff of this commit:
cvs rdiff -u -r1.31 -r1.32 pkgsrc/security/flawfinder/Makefile
cvs rdiff -u -r1.2 -r1.3 pkgsrc/security/flawfinder/PLIST
cvs rdiff -u -r1.12 -r1.13 pkgsrc/security/flawfinder/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/flawfinder/Makefile
diff -u pkgsrc/security/flawfinder/Makefile:1.31 pkgsrc/security/flawfinder/Makefile:1.32
--- pkgsrc/security/flawfinder/Makefile:1.31    Mon Aug 14 05:25:09 2023
+++ pkgsrc/security/flawfinder/Makefile Wed Oct  7 17:15:41 2026
@@ -1,19 +1,20 @@
-# $NetBSD: Makefile,v 1.31 2023/08/14 05:25:09 wiz Exp $
+# $NetBSD: Makefile,v 1.32 2026/10/07 17:15:41 adam Exp $
 
-DISTNAME=      flawfinder-2.0.19
-PKGREVISION=   1
+DISTNAME=      flawfinder-2.0.20
 CATEGORIES=    security devel
-MASTER_SITES=  https://www.dwheeler.com/flawfinder/
+MASTER_SITES=  https://dwheeler.com/flawfinder/
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
-HOMEPAGE=      https://www.dwheeler.com/flawfinder/
+HOMEPAGE=      https://dwheeler.com/flawfinder/
 COMMENT=       Python program to find flaws in C/C++ programs
 LICENSE=       gnu-gpl-v2
 
+TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools>=78:../../devel/py-setuptools
+
 INSTALLATION_DIRS=     ${PKGMANDIR}/man1
 
 post-install:
        ${INSTALL_MAN} ${WRKSRC}/flawfinder.1 ${DESTDIR}${PREFIX}/${PKGMANDIR}/man1
 
-.include "../../lang/python/egg.mk"
+.include "../../lang/python/wheel.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/security/flawfinder/PLIST
diff -u pkgsrc/security/flawfinder/PLIST:1.2 pkgsrc/security/flawfinder/PLIST:1.3
--- pkgsrc/security/flawfinder/PLIST:1.2        Mon Feb  6 11:23:50 2023
+++ pkgsrc/security/flawfinder/PLIST    Wed Oct  7 17:15:41 2026
@@ -1,11 +1,12 @@
-@comment $NetBSD: PLIST,v 1.2 2023/02/06 11:23:50 nros Exp $
+@comment $NetBSD: PLIST,v 1.3 2026/10/07 17:15:41 adam Exp $
 bin/flawfinder
-${PYSITELIB}/${EGG_INFODIR}/PKG-INFO
-${PYSITELIB}/${EGG_INFODIR}/SOURCES.txt
-${PYSITELIB}/${EGG_INFODIR}/dependency_links.txt
-${PYSITELIB}/${EGG_INFODIR}/entry_points.txt
-${PYSITELIB}/${EGG_INFODIR}/top_level.txt
-${PYSITELIB}/${EGG_INFODIR}/zip-safe
+${PYSITELIB}/${WHEEL_INFODIR}/METADATA
+${PYSITELIB}/${WHEEL_INFODIR}/RECORD
+${PYSITELIB}/${WHEEL_INFODIR}/WHEEL
+${PYSITELIB}/${WHEEL_INFODIR}/entry_points.txt
+${PYSITELIB}/${WHEEL_INFODIR}/licenses/COPYING
+${PYSITELIB}/${WHEEL_INFODIR}/top_level.txt
+${PYSITELIB}/${WHEEL_INFODIR}/zip-safe
 ${PYSITELIB}/flawfinder.py
 ${PYSITELIB}/flawfinder.pyc
 ${PYSITELIB}/flawfinder.pyo

Index: pkgsrc/security/flawfinder/distinfo
diff -u pkgsrc/security/flawfinder/distinfo:1.12 pkgsrc/security/flawfinder/distinfo:1.13
--- pkgsrc/security/flawfinder/distinfo:1.12    Mon Feb  6 11:23:50 2023
+++ pkgsrc/security/flawfinder/distinfo Wed Oct  7 17:15:41 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.12 2023/02/06 11:23:50 nros Exp $
+$NetBSD: distinfo,v 1.13 2026/10/07 17:15:41 adam Exp $
 
-BLAKE2s (flawfinder-2.0.19.tar.gz) = 0168e0f39c14517610584191e2106a2876f8c56399f5936cf2cf0c9e86fe2a0a
-SHA512 (flawfinder-2.0.19.tar.gz) = 7ac8684f157f30cb7cc0e2d9c270f92bb26e9207d9879530c499cc93af10070c2558f3794cc8b1a0a51b52ae771a4aa47157b467d0e6578cab96360cb0c6d90b
-Size (flawfinder-2.0.19.tar.gz) = 260817 bytes
+BLAKE2s (flawfinder-2.0.20.tar.gz) = 5a629e9be0f1a82432bd3781b22b9886a961e5a0c620d1ee8192497eb60b22a8
+SHA512 (flawfinder-2.0.20.tar.gz) = bd72f4145733f297dd70d3ba73fff1f481d50519431d76dfc1809af8b586c8b0311a62834ce217f5ced8732e2399ef93b592caa952f9cdb36e17ff2c5223c8c7
+Size (flawfinder-2.0.20.tar.gz) = 272298 bytes
 SHA1 (patch-setup.py) = adef74ae8bf53be447cfb3d68d5d9d8dc36b93f6

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: pkgsrc/devel/py-mocket
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: pkgsrc/devel/py-mocket
Indexes:

Home | Main Index | Thread Index | Old Index