ossf / ossf/package-analysis

Add more identifiers that are declared outside scope to parser output

Open
#519 0 comments 0 reactions 1 assignee View on GitHub

@maxfisher-g is already working on this.

Since Dec 12, 2022.

enhancement static analysis
Dominant language
Go
Stars
912
Forks
74
PR merge metrics
No merged PRs in 30d

Description

Currently, the parser tries to filter out identifier references and only report declarations. In particular, identifiers are parsed from variable, function, method and class declarations (and more), and this is good because it captures names that originate from the package.

On the other hand, names of variables that are simply written to or read from are ignored, and calls to functions or methods are ignored since they must have been defined elsewhere. The downside of this is that there might be telltale ('suspicious') function calls which are often associated with obfuscated code, such as exec.

So it might make sense to include some level of referenced identifiers in the parser output too, with some extra metadata that can be used to distinguish between what's been declared in the file vs what was simply referenced.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.