Codechecker Integration with DefectDojo
CodeChecker is an open-source static analysis infrastructure built on the LLVM/Clang toolchain that integrates multiple static analyzers including Clang Static Analyzer and Clang-Tidy to detect bugs, code quality issues, and security vulnerabilities in C, C++, and Objective-C projects through automated source code analysis and symbolic execution. The platform provides a comprehensive defect database, web-based result viewer with filtering and comparison capabilities, incremental analysis support, and integration with CI/CD pipelines to track, manage, and remediate issues across development workflows while minimizing false positives through sophisticated issue management features.
Data Granularity: What Gets Imported
The following fields are captured from Codechecker results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Codechecker",
"engagement": "<engagement-id>",
"file": "results.json"
}