ITS4(1)

NAME
its4 - Scan C/C++ source for potential security problems.

SYNOPSIS
its4 [-mprCDHQSVW?] [-a function] [-c {0,1,2,3,4,5}] [-i function] [-I file] [-l function] [-o filename] [-q function] [-s {0,1,2,3,4,5,6}] [-v file] [-w cols] [--db-location=file] [--help] [--ignore=function] [--no-commands] [--no-descriptions] [--no-severity] [--paranoid] [--no-solutions] [--output=filename] [--query=function] [--reverse] [--no-handlers] [--quiet] [--ignore-file=file] [--add=function] [--input-mode] [--limit=function] [--severity-cutoff={0,1,2,3,4,5}] [--sort={0,1,2,3,4,5,6}] [--width=cols] [--mvs-reports] [FILE...]

DESCRIPTION
This manual page documents its4, a scanner for C and C++ code that searches for potential security holes.

The its4 scanner searches the entire program source with heuristics in an attempt to find library calls that may indicate a security vulnerability.

File arguments are required unless either the --query or --version argument is used.

  OPTIONS

-a, --add=function
    Add a new function name to the database for this scan only. Modify the database file or create a new database file for a more permanent solution.

-c, --severity-cutoff={0,1,2,3,4,5}
    Set severity cutoff. The default is 2. Lower numbers generally give more warnings.

-C, --no-commands
    Ignore commands to ITS4 that are embedded in comments. See the section "COMMANDS" for information on these commands.

-D, --no-descriptions
    Don't display descriptions of potential problems.

-H, --no-handlers
    Don't use any clever tricks, just match token names. This flag gives more warnings than if you don't use it (or at least no fewer). The reason is because checks that reduced the severity of strcpy(dst, ''foo'') to 0 are now not made.

-i, --ignore=function
    Ignore instances of a particular function name. This flag can be used as many times as you like.

-I, --ignore-file=filename
    Specify a file to read ignore info from, causing ITS4 to not report instances of those functions. Each function to ignore should be on its own line.

-l, --limit=function
    Tells ITS4 not to scan for any functions, except those passed in with this flag. You can use this flag as many times as you want.

-m, --input-mode
    Tells ITS4 to print out all non-argv spots at which input can enter. This option causes some other options to be ignored. Most importantly, the regular scan does not happen, no severities are visibly reported, and the cutoff is ignored. Also, the default sorting value changes to 0, from 2 (see below).

-o, --output=filename
    Direct output to a given filename instead of stdout.

-p, --paranoid
    By default, ITS4 ignores identifiers that don't look like functions. If you are afraid the code you're scanning abuses the preprocessor heinously, you may catch some extra stuff by turning this on. You will probably up the noise level significantly, though.

-q, --query=function
    Show database record for the given function name. This flag can be used as many times as you like.

-r, --reverse
    Sort output in reverse order.

-s, --sort={0,1,2,3,4,5,6}
    Sort output. Takes integer from 0-6. Default is 2, unless -m (--input-mode) flag is also set, in which case the default is 0.

0=  No sort, report in order scanned.

1=  Sort by most severe, then group by location.

2=  Sort by most severe, then group by vulnerability.

3=  Sort by vulnerability, then severity.

4=  Sort by vulnerability, then location.

5=  Sort by file, then by severity.

6=  Sort by file, then by vulnerability.

-S, --no-solutions
    Don't display solution guidelines for potential problems.

-v, --db-location=file
    Set the location of the vulnerability database to use.

-V, --no-severity
    Don't display the severity.

-w, --with=cols
    Set terminal width (for output wrapping). Without this flag, the COLUMNS environment variable is checked. If it is not present, then 80 is used.

-W, --mvs-reports
    Format output for use with Microsoft Visual Studio.

-?, --help
    Print a usage message on standard output and exit successfully.

--version
    Print version information on standard output then exit successfully.

COMMANDS
The programmer can pass commands to the ITS4 scanner from within the source code by embedding the commands within comments. Currently, the only command supported is the IGNORE command, which is capable of suppressing individual warnings (unless the -C flag is passed to the program). If there is code on the same line as the comment, then the command applies to that line. If not, the command applies to the very next line (so don't have blank lines between the comment and the code). If there are two comments on one line, both with ITS4 commands, the first operates only on the current line, up to the comment. The second operates only on the current line after the comment, or the next line if there is no code on the current line.

The ignore command is best explained with some examples: strcpy(dst, src); /* ITS4: ignore */

strcpy(dst, src); /* ITS4: ignore strcpy */

strcpy(dst, src); strcat(dst, src2);  /* ITS4: ignore */ // ignores both

strcpy(dst, src); strcat(dst, src2);  /* ITS4: ignore strcpy, strcat */

You can't embed a comment in the same comment block as the command. Use a separate comment for that.

BUGS
This man page is wrong if your system does not have GNU getopt, which supports long options. If that is the case, only short versions of options are supported.

AUTHOR
John Viega, viega@list.org

NOTE: The copyright of this software is held by Reliable Software Technologies. There are some restrictions to its commercial use. See the LICENCE file that came with the package for details, or visit http://www.rstcorp.com/its4