Available Coverity Analyze Options

Coverity Analyze options available on Coverity on Polaris

Description

The analyze section of the config file (polaris.yml) can be used to pass additional options to Coverity analysis commands. See cov-analyze for more information.

Syntax

Here's an example to show the syntax for using Coverity options in the polaris.yml configuration file:

analyze:
   coverity:
      cov-analyze: ["--enable", "FORWARD_NULL", "--enable-fb",
                       "--fb-include", "high-priority",
                       "--allow-jsp-include-param-blacklist",
                       "--webapp-security" ]

You can also use the --co command to override your config file from the command line. See Overriding the Configuration File from the Coverity on Polaris CLI for more information.

Commands

The table below contains all the Coverity options that that can be used on Coverity on Polaris.

Table 1. **Commands**
Option	Syntax	Description
Option	Syntax	Description
`--add-password-regex`	`--add-password-regex <regular_expression>`	[Web and mobile application security option] Treats field and method parameter names that match the specified regular expression as a password source.
`--aggressiveness-level`	`--aggressiveness-level <level>`	Higher levels report more defects, and the analysis time increases. Values for level are `low`, `medium`, or `high`. Default is `low`.
`--all`	`--all`	Enables almost all checkers that are disabled by default .
`--allow-jsp-include-param-blacklist`	`--allow-jsp-include-param-blacklist`	[Java web application security option] Treats any servlet request parameters that are set through a tag as untainted.
`--analyze-node-modules`	`--analyze-node-modules`	By default, cov-analyze does not analyze code in the node_modules/ directories for JavaScript or TypeScript projects. This option enables analysis of the translation units in the node_modules/ directories. Even when you use the `--tu` or the `--tu-pattern` option, you must specify `--analyze-nodemodules` in order to analyze translation units in `node_modules/` directories.
`--android-security`	`--android-security`	Enables the checkers used for Android application security analyses.
`--brakeman-aggressiveness-level`	`--brakeman-aggressiveness-level <low\|medium\|high>`	Tunes the aggressiveness of Brakeman Pro to only report defects that are above a certain confidence level. A higher setting reports more defects and increases the likelihood that any given defect is a false positive. Accepted values for this option are `low`, `medium`, or `high`. Default is `high`.
`--checker-option`	`--checker-option <checker_name>:<option> [:<option_value>]`	Passes the specified checker option to cov-analyze when invoking cov-analyze after the library has been built.
`--concurrency`	`--concurrency`	[C/C++ analysis option] Enables C/C++ concurrency checkers that are disabled by default.
`--disable`	`--disable <CHECKER_NAME>`	Can disable any checker.
`--disable-android-security`	`--disable-android-security`	Disables the Android application security checkers. Note that these checkers are disabled by default.
`--disable-brakeman`	`--disable-brakeman`	Disables Brakeman Pro checkers.
`--disable-default`	`--disable-default`	Disables default checkers. This option is useful if you want to disable all default checkers and then enable only a few with the --enable option.
`--disable-fb`	`--disable-fb`	[SpotBugs analysis option for Java] Disables SpotBugs analysis.
`--disable-fnptr`	`--disable-fnptr`	[C/C++ analysis option] Disables analysis of calls to function pointers for defects.
`--disable-jshint`	`--disable-jshint`	[JavaScript option] Disables JSHint analyses. The JSHint analysis is disabled by default.
`--disable-sigma`	`--disable-sigma`	Allows you to disable Rapid Scan Static (the Sigma analysis engine), if you want to turn it off in order to decrease the number of low-severity issues.
`--disable-webapp-security`	`--disable-webapp-security`	[Web application security option] This option has been deprecated. Disables the Web application security checkers. Note that these checkers are disabled by default.
`--distrust-all`	`--distrust-all`	[Security option] This option is equivalent to setting all the `--distrust-*` options. It applies to all the checkers in the group Security (Tainted dataflow checker).
`--distrust-command-line`	`--distrust-command-line`	[Web application security option] Treats command line arguments as though they are tainted. Such data is otherwise trusted by default.
`--distrust-console`	`--distrust-console`	[Web application security option] Treats data obtained from a console (for example, reading from System.in) as though it is tainted. Such data is otherwise trusted by default.
`--distrust-cookie`	`--distrust-cookie`	[Web application security option] Specifies the default behavior of the analysis, which is to distrust data from HTTP cookies and treat it as though it is tainted. This option applies to all the checkers of type Security (Tainted dataflow checker).
`--distrust-database`	`--distrust-database`	Treats data obtained from a database (for example, SQL query results and Hibernate objects) as though it is tainted. Such data is otherwise trusted by default. This option applies to all the checkers in the group Security (Tainted dataflow checker).
`--distrust-environment`	`--distrust-environment`	[Web application security option] Treats data that the checker identifies as environment variables as though it is tainted. Such data is otherwise trusted by default. This option applies to all the checkers in the group Security (Tainted data checker).
`--distrust-filesystem`	`--distrust-filesystem`	[Web application security option] Treats data obtained from a file system as though it is tainted. Such data is otherwise trusted by default. This option applies to all the checkers of type Security (Tainted dataflow checker).
`--distrust-http`	`--distrust-http`	[Web application security option] Specifies the default behavior of the analysis, which is to treat web input (for example, GET and POST parameters) as though tainted. This option applies to all the checkers of type Security (Tainted dataflow checker). For details, see the Coverity Checker Reference. Note that the checker-level version of this option (not available to all checkers in this group) overrides the command-level version. This option cannot be used with --trust-http.
`--distrust-http-header`	`--distrust-http-header`	[Web application security option] Specifies the default behavior of the analysis, which is to distrust data from HTTP headers as though it is tainted. This option applies to all the checkers of type Security (Tainted dataflow checker).
`--distrust-js-client-cookie`	`--distrust-js-client-cookie`	Treats data from document.cookie as though it is tainted. The default is to trust this data.
`--distrust-js-client-external`	`--distrust-js-client-external`	Treats response data from the response to XMLHttpRequest and similar requests as though it is tainted. This is the default behavior for this option.
`--distrust-js-client-html-element`	`--distrust-js-client-html-element`	Treats data from user input on HTML elements such as textarea and input elements as though it is tainted. The default is to trust this data.
`--distrust-js-client-http-header`	`--distrust-js-client-http-header`	Treats data as tainted when it is from the HTTP response header of the response to XMLHttpRequest or to a similar request. This data is trusted by default.
`--distrust-js-client-http-referer`	`--distrust-js-client-http-referer`	Treats data from the referer HTTP header (from document.referrer) as though it is tainted. This is the default behavior.
`--distrust-js-client-other-origin`	`--distrust-js-client-other-origin`	Treats data as tainted when it is from content in another frame or from another origin, for example, from window.name. This is the default behavior
`--distrust-js-client-url-query-or-fragment`	`--distrust-js-client-url-query-or-fragment`	Treats data as tainted when it is from the query or fragment part of the URL, for example, location.hash or location.query. This is the default behavior.
`--distrust-mobile-other-app`	`--distrust-mobile-other-app`	[Mobile application security option] Specifies the default behavior of the analysis, which is to treat data as tainted when it is received from any mobile application that does not require a permission to communicate with the current application component.
`--distrust-mobile-other-privileged-app`	`--distrust-mobile-other-privileged-app`	[Mobile application security option] Treats data as though it is tainted when it is received from any mobile application that requires a permission to communicate with the current application component. Such data is otherwise trusted by default.
`--distrust-mobile-same-app`	`--distrust-mobile-same-app`	[Mobile application security option] Treats data received from the same mobile application as though it is tainted. Such data is otherwise trusted by default.
`--distrust-mobile-user-input`	`--distrust-mobile-user-input`	[Mobile application security option] Specifies the default behavior of the analysis, which is to treat data obtained from user input as though it is tainted.
`--distrust-network`	`--distrust-network`	[Web application security option] Specifies the default behavior of the analysis, which is to treat data obtained from a network connection (for example, a TCP socket or HTTP connection) as though it is tainted. This option applies to all the checkers of type Security (Tainted dataflow checker).
`--distrust-rpc`	`--distrust-rpc`	[Web application security option] Specifies the default behavior of the analysis, which is to distrust data obtained from a Remote Procedure Call (RPC) as though tainted. This option applies to all the checkers in the group Security (Tainted data checker).
`--distrust-system-properties`	`--distrust-system-properties`	[Web application security option] Treats system properties (those obtained from System.getProperty()) as though tainted. Such properties are otherwise trusted by default. This option applies to all the checkers in the group Security (Tainted dataflow checker).
`--enable`	`--enable <checker_name>`	Enables a checker that is not otherwise enabled by default. The checker name is case insensitive. This option will enable a checker for all languages supported by the checker. Note that default enablement of a given checker can vary by language.
`--enable-audit-mode`	`--enable-audit-mode`	Enables audit-mode analysis, which is intended to expose more potential security vulnerabilities by considering additional potential data sources that could be used in an exploit.
`--enable-brakeman`	`--enable-brakeman`	Enables Brakeman Pro checkers (default).
`--enable-constraint-fpp`	`--enable-constraint-fpp`	Enables additional filtering of potential defects by using an additional false-path pruner (FPP).
`--enable-default`	`--enable-default`	Enables all default checkers.
`--enable-exceptions`	`--enable-exceptions`	Enables exceptional control flow analysis for C++.
`--enable-fb`	`--enable-fb`	[SpotBugs analysis option for Java] Enables SpotBugs (version 2.0.1) analysis (requires a Coverity license).
`--enable-fnptr`	`--enable-fnptr`	[C/C++ analysis option] Enables analysis of calls to function pointers for defects.
`--enable-jshint`	`--enable-jshint`	[JavaScript option] Enables the JSHint analysis of captured JavaScript source code except for minified source files
`--enable-parse-warnings`	`--enable-parse-warnings`	[C/C++/Swift analysis option] Enables parse warnings, recovery warnings, and semantic warnings that are produced by the cov-build command so that they appear as defects in Coverity Connect.
`--enable-sigma`	`--enable-sigma`	Allows you to enable Rapid Scan Static (the Sigma analysis engine). This is enabled by default.
`--enable-single-virtual`	`--enable-single-virtual`	Enables single, virtual-call resolution.
`--enable-virtual`	`--enable-virtual`	Enables full, virtual-call resolution.
`--export-summaries`	`--export-summaries <true\|false>`	Analysis summaries will be captured and committed by default, unless the `cov-analyze --export-summaries` option is explicitly set to `false`.
`--fb-dont-exclude-overlap`	`--fb-dont-exclude-overlap`	[SpotBugs analysis option for Java. Not recommended for production use] Disables the default exclusion of certain SpotBugs checkers.
`--fb-exclude`	`--fb-exclude concurrency \| <filter_file_name>`	[SpotBugs analysis option for Java] Specifies a set of SpotBugs bug patterns to exclude when you run an analysis.
`--fb-include`	`--fb-include (high-priority \| medium-priority \| low-priority \| <filter_file_name>)`	[SpotBugs analysis option for Java] Specifies a set of SpotBugs bug patterns to run on your code. You can use this option to find defects based on SpotBugs priority categories, or you can use a filter file for this purpose.
`--field-offset-escape`	`--field-offset-escape`	[C++ analysis option] A pointer escapes the analysis if it is written to memory, passed to free(), or passed to a function definition that is inaccessible to cov-analyze. Once the pointer escapes the analysis, the storage to which it points will never be treated as a leak or uninitialized.
`--handle-badalloc`	`--handle-badalloc`	[C/C++ analysis option] Causes the analysis as a whole to handle exceptions of type std::bad_alloc, both for exceptional control flow and for UNCAUGHT_EXCEPT. By default, such exceptions are otherwise ignored even when you use --enable-exceptions.
`--hfa`	`--hfa`	[C-only analysis option] Reports unnecessary header file includes.
`--inherit-taint-from-unions`	`--inherit-taint-from-unions`	Enable taint to flow downwards from a C/C++ union to its component fields. This is required to check code that writes to a union using memcpy(&u, &tainted, n) and later reads using u.field.
`--no-field-offset-escape`	`--no-field-offset-escape`	[C/C++ analysis option] Disables a heuristic that can cause RESOURCE_LEAK and UNINIT to produce false negatives when tracking aliases of pointers.
`--no-java`	`--no-java`	Disables Java analysis. By default, the cov-analyze command otherwise analyzes any Java code it finds in the intermediate directory.
`--not-tainted-field`	`--not-tainted-field <fully_qualified_field_name>`	[Web application security option] The value is a Perl regular expression describing a fully qualified field name. Any matching fields will be asserted to be untainted. Additional defects may be reported by the TAINT_ASSERT checker, but reported issues involving unsafe uses of the value will be suppressed in the Web application security checkers.
`--replace-password-regex`	`--replace-password-regex <regular_expression>`	[Web application security option] Replaces the default regular expression that the checker uses to infer passwords. You can specify this option only once. Note that if you use the `--add-passwordregex` and `--replace-password-regex`, the default regular expression will be replaced, then extended.
`--report-in-minified-js`	`--report-in-minified-js`	[JavaScript application option] Enables the JavaScript checkers for minified source files.
`--report-null-field-address`	`--report-null-field-address`	When you specify this option, the analysis considers "&p->field" as dereferencing "p".
`--rule`	`--rule`	[C/C++ analysis option] Enables rule checkers.
`--security`	`--security`	[C/C++ and Objective-C/C++ analysis option] Enables C/C++ and Objective-C/C++ security-related checkers.
`--suppress-vulnerabilities-in-dead-code`	`--suppress-vulnerabilities-in-dead-code`	Java only. Suppresses security defects from tainted dataflow checkers when they require the execution of dead code.
`--trust-all`	`--trust-all`	[Security option] This option is equivalent to providing all the `--trust-*` options. This option applies to all the checkers in the group Security (Tainted data checker).
`--trust-command-line`	`--trust-command-line`	[Web application security option] Specifies the default behavior of the analysis, which is to treat command line arguments as though not tainted.
`--trust-console`	`--trust-console`	[Web application security option] Specifies the default behavior of the analysis, which is to treat data obtained from a console (for example, reading from System.in) as though not tainted. This option applies to all the checkers in the group Security (Tainted data checker).
`--trust-cookie`	`--trust-cookie`	[Web application security option] Treats data that is obtained from an HTTP cookie as though not tainted. Such data is otherwise distrusted by default. This option applies to all the checkers in the group Security (Tainted dataflow checker).
`--trust-database`	`--trust-database`	[Web application security option] Specifies the default behavior of the analysis, which is to treat data obtained from a database (for example, SQL query results and Hibernate objects) as though it is not tainted. This option applies to all the checkers in the group Security (Tainted dataflow checker).
`--trust-environment`	`--trust-environment`	[Web application security option] Specifies the default behavior of the analysis, which is to treat data from environment variables as though it is not tainted. This option applies to all the checkers in the group Security (Tainted data checker).
`--trust-filesystem`	`--trust-filesystem`	[Web application security option] Specifies the default behavior of the analysis, which is to treat data obtained from a file system as though it is not tainted. This option applies to all the checkers in the group Security (Tainted data checker).
`--trust-http`	`--trust-http`	[Web application security option] Treats Web input (for example, GET and POST parameters) as though it is not tainted. Web input is otherwise treated as tainted by default. This option applies to all the checkers in the group Security (Tainted dataflow checker).
`--trust-http-header`	`--trust-http-header`	[Web application security option] Treats data that is obtained from an HTTP header as though it is not tainted. Such data is otherwise distrusted by default. This option applies to all the checkers in the group Security (Tainted dataflow checker).
`--trust-js-client-cookie`	`--trust-js-client-cookie`	Trusts data from document.cookie.
`--trust-js-client-external`	`--trust-js-client-external`	Trusts response data from the response to XMLHttpRequest and similar requests. The default is to distrust this data.
`--trust-js-client-html-element`	`--trust-js-client-html-element`	Trusts data from user input on HTML elements such as textarea and input elements. This is the default behavior.
`--trust-js-client-http-header`	`--trust-js-client-http-header`	Trusts data from the HTTP response header of the response to XMLHttpRequest and similar requests. This is the default behavior. See also, --trust-js-client-external.
`--trust-js-client-http-referer`	`--trust-js-client-http-referer`	Trusts data from the referer HTTP header (from document.referrer). The default is to distrust this data.
`--trust-js-client-other-origin`	`--trust-js-client-other-origin`	Trusts data from content in another frame or from another origin, for example, from window.name. The default is to distrust this data.
`--trust-js-client-url-query-or-fragment`	`--trust-js-client-url-query-or-fragment`	Trusts data from the query or fragment part of the URL, for example, location.hash or location.query. The default is to distrust this data.
`--trust-mobile-other-app`	`--trust-mobile-other-app`	[Mobile application security option] Trusts data received from any mobile application when it does not require a permission to communicate with the current application component. Such data is otherwise distrusted by default.
`--trust-mobile-other-privileged-app`	`--trust-mobile-other-privileged-app`	[Mobile application security option] Specifies the default behavior of the analysis, which is to trust data received from any mobile application that requires a permission to communicate with the current application component.
`--trust-mobile-same-app`	`--trust-mobile-same-app`	[Mobile application security option] Specifies the default behavior of the analysis, which is to trust data received from the same mobile application.
`--trust-mobile-user-input`	`--trust-mobile-user-input`	[Mobile application security option] The analysis treats data obtained from user input as though it is not tainted. Such data is otherwise distrusted by default.
`--trust-network`	`--trust-network`	[Web application security option] Treats data obtained from a network connection (for example, a TCP socket or HTTP connection) as though it is not tainted. Such data is otherwise distrusted by default. This option applies to all the checkers in the group Security (Tainted dataflow checker).
`--trust-rpc`	`--trust-rpc`	[Web application security option] Treats data obtained from a Remote Procedure Call (RPC) as though it is not tainted. Such data is otherwise distrusted by default. This option applies to all the checkers in the group Security (Tainted data checker).
`--trust-system-properties`	`--trust-system-properties`	[Web application security option] Specifies the default behavior of the analysis, which is to treat data obtained from system properties (for example, `System.getProperty()`) as though it is not tainted. This option applies to all the checkers in the group Security (Tainted data checker).
`--webapp-security`	`--webapp-security`	[Web application security option] Enables the checkers that are used for Web application security analyses.
`--webapp-security-aggressiveness-level`	`--webapp-security-aggressiveness-level <low-medium-high>`	[Web application security option] Tunes the aggressiveness of assumptions that the analysis makes to find potential security vulnerabilities (security defects). Higher levels report more defects, but the analysis time increases and memory usage is likely to increase. Higher levels also increase the likelihood that any given defect is a false positive. Values for level are `low`, `medium`, or `high`. Default is `low`.