david-a-wheeler / flawfinder

a static analysis tool for finding vulnerabilities in C/C++ source code

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Recognize .sc file extension as C code

pbderr opened this issue · comments

My project has lots of C code with embedded SQL that is processed by the Oracle Pro*C pre-compiler. We use the ".sc" filename extension for these files. Could you please add ".sc" to your c_extensions list? Or, could you add an option to modify recognized filename extensions?

Thanks...

We could easily add ".sc" as an extension. However, that wouldn't change how the code is parsed. Is the pre-parsed code "close enough" to C syntax that this would actually work?

I think at the least we should add the extension. One problem is that SQL is obviously not the same syntactically as C (!); is there an easy way we can easily detect & skip SQL statements?

Maybe it doesn't matter; as long as the SQL ends in a semicolon, we can at least easily resync, and most of the times the SQL statements are unlikely to trigger a false positive.