OpenBLAS security analysis

Goal

Lear how to use Codee for Static Application Security Testing (SAST) and generate a SAST report for OpenBLAS.

Getting started

Make sure you have Codee installed and available on your machine and clone the OpenBLAS repository.

git clone https://github.com/OpenMathLib/OpenBLAS.git

Now navigate to the source code:

cd OpenBLAS

Walkthrough

1. Generate the compile_commands.json

The compile_commands.json can be obtained using bear:

bear -- make -j

2. Run Codee SAST report

New feature

Running codee commands with the additional --db codee.db flag enables Incremental Static Analysis. This reduces runtime by storing analysis results and reusing them in subsequent analysis, reanalyzing only the source code that has changed.

To obtain Codee SAST results for the CWE standard execute the following command:

codee screening --sast

You should have obtained a result similar to this:

<...>

0 file analyses reused from cache, 5263 files analyzed from scratch
5263 target files, 7502 functions, 18583 loops, 1035170 SLOCs successfully analyzed (33164 checkers) and 0 non-analyzed files in 20 m 14 s