Using a Model Set to Execute Code Check

Scenarios

As the project code scale increases and development frameworks diversify, static analysis models are particularly important. They provide accurate checks for specific logic or framework requirements in service code (for example, the custom memory allocator my_malloc must be used with my_free, and the user input get_user_input() must be marked as an untrusted source). They bridge the gap where generic rules fall short.

Constraints

Model sets are a restricted feature and can only be used after you purchase the CodeCheck enhanced package. When a model set is enabled for a task, the task will consume concurrent resources of the enhanced package.

Preparations

Prepare the Model1.json file locally with the following content:

{
  "RulePackage": {
    "Language": "C++"
  },
  "Rules": {
    "TaintSourceRule": [
      {
        "Function":{
          "Function":{
            "Value":"get_user_input"
          }
        },
        "Source":{
          "OutArgs":"return",
          "TaintFlags":"UntrustedSource"
        }
      }
    ],
    "TaintSinkRule": [
      {
        "Function":{
          "Function":{
            "Value":"executeCmd"
          }
        },
        "Sink":{
          "InArgs":"0",
          "TaintFlags":"UntrustedSink"
        }
      }
    ]
  }
}

Process

Creating a Project

1. Log in to the Huawei Cloud console.
2. Click in the upper-left corner and choose Developer Services > CodeArts from the service list.
3. Click Access Service.
4. Click Create > Create Project, and select the Scrum template. Set the project name to Scrum01 and retain the default values for other parameters.
5. Click OK to access the project.

Creating a Code Repository in CodeArts Repo

1. In the navigation pane, choose Code > Repo.
2. On the CodeArts Repo homepage, click Create Repository.
3. On the displayed page, select Template.
4. Click Next and select the Cpp Demo template.
5. Click Next. Set the repository name to Repo01 and deselect Automatically create check task. Retain default settings for other parameters.
6. Click OK.
7. In the root directory, click the helloworld.cpp file name and click in the upper right corner of the code box. The modified code information is as follows. Then, click OK.

   #include <iostream>
   char *get_user_input();
   void executeCmd(const std::string &command);
   int test01()
   {
       char *input = get_user_input();
       std::string cmd(input);
       executeCmd(cmd);
       return 0;
   }

Creating a Custom Rule Set

1. In the navigation pane, choose Code > Check.
2. On the task list, click the Rule Sets tab.
3. Click Create Rule Set. In the displayed window, set Rule Set to RuleList and Language to C/C++.
4. Click OK. The Configure Rule Sets page is displayed.
5. Select the rule Untrusted input may cause injection issues such as command injection, formatting injection, and SQL injection.
6. Click Save in the upper right corner. The custom rule set is created.

Creating a Model Set and Model

1. On the task list, click the Model Sets tab.
2. Click Create Model Set. In the displayed dialog box, set Model Set to ModelList.
3. Click OK. The model set configuration page is displayed.
4. Click Create Model.
5. Click Upload a model file, select the file created in Preparations, and click OK.
6. Choose Status > Not Enabled, select the created model, and click Save. In the displayed dialog box, click OK.
   Figure 1 Selecting a model
   

Creating a Code Check Task

1. On the task list page, click Create Task and set parameters by referring to the following table.

   Table 2 Code check task parameters

   Parameter	Description
   Project	Enter the project Scrum01 created in Creating a Project. Retain the default setting.
   Code Source	Source of code. Select Repo.
   Name	Enter a task name, for example, CheckTask01.
   Repository	Select the Repo01 code repository created in Creating a Code Repository in CodeArts Repo.
   Branch	Retain the default value master.
   Language	Select C/C++.

2. Click Confirm.

Using a Rule Set and Model Set to Execute Code Check

1. On the task overview page, click Settings.
2. Click Rule Sets. In the right pane, click to select the RuleList rule set created in Creating a Custom Rule Set.
3. Click Configuration, set Compiler Tools Options to , and set Build Tool to cmake. Retain the default values for other parameters and click Confirm.
   Figure 2 Configuration
   

4. Click Model Sets. In the right pane, click and select the model set ModelList created in Creating a Model Set and Model. Then, set the switch to .
5. Click Execute Check in the upper right corner.

Viewing Check Results

1. On the Tasks page, search for the CheckTask01 task created in Creating a Code Check Task.
2. Click the task name and click Logs. If the following information is found in the log, the code check task uses the rules in the uploaded model file.
   Figure 3 Check result
   

3. On the Issues tab, view the code issues of the model.
   Figure 4 Code issues