itiviti-cpp-analyzer is a Clang plugin that performs static analysis checks to identify potential issues in C++ code.
Clang plugin with several static analysis checks
This tool is used by C++ developers and security engineers to integrate static code analysis into their build process, helping to detect vulnerabilities and code quality issues early. It is particularly useful in DevSecOps pipelines to automate security checks and enforce coding standards within CMake-based projects.
Currently, ICA only supports clang-10 and requires specific libclang development packages. Boost headers are optionally needed and can be downloaded during build. Users should carefully configure checks and emit levels to balance noise and coverage. Integration with CMake projects is streamlined but requires adding ICA either as an external project or subdirectory. Suppressing warnings and disabling URL integration are supported for customization.
Ensure Clang 10 and CMake are installed
Install libclang-10-dev and libclang-cpp10-dev packages
Optionally have Boost 1.68+ headers or enable downloading during build
Create and enter a build directory: mkdir build && cd build
Run cmake with parameters: cmake -DGCC_TOOLCHAIN=<path> -DBOOST_FROM_INTERNET=ON -DTARGET_COMPILER=clang++-10 ../
Build the plugin with: cmake --build . --parallel
The plugin will be available as ./build/libica-plugin.so[ -load path/to/libica-plugin.so ] -add-plugin ica-plugin -plugin-arg-ica-plugin checks=$CHECKS
Load the ICA plugin into clang-10 and specify which checks to run using a comma-separated list.
-Xclang -load -Xclang ../build/libica-plugin.so -Xclang -add-plugin -Xclang ica-plugin -Xclang -plugin-arg-ica-plugin -Xclang checks=$CHECKS
Example of passing plugin load and arguments to clang frontend using -Xclang flags.
add_ica_checks(check1 check2 ...)
CMake helper function to load the ICA plugin and enable specified static analysis checks.
ica_no_url()
CMake helper to disable URL integration in check messages.
target_ica_checks(MyTarget VISIBILITY ...)
Apply ICA checks configuration to a specific CMake target and its dependencies.
target_ica_no_url(MyTarget VISIBILITY)
Disable URL integration for ICA messages on a specific CMake target.
cmake --install . --install-prefix /path/to/ica/installation/
Install the built ICA plugin to a specified directory for use as an external project.