Skip to content

feat: initial C++ support using standalone ANTLR scanner#397

Open
Ndugu2 wants to merge 2 commits into
cbomkit:mainfrom
Ndugu2:feat-cxx-support
Open

feat: initial C++ support using standalone ANTLR scanner#397
Ndugu2 wants to merge 2 commits into
cbomkit:mainfrom
Ndugu2:feat-cxx-support

Conversation

@Ndugu2
Copy link
Copy Markdown

@Ndugu2 Ndugu2 commented May 5, 2026

Goal
This PR introduces initial support for C/C++ cryptographic detection, resolving Issue #374.

Implementation Details

  • Standalone Scanner**: Implemented a C++ sensor using standard ANTLR4 grammars (C++14), allowing for AST-based scanning without dependency on closed-source plugins.
  • Detection Engine**: Added C++ specific translation and detection logic in the engine module.
  • OpenSSL Rules**: Included an initial set of detection rules for the OpenSSL EVP API.
  • Automated Source Generation**: Configured the antlr4-maven-plugin to generate parser classes at build-time. This PR correctly omits the massive generated Java files, keeping the repository hygiene high.

Cleanup & Hygiene

  • This PR branch was cleaned to exclude unrelated C# scaffolding and binary artifacts (maven_fast/).
  • Only source files and grammars are included.

Verification

  • Includes OsslEvpRuleTest.java as a placeholder for architectural verification.
  • To verify fully, run mvn clean install to ensure grammars compile and the module integrates correctly.

Fixes #374

@Ndugu2 Ndugu2 requested a review from a team as a code owner May 5, 2026 18:16
@san-zrl
Copy link
Copy Markdown
Contributor

san-zrl commented May 20, 2026

Hi @Ndugu2,

Thank you for your PR and for the time and effort you put into contributing to CBOMkit—we truly appreciate your interest.

You may have noticed that we are already working on adding C/C++ support to sonar-cryptography in PR #377. This approach differs from yours, as it relies on Sonar’s native C/C++ support package rather than ANTLR, similar to how the existing Java module is implemented.

Work on PR #377 is already quite advanced, and at this stage we are leaning toward this approach because we expect it to provide stronger support for cross-file symbol tracing through the Sonar infrastructure.

That said, we will keep your PR open for now until a final decision is made.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support for C/C++ in sonar-cryptography plugin with sonar-cxx

2 participants