v6.24.7

• The CodeChecker server in the codechecker-web docker image could not connect to LDAP servers for authentication using SSL and the authentication was not working. This was fixed.

Full Changelog: v6.24.6...v6.24.7

v6.24.6

• Update the Python version in the codechecker-web Docker image
• Fix an URL parsing error in the web server
  Full Changelog: v6.24.5...v6.24.6

v6.24.5

This is a security patch release

Move from cookie-based to token-based authentication
Session-based authentication is deprecated, but left in for the benefit of old CLI clients.
When performing upgrade, all users will need to re-authenticate.

v6.25.0-rc1

🌟 Highlights

Guideline Statistics page under the statistics tab to generate SEI Cert Compliance reports

A new Guideline Statistics page is added under the statistics tab to generate SEI Cert Compliance reports.

This page shows the compliance of an analyzed program to a coding guideline (such as SEI Cert C/C++) . It shows all checkers corresponding to a guideline rule, their configuration status (on/off) and all outstanding and closed reports per guideline rule.

It is possible to generate the table into HTML and CSV format.

The first supported guidelines are SEI Cert C and C++.

Facebook Infer as a new C/C++ analyzer plugin

Besides clang-tidy, clang static analyzer, cppcheck and gcc, Facebook Infer is a well known open-source static code analyzer tool https://github.com/facebook/infer

CodeChecker will support executing this analyzer. It will not be enabled by default, but is available for testing.

PVS Studio report conversion

From now on, it will be possible to convert the reports of the https://pvs-studio.com/en/pvs-studio/ analyzer and handle them with CodeChecker.
PVS-Studio Static Code Analyzer support by @feeelin in #4356

❗ Backward incompatible changes

• Resolve checker enable/disable ambiguity by @noraz31 in #4377 and by @cservakt in #4392
  CodeChecker analyze emits an error (instead of a warning) when the enabled checkers/profiles/checker prefix groups are given ambigously. In these cases the ambiguity must be resolved. For example CodeChecker analyze -e security command is ambigous as security is a checker group (all checkers starting with security. and a profile at the same time. Please define explicitly CodeChecker -e prefix:security if you mean the prefix group, or profile:security if you mean the security profile.

CodeChecker -e clang-diagnostic-format will give an error, because it is ambigous if the user means the clang-diagnostic-format single checker, or all chekcers starting with clang-diagnostic-format. To refer the former, the user must user checker:clang-diagnostic-format or to the latter prefix:clang-diagnostic-format.

If you have such clashing cases, you must resolve them. The following namespaces can be used
prefix: - to mach checkera starting with a prefix
profile: - to match a checker profile
checker: - to match a single checker
guideline: - to match checkers belonging to a guideline
severity: - to match checkers belonging to a given severity.

• The skip file handling changed! Adding a --drop-reports-from-skipped-files parameter to analyze by @dkrupp in #4332
  After this patch, the skip files will only skip the analysis of the listed files, but will not filter out any reports. This may result in more reports than before.
  By default CodeChecker used to filter out all reports from files which were on the skip list. This can hide true positive reports strating from unskipped code and ending in skipped files (typical with CTU and header related findings).
  This patch removes the default report filtering post processing step from CodeChecker analyze --skip SKIPFILE operation.
  The legacy functionality is still available with the --drop-reports-from-skipped-files paramer.

• guideline:sei-cert cannot be used anymore. The sei-cert guideline profile was split to guideline:sei-cert-c for the C guideline and guideline:sei-cert-cpp for the C++ guideline. #4400

• CodeChecker -e W* syntax is not supported anymore. Clang warnings only appear as clang-diagnostic-* checkers and the

🐛 Analyzer improvements

• [fix] Resolve checker enable/disable ambiguity #4392
• [fix] Don't capture cc1 by the logger. by @bruntib in #4300
• Add -mmitigate-rop to ignored options by @noraz31 in #4295
• Removing alpha checkers from the security profile so it can be used in production by @dkrupp in #4284
• [analyzer] Adds -fno-freestanding to ignored GCC compiler flags by @ArchieAtkinson in #4281
• [analyzer] Disable clang-diagnostic-error checker by @cservakt in #4325
• [analyzer] Ignore -fno-printf-return-value by @pdgendt in #4329
• [anayzer] Fb infer by @stt08 in #4257

💻 CLI/Server improvements

• Fix trim-path-prefix functionality in HTML export by @dkrupp #4387
• Automatic addition of database before connecting to it by @feyruzb #4316
• Resolve paths when blaming files by @tomhughes #4357
• Fix the endpoint parsing issue by @dkrupp in 8953b30
• Removing the root user creation by @dkrupp in 3bb2cbf
• [feat] Adding report annotation for json export by @cservakt in #4380
• [fix] Get product configuration with view permission by @bruntib in #4375
• CodeChecker authentication fixed by @dkrupp in #4369
• [fix] Forwarding --ctu-ast-mode to analyze command by @bruntib in #4341
• [fix] Better SQL SELECT instead of a timeout query by @bruntib in #4363
• Speeding up store by removing nested query by @dkrupp in #4358
• Environment initialization for binaries by @dkrupp in #4337
• [fix] Missing analyzer error by @cservakt in #4330
• [fix] Don't reset PATH in Cppcheck plugin by @bruntib in #4320
• [feat] Implicit include paths added with -idirafter by @bruntib in #4315
• Revert "[analyzer] Use absolute path to logger.so in LD_PRELOAD" by @dkrupp in #4314
• [cmd] Checker name prefixes are meant along separator characters by @bruntib in #4311
• [fix] Support joker characters at annotation filter by @bruntib in #4306
• Analyzer binary dependent environment by @dkrupp in #4305
• [fix] Minor fixing for statistics tabs by @cservakt in #4304
• [fix] Don't enable checkers by suffix by @bruntib in #4307
• [Fix] Report sorting in unique mode by @cservakt in #4294
• [fix] Error when debug logging skipped actions by @bruntib in #4301

🌳 Environment

• PVS-Studio Static Code Analyzer support by @feeelin in #4356
• Bump webpack from 5.91.0 to 5.94.0 in /web/server/vue-cli by @dependabot in #4334
• [cfg] Add setuptools as a dependency by @bruntib in #4285
• Deprecate distutils by @EinarArnason in #4286
• Bump urllib3 from 2.2.1 to 2.2.2 in /scripts/labels/label_tool by @dependabot in #4290
• [cfg] Upgrade to pylint 3.2.4 by @bruntib in #4279
• [cfg] Upgrade lxml version by @bruntib in #4262
• Bump follow-redirects from 1.15.4 to 1.15.6 in /web/server/vue-cli by @dependabot in #4192

📖 Documentation updates

• Modified documentation to match current procedures for changing schema by @feyruzb in #4366
• chore: Remove ancient, unused docs/checker_docs.md by @whisperity in #4283
• additional library was required for venv_dev by @stt08 in #4273

🔨 Other

• [cfg] Add info for new unix.Chroot Checker by @vabridgers #4391
• Add test for Disable clang-diagnostic-error checker #4325 by @noraz31 in #4339
• Github Actions: stop previous jobs when a new one was pushed by @stt08 in #4351
• Bring code borrowed from http.server in sync with upstream by @Discookie in #4379
• [test] Fix test with new clang version by @bruntib in #4382
• [cmd] Display warning instead of debug log for missing diagtool by @bruntib in #4342
• [test] The assertDictContainsSubset() is depreceted and removed by @bruntib in #4322
• [fix] fix compare_results.py sciprt by @bruntib in #4319
• [script] Script for querying all reports by @bruntib in #4245
• chore(config): Apply invariant fixes from label-tool by @whisperity in #4291
• [cfg] Upgrade pycodestyle to 2.12.0 by @bruntib in https://github.com/Ericsson/c...

v6.24.4

This release fixes a bug about permission settings:

• [fix] Get product configuration with view permission #4375
  Users with admin rights couldn't get product configuration page for changing product configuration or setting user permissions.

v6.24.3

This release fixes an authentication issue:

• CodeChecker authentication fixed #4369
  Version 6.24.2 introduced the super_user field in the server_config.json.
  If this field was missing from the config file, the authentication did not work for any user.

v6.24.2

This release contains security vulerability fixes.
It is highly recommended to upgrade to this as soon as possible.

1. [fix] Removing the root user creation 3bb2cbf
   Backward incompatible change: The built-in root user generated at CodeChecker server start with
   CodeChecker --reset-root ... has been disabled.
   Instead, the user can give SUPER_USER permission to an existing user in the server_config.json
   For further details, see https://github.com/Ericsson/codechecker/blob/master/docs/web/user_guide.md#initial-super-user

2. Fix the endpoint parsing issue 8953b30
   CodeChecker web server has accepted some invalid URLs. The URL parsing has been hardened.

v6.24.1

🌟 Highlights

Standard library handling change

GCC has implicit include paths that are forwarded to Clang. Until now these paths were added with -isystem flag, but sometimes the priority of this is too high: https://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html The implicit include paths should be searched the last, so -isystem has been changed to -idirafter.
In case of potential backward compatibility break --add-gcc-include-dirs-with-isystem has been introduced for "CodeChecker analyze" command which reverts this change.

ld_logger environment change

CodeChecker log command uses the LD_PRELOAD environment variable for collecting the build commands. This environment variable relies on LD_LIBRARY_PATH which tells where to find the .so file set in LD_PRELOAD. Some build systems overwrite the value of LD_LIBRARY_PATH and for this reason CodeChecker fails to collect build commands. A solution to this problem was to fill LD_PRELOAD with an absolute path. However, this solution doesn't work when the analyzed project is built for multiple target architectures (e.g 32 and 64 bits), since CodeChecker sets a single absolute path based on the host architecture.
If the project's build system is resetting LD_LIBRARY_PATH, then the workaround solution is to extend LD_LIBRARY_PATH with the proper ldlogger.so file: For further details consult this documentation.

Enable checkers by group prefix

Checkers can be enabled by providing a group prefix. For example, cplusplus.NewDeleteLeaks can be enabled by --enable cplusplus. The problem was that checkers are enabled by any name prefix, so this former checker is also enabled by cplusplus.NewDelete which is not an intended behavior. This release fixes this issue.
Also, it was possible to enable checkers by suffix (e.g. --enable NewDeleteLeaks). As of this release, the suffix matching is not checked either.

💻 CLI/Server improvements

• [fix] Don't reset PATH in Cppcheck plugin #4320
• [feat] Implicit include paths added with -idirafter #4315
• Revert "[analyzer] Use absolute path to logger.so in LD_PRELOAD" #4314
• [cmd] Checker name prefixes are meant along separator characters #4311
• Analyzer binary dependent environment #4305
• [fix] Support joker characters at annotation filter #4306
• [Fix] Report sorting in unique mode #4294
• [fix] Don't enable checkers by suffix #4307
• [fix] Minor fixing for statistics tabs #4304
• [fix] Error when debug logging skipped actions #4301
• [fix] Don't capture cc1 by the logger. #4300
• Add -mmitigate-rop to ignored options #4295
• [analyzer] Ignore -fno-printf-return-value #4329
• [fix] Disable clang-diagnostic-error checker #4325
• [fix] Missing analyzer error #4330
• [fix] Forwarding --ctu-ast-mode to analyze command #4341
• Environment initialization for binaries #4337

🌳 Environment

• [cfg] Add setuptools as a dependency #4285
• Deprecate distutils #4286
• Bump urllib3 from 2.2.1 to 2.2.2 in /scripts/labels/label_tool #4290
• [cfg] Upgrade to pylint 3.2.4 #4279
• [analyzer] Adds -fno-freestanding to ignored GCC compiler flags #4281
• [cfg] Upgrade pycodestyle to 2.12.0 #4264
• [cfg] Upgrade lxml version #4262

🔨 Other

• [test] The assertDictContainsSubset() is depreceted and removed #4322
• [fix] fix compare_results.py sciprt #4319
• [script] Script for querying all reports #4245
• [cmd] Display warning instead of debug log for missing diagtool #4342

v6.24.0

🌟 Highlights

Listing of Enabled/Disabled Checkers in the WEB UI per run

CodeChecker provides a new view in the "Analysis information tab" which lists all checkers that were enabled during analysis.

• feat(server): Store information about available checkers to the database by @whisperity in #4089

New Checker Coverage Statistics view with coding guideline references

CodeChecker provides a new view to display all enabled checkers for a set of selected runs. Additionally, it also lists all guideline rules related to the given checker. For example, you can verify whether your code has any SEI Cert coding guideline violation.

The new table lists all checkers that were enabled in a set of selected analysis runs, shows the number of outstanding reports and the number of closed reports per enabled checker and the related coding guideline rules.

How is this new view different compared to the existing "Checker Statistics View"?
The Checker Statistics View only displays checkers that produced reports for the selected runs.
This new view additionally lists all checkers that were enabled in the last analysis for the selected runs.

• [GUI] New "Checker Coverage" statistics tab to show all enabled checkers and … by @cservakt in #4210

Faster run storage

Thanks to a new optimization, the run storage duration can be up to 50% faster.

• [store] Unique reports before storing by @Szelethus in #4152

New Static HTML Report Pages

• [cmd] Restructure static HTML generation so it can handle much larger result set. #4168
• [feat] Display dynamic analysis generated testcase and timestamp columns in static HTML #4172

New report filter to list closed and outstanding reports

A new filter has been added to list outstanding and closed reports. An outstanding report is a report with detection status new, reopened, unresolved with review status unreviewed or confirmed.

• Showing closed reports by @cservakt in #4244

Web GUI improvements

• [fix] Fixing OFF and UNAVAILABLE detectionStatus in the report sidebar by @cservakt in #4127
• feat(gui): Checker status auditing by @whisperity in #4156
• test(gui): Add front-end test for checked status in AnalysisInfo dialog by @whisperity in #4202
• Showing closed reports by @cservakt in #4244

❗ Backward incompatible changes

None

🐛 Analyzer improvements

• [analyzer] Ignore -fno-tree-dominator-opts by @bo-dani in #4141
• [fix] Cppcheck premium version check by @bruntib in #4155
• [gcc] Don't emit a missing gcc warning if no checkers are enabled by @Szelethus in #4179
• [fix] --cppcheckargs should be present in "CodeChecker check" by @bruntib in #4178
• [gcc][GUI] Fix indentations for gcc fn calls bug reports by @Szelethus in #4182
• Add functionality to validate analyzer and checker options by @noraz31 in #4204
• Fix a bug in #3866 where check didn't respect --no-missing-checker-error by @Szelethus in #4217
• Display warning if the compilation database is empty by @noraz31 in #4226
• Do not allow parse if the does not exist by @noraz31 in #4212
• [fix] Pass envp to posix_spawn in ld_logger by @bruntib in #4146
• [analyze] Removing long enabled checker list at info log level by @dkrupp in #4103

💻 CLI/Server improvements

• Fix debug logging in store by @vodorok in #4134
• Fix remote server path resolution by @vodorok in #4131
• [report-converter][fix] Don't crash when we can't find the checker name for ubsan by @Szelethus in #4143
• Fix typo 'vesion' in sarif conversion template by @SirMutantRat in #4140
• [report-converter] Allow for empty strings in sanitizer error msgs by @Szelethus in #4147
• [fix] Eliminate unnecessary error logging by @bruntib in #4162
• Fix impossible blame info collection by @vodorok in #4190
• fix(migration): Migrate reports with appropriate default checker ID by @whisperity in #4191
• fix(migration): Do not emit log output for checker_id normalisation by @whisperity in #4198
• feat(server): Multiprocess migration and db_cleanup #4175
• [fix] Prevent overlapping report groups #4215
• [fix] Replace UTF-8 dash characters #4216
• [cmd] Check for non-existing source components by @bruntib in #4203
• Fix a crash where config handlers were built with missing binaries by @Szelethus in #4241
• [fix] Creating new temporary directory for zip files by @cservakt in #4237
• [db] Faster query for comment garbage collection by @bruntib in #4254
• [fix] Use module uuid instead of tempfile by @bruntib in #4253
• [cmd] Add --anywhere-on-report-path flag to CLI by @bruntib in #4255
• Support relative paths in the --file option by @noraz31 in #4250
• [Fix] Drop foreign key constraints for faster analysis info deleting by @cservakt in #4259

🌳 Environment

• Adding OpenSSF Scorecard badge to README by @gkunz in #4164

📖 Documentation updates

• [doc] Fix documentation URL in highlights page by @bruntib in #4136
• [docs] Rewrite the docs for diff by @Szelethus in #4006
• chore(docs): Remove mentions of Python 2 and ancient Clang limitations from the README by @whisperity in #4174
• Update usage.md: fix typo by @ArnaudBienner in #4153
• Fix Broken Links In Documentation by @justindhillon in #4159
• Fix typos by @omahs in #4173
• additional guidance for silicon mac users by @feyruzb in #4188
• chore(config): [clangsa][clang-tidy] Fix dead doc_urls in checker labels by @whisperity in #4214
• [config] Label Clang 18.0-19.trunk SA & Tidy checkers by @sylvestre in #4193
• [fix] Links in static HTML files should be relative by @bruntib in #4236
• feat(script): Verify the existence of checker config doc_url pages and find appropriate older releases for gone (removed, dealpha, etc.) checkers by @whisperity in #4207

🔨 Other

• Bump version to 6.24.0 by @vodorok in #4126
• Bump follow-redirects from 1.15.3 to 1.15.4 in /web/server/vue-cli by @dependabot in #4151
• Bump gitpython from 3.1.37 to 3.1.41 in /web by @dependabot in #4150
• [fix] Fixing getReportAnnotations subquery by @cservakt in #4229
• chore(ci): Disable failing and dangerous PyPI publishing job by @whisperity in #4231
• Updating clangsa sei cert mapping for clang 18 by @dkrupp in #4239
• chore(config): Add automatically generated doc_urls and severitys by @whisperity in #4224
• chore(config): [clang-tidy] Update SEI-CERT Guideline mappings by @whisperity in #4235
• [config] Adding sei-cert rule mappings for clang diagnostics by @dkrupp in #4243
• Always pass absolute paths to skip handler by @vodorok in #4227
• [config] Minor updates of the clangsa, clang-tidy profiles by @dkrupp in #4246
• Make sure that the Number of runs is displayed correctly by @noraz31 in #4242
• [fix] Store temp .plist files in report dir during store by @bruntib in #4248
• [feature] Adding guideline label to Checker Coverage tab by @cservakt i...

v6.24.0-rc1

🌟 Highlights

Listing of Enabled/Disabled Checkers in the WEB UI per run

CodeChecker provides a new view in the "Analysis information tab" which lists all checkers that were enabled during analysis.

• feat(server): Store information about available checkers to the database by @whisperity in #4089

New Checker Coverage Statistics view

CodeChecker provides a new view to display all enabled checkers for a set of selected runs.
The new table lists all checkers that were enabled in a set of selected analysis runs, shows the number of outstanding reports and the number of closed reports per enabled checker.

How is this new view different compared to the existing "Checker Statistics View"?
The Checker Statistics View only displays checkers that produced reports for the selected runs.
This new view additionally lists all checkers that were enabled in the last analysis for the selected runs.

• [GUI] New "Checker Coverage" statistics tab to show all enabled checkers and … by @cservakt in #4210

Faster run storage

Thanks to a new optimization, the run storage duration can be up to 50% faster.

• [store] Unique reports before storing by @Szelethus in #4152

New Static HTML Report Pages

• [cmd] Restructure static HTML generation so it can handle much larger result set. #4168
• [feat] Display dynamic analysis generated testcase and timestamp columns in static HTML #4172

Web GUI improvements

• [fix] Fixing OFF and UNAVAILABLE detectionStatus in the report sidebar by @cservakt in #4127
• feat(gui): Checker status auditing by @whisperity in #4156
• test(gui): Add front-end test for checked status in AnalysisInfo dialog by @whisperity in #4202

❗ Backward incompatible changes

None

🐛 Analyzer improvements

• [analyzer] Ignore -fno-tree-dominator-opts by @bo-dani in #4141
• [fix] Cppcheck premium version check by @bruntib in #4155
• [gcc] Don't emit a missing gcc warning if no checkers are enabled by @Szelethus in #4179
• [fix] --cppcheckargs should be present in "CodeChecker check" by @bruntib in #4178
• [gcc][GUI] Fix indentations for gcc fn calls bug reports by @Szelethus in #4182

💻 CLI/Server improvements

• Fix debug logging in store by @vodorok in #4134
• Fix remote server path resolution by @vodorok in #4131
• [report-converter][fix] Don't crash when we can't find the checker name for ubsan by @Szelethus in #4143
• Fix typo 'vesion' in sarif conversion template by @SirMutantRat in #4140
• [report-converter] Allow for empty strings in sanitizer error msgs by @Szelethus in #4147
• [fix] Eliminate unnecessary error logging by @bruntib in #4162
• Fix impossible blame info collection by @vodorok in #4190
• fix(migration): Migrate reports with appropriate default checker ID by @whisperity in #4191
• fix(migration): Do not emit log output for checker_id normalisation by @whisperity in #4198
• feat(server): Multiprocess migration and db_cleanup #4175
• [fix] Prevent overlapping report groups #4215
• [fix] Replace UTF-8 dash characters #4216

🌳 Environment

• Adding OpenSSF Scorecard badge to README by @gkunz in #4164

📖 Documentation updates

• [doc] Fix documentation URL in highlights page by @bruntib in #4136
• [docs] Rewrite the docs for diff by @Szelethus in #4006
• chore(docs): Remove mentions of Python 2 and ancient Clang limitations from the README by @whisperity in #4174
• Update usage.md: fix typo by @ArnaudBienner in #4153
• Fix Broken Links In Documentation by @justindhillon in #4159
• Fix typos by @omahs in #4173
• additional guidance for silicon mac users by @feyruzb in #4188

🔨 Other

• Bump version to 6.24.0 by @vodorok in #4126
• Bump follow-redirects from 1.15.3 to 1.15.4 in /web/server/vue-cli by @dependabot in #4151
• Bump gitpython from 3.1.37 to 3.1.41 in /web by @dependabot in #4150

---

New Contributors

• @SirMutantRat made their first contribution in #4140
• @bo-dani made their first contribution in #4141
• @justindhillon made their first contribution in #4159
• @omahs made their first contribution in #4173
• @feyruzb made their first contribution in #4188

Full Changelog: v6.23.1...v6.24.0-rc1