rpms/rats/devel rats-2.1-build-clean.patch, NONE, 1.1 rats-2.1-gtk-vuln.patch, NONE, 1.1 rats-2.1-lex.patch, NONE, 1.1 rats-2.1-php.patch, NONE, 1.1 rats-2.1-report.patch, NONE, 1.1 rats.spec, NONE, 1.1 .cvsignore, 1.1, 1.2 sources, 1.1, 1.2
Scott Henson (shenson)
fedora-extras-commits at redhat.com
Mon Oct 15 03:21:48 UTC 2007
- Previous message (by thread): rpms/gcin/F-7 gcin.spec, 1.23, 1.24 im-client.patch, 1.8, 1.9 newcj3.patch, 1.1, 1.2
- Next message (by thread): devel/ppc64-utils bootinfo.txt, NONE, 1.1 ofboot.b, NONE, 1.1 ppc64-utils.spec, 1.28, 1.29
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: shenson
Update of /cvs/pkgs/rpms/rats/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv29557/devel
Modified Files:
.cvsignore sources
Added Files:
rats-2.1-build-clean.patch rats-2.1-gtk-vuln.patch
rats-2.1-lex.patch rats-2.1-php.patch rats-2.1-report.patch
rats.spec
Log Message:
Initial Import of Rats
rats-2.1-build-clean.patch:
--- NEW FILE rats-2.1-build-clean.patch ---
=== modified file 'Makefile.in'
--- Makefile.in 2007-10-09 18:57:42 +0000
+++ Makefile.in 2007-10-09 21:11:18 +0000
@@ -5,7 +5,7 @@
LEX = @LEX@
CC = @CC@
-prefix = @prefix@
+prefix ?= @prefix@
exec_prefix = @exec_prefix@
BINDIR = @bindir@
LIBDIR = @libdir@
@@ -16,8 +16,8 @@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
-CFLAGS = -Wall -g @CFLAGS@ @DEFS@ -DDATADIR=\"$(SHAREDIR)\"
-LDFLAGS = -Wall -g @LDFLAGS@
+CFLAGS = -Wall @CFLAGS@ @DEFS@ -DDATADIR=\"$(SHAREDIR)/rats\"
+LDFLAGS = -Wall @LDFLAGS@
LEXFLAGS = -F -8
BIN = rats
=== modified file 'engine.c'
--- engine.c 2007-10-09 18:57:42 +0000
+++ engine.c 2007-10-09 21:10:12 +0000
@@ -32,7 +32,7 @@
* of a reasonable OS -- Robert */
#define _S_ISTYPE(mode, mask) (((mode) & _S_IFMT) == (mask))
#define S_ISDIR(mode) _S_ISTYPE((mode), _S_IFDIR)
-#define _S_ISDIR(mode) S_ISDIR(mode)
+#define _S_ISDIR(mode) S_ISDIR(mode)
#define S_ISREG(m) _S_ISTYPE((m), _S_IFREG)
#else
=== modified file 'main.c'
--- main.c 2007-10-09 18:57:42 +0000
+++ main.c 2007-10-09 21:10:12 +0000
@@ -22,7 +22,8 @@
#include <stdio.h>
#include <stdlib.h>
#include "getopt.h"
-#ifndef _MSC_VER
+#ifndef _MSC_VER
+
#include <sys/time.h>
#include <unistd.h>
#else
@@ -138,7 +139,7 @@
printf(" --help\n");
printf(" -i report functions that accept external input\n");
printf(" --input\n");
- printf(" -l <language> force the specified langauge to be used\n");
+ printf(" -l <language> force the specified language to be used\n");
printf(" --language <language>\n");
printf(" -r include references that are not function calls\n");
printf(" --references\n");
@@ -160,7 +161,7 @@
printf(" --resultsonly\n");
printf(" No header, footer, or status information\n");
printf(" --columns\n");
- printf(" Show column number of hte line where the problem occured.\n");
+ printf(" Show column number of the line where the problem occured.\n");
printf(" --context\n");
printf(" Display the line of code that caused the problem report\n");
}
@@ -228,7 +229,7 @@
printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.0 Transitional//EN\">\n");
printf("<html>\n");
- printf("<head></head>\n");
+ printf("<head>\n<title>Rats Results</title>\n</head>\n");
printf("<body>\n");
if (flags & NO_HEADER)
@@ -278,6 +279,7 @@
{"columns", 0,0,0},
{"context", 0,0,0},
{"all-static", 0,0,0},
+ {0,0,0,0}
};
progname = argv[0];
flags|=RECURSIVE_FILE_SCAN;
@@ -520,7 +522,8 @@
} else {
output_header(flags);
}
-
+
+
#ifdef _MSC_VER
time_started = GetTickCount();
#else
rats-2.1-gtk-vuln.patch:
--- NEW FILE rats-2.1-gtk-vuln.patch ---
=== modified file 'rats-c.xml'
--- rats-c.xml 2007-10-09 18:57:42 +0000
+++ rats-c.xml 2007-10-09 19:11:54 +0000
@@ -2830,5 +2830,22 @@
<Severity>High</Severity>
</Info>
</Vulnerability>
+
+ <!-- GTK/GLib specific problems, added by Steve Kemp -->
+ <Vulnerability>
+ <Name>g_get_tmp_dir</Name>
+ <Info>
+ <Description>This function returns the contents of the environmental variable TMP and can be any length, containing arbitary characters. It should be treated as getenv.</Description>
+ <Severity>High</Severity>
+ </Info>
+ </Vulnerability>
+ <Vulnerability>
+ <Name>g_get_home_dir</Name>
+ <Info>
+ <Description>This function returns the contents of the environmental variable HOME and can be any length, containing arbitary characters, it should be treated as getenv.</Description>
+ <Severity>High</Severity>
+ </Info>
+ </Vulnerability>
+
</VulnDB>
rats-2.1-lex.patch:
--- NEW FILE rats-2.1-lex.patch ---
=== modified file 'c-lex.l'
--- c-lex.l 2007-10-09 18:57:42 +0000
+++ c-lex.l 2007-10-09 19:09:47 +0000
@@ -31,7 +31,6 @@
static int identifier(void);
static int string_const(void);
-static int preprocessor(void);
static void reset_comment(void);
static int cstyle_comment(void);
static void no_match(void);
@@ -63,7 +62,50 @@
%%
-"#" { count(); return preprocessor(); }
+"#" {
+ signed char c;
+ count();
+
+ while ((c = input()) && c != -1)
+ {
+ clexreal_column++;
+ if (c == '\n')
+ {
+ clex_lineno++;
+ clexreal_column = 0;
+ clex_column = 0;
+ break;
+ }
+ if (c == '\r')
+ {
+ clex_lineno++;
+ clexreal_column = 0;
+ clex_column = 0;
+ }
+
+ /* handle multi-line comments beginning on a preprocessor line */
+ if (c == '/')
+ {
+ if (!(c = input()) || c == -1)
+ break;
+ clexreal_column++;
+ if (c == '*')
+ {
+ int save_lineno = clex_lineno;
+
+ cstyle_comment();
+ if (clex_lineno != save_lineno)
+ return TOKEN_COMMENT;
+ continue;
+ }
+ clexreal_column--;
+ unput(c);
+ }
+ }
+
+ return TOKEN_JUNK;
+}
+
"/*" { count(); return cstyle_comment(); }
"//".* { count(); reset_comment();
accumulate_comment(yytext+2,strlen(yytext+2));
@@ -259,7 +301,7 @@
static
int cstyle_comment(void)
{
- char c;
+ signed char c;
reset_comment();
while ((c = input()) && c != -1)
@@ -296,50 +338,6 @@
return TOKEN_COMMENT;
}
-static
-int preprocessor(void)
-{
- char c;
-
- while ((c = input()) && c != -1)
- {
- clexreal_column++;
- if (c == '\n')
- {
- clex_lineno++;
- clexreal_column = 0;
- clex_column = 0;
- break;
- }
- if (c == '\r')
- {
- clex_lineno++;
- clexreal_column = 0;
- clex_column = 0;
- }
-
- /* handle multi-line comments beginning on a preprocessor line */
- if (c == '/')
- {
- if (!(c = input()) || c == -1)
- break;
- clexreal_column++;
- if (c == '*')
- {
- int save_lineno = clex_lineno;
-
- cstyle_comment();
- if (clex_lineno != save_lineno)
- return TOKEN_COMMENT;
- continue;
- }
- clexreal_column--;
- unput(c);
- }
- }
-
- return TOKEN_JUNK;
-}
static
void no_match(void)
=== modified file 'perl-lex.l'
--- perl-lex.l 2007-10-09 18:57:42 +0000
+++ perl-lex.l 2007-10-09 19:09:47 +0000
@@ -431,7 +431,7 @@
{
int bslash = 0;
- char c;
+ signed char c;
while ((c = input()) && c != -1)
{
@@ -468,7 +468,7 @@
int bline = 0;
int cstate = 0;
- char c;
+ signed char c;
while ((c = input()) && c != -1)
{
perllexreal_column++;
=== modified file 'php-lex.l'
--- php-lex.l 2007-10-09 18:57:42 +0000
+++ php-lex.l 2007-10-09 19:09:47 +0000
@@ -274,7 +274,7 @@
{
int bslash = 0;
- char c;
+ signed char c;
while ((c = input()) && c != -1)
{
@@ -375,7 +375,7 @@
static
int cstyle_comment(void)
{
- char c;
+ signed char c;
reset_comment();
while ((c = input()) && c != -1)
=== modified file 'python-lex.l'
--- python-lex.l 2007-10-09 18:57:42 +0000
+++ python-lex.l 2007-10-09 19:09:47 +0000
@@ -197,7 +197,7 @@
{
int bslash = 0;
- char c;
+ signed char c;
while ((c = input()) && c != -1)
{
@@ -252,7 +252,7 @@
static
int longstring(int q)
{
- char c;
+ signed char c;
int quotes = 0;
int backtick = 0;
rats-2.1-php.patch:
--- NEW FILE rats-2.1-php.patch ---
=== modified file 'engine.c'
--- engine.c 2007-10-09 19:04:47 +0000
+++ engine.c 2007-10-09 19:05:16 +0000
@@ -33,6 +33,7 @@
#define _S_ISTYPE(mode, mask) (((mode) & _S_IFMT) == (mask))
#define S_ISDIR(mode) _S_ISTYPE((mode), _S_IFDIR)
#define _S_ISDIR(mode) S_ISDIR(mode)
+
#define S_ISREG(m) _S_ISTYPE((m), _S_IFREG)
#else
@@ -928,8 +929,10 @@
setup_python(fd);
else if (!strcasecmp(dot, ".pl") || !strcasecmp(dot, ".pm"))
setup_perl(fd);
- else if (!strcasecmp(dot, ".php"))
- setup_php(fd);
+ else if (!strcasecmp(dot, ".php")||
+ !strcasecmp(dot, ".php3")||
+ !strcasecmp(dot, ".php4"))
+ setup_php(fd);
else if (!strcasecmp(dot, ".c")||
!strcasecmp(dot, ".c++")||
!strcasecmp(dot, ".cp")||
rats-2.1-report.patch:
--- NEW FILE rats-2.1-report.patch ---
=== modified file 'report.c'
--- report.c 2007-10-09 18:57:42 +0000
+++ report.c 2007-10-09 19:09:08 +0000
@@ -51,7 +51,8 @@
#else
struct timeval time_started;
struct timeval time_finished;
-#endif
+#endif
+
/* This function EXPECTS a MALLOCED BUFFER to be passed into it, as it will
@@ -708,24 +709,30 @@
if (!(flags & INPUT_MODE))
return;
+ printf( "<ul>\n" );
+
for (ptr = input_head; ptr != (input_t *)NULL; ptr = next)
{
next = ptr->next;
if (!lookup_ignore(ptr->filename, ptr->lineno, ptr->data->Name))
{
count++;
- printf("<b>%s</b>: Line %d: function %s<br>\n", ptr->filename, ptr->lineno, ptr->data->Name);
+ printf("<li><b>%s</b>: Line %d: function %s</li>\n", ptr->filename, ptr->lineno, ptr->data->Name);
}
free(ptr);
}
input_head = input_tail = (input_t *)NULL;
+ printf( "</ul>\n" );
+
if (count > 0)
{
- printf("<br>Double check to be sure that all input accepted from an external data source\n");
+ printf("<p>Double check to be sure that all input accepted from an external data source\n");
+
printf("does not exceed the limits of the variable being used to hold it. Also make\n");
- printf("sure that the input cannot be used in such a manner as to alter your program's\n");
- printf("behaviour in an undesirable way.<br>\n");
+ printf("sure that the input cannot be used in such a manner as to alter your program's\n");
+
+ printf("behaviour in an undesirable way.</p>\n");
}
}
@@ -894,145 +901,171 @@
/* Output the severity */
- printf(" <b>Severity: %s</b><br/>\n",
- severities[ptr->severity]);
switch (ptr->type)
{
case BOProblem:
if (ptr->data->BOProblem->FormatArg > 0)
{
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: <tt>%s</tt></p>\n",
ptr->data->Name);
- printf(" Check to be sure that the format string passed as argument %d to this\n", ptr->data->BOProblem->FormatArg);
- printf(" function call does not come from an untrusted source that could have added\n");
- printf(" formatting characters that the code is not prepared to handle.\n");
- printf(" Additionally, the format string could contain `%%s' without precision that\n");
- printf(" could result in a buffer overflow.\n");
- printf(" <br/>\n");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+
+ printf("<p>Check to be sure that the format string passed as argument %d to this\n", ptr->data->BOProblem->FormatArg);
+ printf("function call does not come from an untrusted source that could have added\n");
+ printf("formatting characters that the code is not prepared to handle.\n");
+ printf("Additionally, the format string could contain `%%s' without precision that\n");
+ printf("could result in a buffer overflow.\n");
+ printf("</p>\n");
}
if (ptr->data->BOProblem->SrcBufArg > 0)
{
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: <tt>%s</tt></p>\n",
ptr->data->Name);
- printf(" Check to be sure that argument %d passed to this function call will not\n", ptr->data->BOProblem->SrcBufArg);
- printf(" copy more data than can be handled, resulting in a buffer overflow.\n");
- printf(" <br/>\n");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+ printf("<p>Check to be sure that argument %d passed to this function call will not\n", ptr->data->BOProblem->SrcBufArg);
+ printf("copy more data than can be handled, resulting in a buffer overflow.\n");
+ printf("</p>\n");
}
break;
case FSProblem:
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: <tt>%s</tt></p>\n",
ptr->data->Name);
- printf(" Check to be sure that the non-constant format string passed as argument %d \n", ptr->data->FSProblem->Arg);
- printf(" to this function call does not come from an untrusted source that could\n");
- printf(" have added formatting characters that the code is not prepared to handle.\n");
- printf(" <br/>\n");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+ printf("<p>Check to be sure that the non-constant format string passed as argument %d \n", ptr->data->FSProblem->Arg);
+ printf("to this function call does not come from an untrusted source that could\n");
+ printf("have added formatting characters that the code is not prepared to handle.\n");
+ printf("</p>\n");
break;
case InputProblem:
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: <tt>%s</tt></p>\n",
ptr->data->Name);
- printf(" Argument %d to this function call should be checked to ensure that it does\n", ptr->data->InputProblem->Arg);
- printf(" not come from an untrusted source without first verifying that it contains\n");
- printf(" nothing dangerous.\n");
- printf(" <br/>\n");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+
+ printf("<p>Argument %d to this function call should be checked to ensure that it does\n", ptr->data->InputProblem->Arg);
+ printf("not come from an untrusted source without first verifying that it contains\n");
+ printf("nothing dangerous.\n");
+ printf("</p>\n");
break;
case Info:
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: <tt>%s</tt></p>\n",
ptr->data->Name);
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+
if (ptr->data->Info->Description != (char *)NULL) {
cleanup_string(ptr->data->Info->Description);
- printf(" %s\n", ptr->data->Info->Description);
+ printf("<p>%s</p>\n", ptr->data->Info->Description);
}
if (ptr->data->Info->URL != (char *)NULL) {
cleanup_string(ptr->data->Info->URL);
/* This should possibly be made into it's own tag -- Robert */
- printf(" See also:\n %s\n", ptr->data->Info->URL);
+ printf("<p> See also:\n %s</p>\n", ptr->data->Info->URL);
}
- printf(" <br/>\n");
break;
case RaceConditionCheck:
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: %s</p>\n",
ptr->data->Name);
- printf(" A potential TOCTOU (Time Of Check, Time Of Use) vulnerability exists.\n");
- printf(" This is the first line where a check has occured.");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+
+ printf("<p>A potential TOCTOU (Time Of Check, Time Of Use) vulnerability exists.\n");
+ printf("This is the first line where a check has occured.</p>");
if (ptr->uses != (toctou_use_t *)NULL && ptr->uses[0].lineno != 0)
{
- printf("\n The following line(s) contain uses that may match up with this check:\n");
+ printf("<p>The following line(s) contain uses that may match up with this check:\n");
for (i = 0; ptr->uses[i].lineno != 0; i++)
printf(" %s%d (%s)", (i == 0 ? "" : ", "), ptr->uses[i].lineno, ptr->uses[i].name);
- printf("\n");
+ printf("</p>\n");
}
else
{
- printf(" No matching uses were detected.\n");
+ printf("<p>No matching uses were detected.</p>\n");
}
- printf(" <br/>\n");
break;
case RaceConditionUse:
- printf(" Issue: fixed size local buffer<br/>\n");
- printf(" A potential race condition vulnerability exists here. Normally a call\n");
- printf(" to this function is vulnerable only when a match check precedes it. No\n");
- printf(" check was detected, however one could still exist that could not be\n");
- printf(" detected.\n");
- printf(" <br/>\n");
+ printf("<p>Issue: fixed size local buffer</p>\n");
+ printf("<p>A potential race condition vulnerability exists here. Normally a call\n");
+ printf("to this function is vulnerable only when a match check precedes it. No\n");
+ printf("check was detected, however one could still exist that could not be\n");
+ printf("detected.</p>\n");
break;
case StaticLocalBuffer:
- printf(" Issue: fixed size global buffer<br/>\n");
- printf(" Extra care should be taken to ensure that character arrays that are\n");
- printf(" allocated on the stack are used safely. They are prime targets for\n");
- printf(" buffer overflow attacks.\n");
- printf(" <br/>\n");
+ printf("<p>Issue: fixed size global buffer</p>\n");
+ printf("<p>Extra care should be taken to ensure that character arrays that are\n");
+ printf("allocated on the stack are used safely. They are prime targets for\n");
+ printf("buffer overflow attacks.</p>\n");
break;
case StaticGlobalBuffer:
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: %s</p>\n",
ptr->data->Name);
- printf(" Extra care should be taken to ensure that character arrays that are\n");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+
+ printf("<p>Extra care should be taken to ensure that character arrays that are\n");
printf(" allocated with a static size are used safely. This appears to be a\n");
printf(" global allocation and is less dangerous than a similar one on the stack.\n");
printf(" Extra caution is still advised, however.\n");
- printf(" <br/>\n");
+ printf(" </p>\n");
break;
case Reference:
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: %s</p>\n",
ptr->data->Name);
- printf(" A function call is not being made here, but a reference is being made to\n");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+
+ printf("<p>A function call is not being made here, but a reference is being made to\n");
printf(" a name that is normally a vulnerable function. It could be being\n");
printf(" assigned as a pointer to function.\n\n");
- printf(" <br/>\n");
+ printf(" </p>\n");
break;
case PythonBacktick:
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: %s</p>\n",
ptr->data->Name);
- printf(" Do not use a variable that has been derived from untrusted sources\n");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+
+ printf("<p>Do not use a variable that has been derived from untrusted sources\n");
printf(" within a backtick. Doing so could allow an attacker to execute\n");
printf(" arbitrary python code.\n");
- printf(" <br/>\n");
+ printf(" </p>\n");
break;
case PhpBacktick:
case PerlBacktick:
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: %s</p>\n",
ptr->data->Name);
- printf(" The backtick will act just like an call to exec(), so care should be\n");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+
+
+ printf("<p>The backtick will act just like an call to exec(), so care should be\n");
printf(" exercised that the string being backtick evaluated does not come from an\n");
printf(" untrusted source.\n");
- printf(" <br/>\n");
+ printf(" </p>\n");
break;
case None:
- printf(" Issue: %s<br/>\n",
+ printf("<p>Issue: %s</p>\n",
ptr->data->Name);
- printf(" Unknown!?!?\n\n");
- printf(" <br/>\n");
+ printf("<p>Severity: <b>%s</b></p>\n",
+ severities[ptr->severity]);
+
+
+ printf("<p> Unknown!?!?</p>\n\n");
break;
}
}
@@ -1042,7 +1075,7 @@
vulnerability_t * ptr;
/* Initial necessary cruft */
- printf("<h2>RATS results.\n</h2><br>\n");
+ printf("<h2>RATS results.\n</h2>\n");
/* Loop iterates through all of the problems found */
for (ptr = list_head; ptr != (vulnerability_t *)NULL; ptr = ptr->next) {
@@ -1071,7 +1104,7 @@
printf("<ul>\n");
if (!(flags & SHOW_CONTEXT))
{
- printf("File: <b>%s</b><br/>Lines: \n",
+ printf("<li>File: <b>%s</b><br/>Lines: \n",
ptr->filename);
}
}
@@ -1089,15 +1122,15 @@
printf("File: <b>%s</b> Line:<b>%d", ptr->filename, ptr->lineno);
if (flags & SHOW_COLUMNS)
printf("[%d]", ptr->column);
- printf("</b><br>\n");
+ printf("</b>\n");
ctx = getctx(ptr->filename, ptr->lineno);
if(ctx)
{
- printf("%s<br>\n", ctx);
+ ctx = xml_escape(ctx);
+ printf("%s\n", ctx);
free(ctx);
}
}
-
@@ -1105,7 +1138,7 @@
if(ptr->next==(vulnerability_t *)NULL||
strcmp(ptr->filename,ptr->next->filename)|| ptr->type == RaceConditionCheck ||
ptr->next->type != ptr->type || ptr->next->data != ptr->data) {
- printf(" </ul>\n");
+ printf("</li>\n </ul>\n");
}
/* If the next vuln is different reset the vuln_reported variable to 0 so
@@ -1120,11 +1153,7 @@
printf("<h3>Inputs detected at the following points</h3>\n");
- printf("<ul>\n");
html_report_inputs();
- printf("</ul>\n");
-
- printf("<br><br>\n");
if (!(flags & NO_FOOTER))
@@ -1146,9 +1175,9 @@
#endif
- printf("Total lines analyzed: <b>%d</b><br>\n", total_lines);
- printf("Total time <b>%f</b> seconds<br>\n", fsecs);
- printf("<b>%d</b> lines per second<br>\n", (int)(total_lines/fsecs));
+ printf("<p>Total lines analyzed: <b>%d</b></p>\n", total_lines);
+ printf("<p>Total time <b>%f</b> seconds</p>\n", fsecs);
+ printf("<p><b>%d</b> lines per second</p>\n", (int)(total_lines/fsecs));
}
printf("</body></html>\n");
--- NEW FILE rats.spec ---
Name: rats
Version: 2.1
Release: 5%{?dist}
Summary: Rough Auditing Tool for Security
Group: Development/Tools
License: GPLv2
URL: http://www.fortifysoftware.com/security-resources/rats.jsp
Source0: http://www.fortifysoftware.com/servlet/downloads/public/rats-%{version}.tar.gz
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
Patch1: rats-2.1-build-clean.patch
Patch2: rats-2.1-php.patch
Patch3: rats-2.1-report.patch
Patch4: rats-2.1-lex.patch
Patch5: rats-2.1-gtk-vuln.patch
BuildRequires: expat-devel, flex
Requires: expat
%description
RATS scans through code, finding potentially dangerous function calls.
The goal of this tool is not to definitively find bugs (yet). The
current goal is to provide a reasonable starting point for performing
manual security audits.
The initial vulnerability database is taken directly from things that
could be easily found when starting with the forthcoming book,
"Building Secure Software" by Viega and McGraw.
%prep
%setup -q
%patch1
%patch2
%patch3
%patch4
%patch5
%build
%configure
make %{?_smp_mflags} lex
make %{?_smp_mflags}
%install
rm -rf $RPM_BUILD_ROOT
#make install doesn't accept DESTDIR or other ways of not installing to PREFIX.
# So, we do the install ourselves due to so few files to install.
mkdir -p $RPM_BUILD_ROOT/{%{_datadir}/rats,%{_bindir},%{_mandir}/man1}
install -c rats $RPM_BUILD_ROOT/%{_bindir}
install -c -m644 *.xml $RPM_BUILD_ROOT/%{_datadir}/rats
install -c -m644 *.1 $RPM_BUILD_ROOT/%{_mandir}/man1
%clean
rm -rf $RPM_BUILD_ROOT
%files
%defattr(644,root,root,755)
%dir %{_datadir}/rats
%doc README README.win32
%attr(755,root,root) %{_bindir}/*
%{_datadir}/rats/*
%{_mandir}/man1/*
%changelog
* Tue Oct 9 2007 Scott Henson <shenson at redhat.com> - 2.1-5
- Change the Makefile.in so we can use the configure macro
- Rename all patches to .patch to be more standard
* Tue Oct 9 2007 Scott Henson <shenson at redhat.com> - 2.1-4
- Do configure ourselves because datadir gets set wrong otherwise.
* Tue Oct 9 2007 Scott Henson <shenson at redhat.com> - 2.1-3
- Break the monolithic patch into pieces
- Build Clean, contains build cleanups and spelling corrections
- Php, adds support for php3 and php4 files
- Report, adds some html output cleanup
- Lex, some lex bug fixes
- GTK-Vuln, adds some gtk vulnerabilities
- Also generate lex output files on each build.
* Mon Oct 8 2007 Scott Henson <shenson at redhat.com> - 2.1-2
- Move configure to the build stage and simplify it to just use the configure macro
- Comment as to why we don't use make install
- Remove the GPL comment from the Description
- Update upstream to Fortify Software
- Other misc cleanups.
* Wed Sep 26 2007 Scott Henson <shenson at redhat.com> - 2.1-1
- Initial packaged version
Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/rats/devel/.cvsignore,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- .cvsignore 12 Oct 2007 17:43:52 -0000 1.1
+++ .cvsignore 15 Oct 2007 03:21:14 -0000 1.2
@@ -0,0 +1 @@
+rats-2.1.tar.gz
Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/rats/devel/sources,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- sources 12 Oct 2007 17:43:52 -0000 1.1
+++ sources 15 Oct 2007 03:21:15 -0000 1.2
@@ -0,0 +1 @@
+adf31806f1eff0c353abcfd57653ecb3 rats-2.1.tar.gz
- Previous message (by thread): rpms/gcin/F-7 gcin.spec, 1.23, 1.24 im-client.patch, 1.8, 1.9 newcj3.patch, 1.1, 1.2
- Next message (by thread): devel/ppc64-utils bootinfo.txt, NONE, 1.1 ofboot.b, NONE, 1.1 ppc64-utils.spec, 1.28, 1.29
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list