Tool | Version | Checker | Description |
|---|
| Astrée | |
| Supported by stubbing/taint analysis |
| CodeSonar | | IO.INJ.COMMAND
IO.INJ.FMT
IO.INJ.LDAP
IO.INJ.LIB
IO.INJ.SQL
IO.UT.LIB
IO.UT.PROC
| Command injection
Format string injection
LDAP injection
Library injection
SQL injection
Untrusted Library Load
Untrusted Process Creation |
| Coverity | 6.5 | TAINTED_STRING | Fully implemented |
| Klocwork | | NNTS.TAINTED
SV.TAINTED.INJECTION |
|
| LDRA tool suite | | 108 D, 109 D | Partially implemented |
| Parasoft C/C++test | | CERT_C-STR02-a
CERT_C-STR02-b
CERT_C-STR02-c | Protect against command injection
Protect against file name injection
Protect against SQL injection |
| Polyspace Bug Finder | | Include Page |
|---|
| Polyspace Bug Finder_V |
|---|
| Polyspace Bug Finder_V |
|---|
|
| CERT C: Rec. STR02-C
| Checks for: - Execution of externally controlled command
- Command executed from externally controlled path
- Library loaded from externally controlled path
Rec. partially covered. |
