Recognize .sc file extension as C code about flawfinder HOT 4 CLOSED

David, Oracle SQL-embedded C code is almost exactly the same as Postgres embedded-SQL C which it seems you are handling. I think I see the list of file extensions in your c_extensions list, which includes two varieties of SQL-embedded C. I haven’t used Informix embedded C, but I have used both the Postgres and Oracle styles, and they are almost identical. The embedded SQL sections start with “EXEC SQL” (not case sensitive) and end with semi-colon (;). For example: { int a; /* ... */ EXEC SQL SELECT salary INTO :a FROM Employee WHERE SSN=876543210; /* ... */ printf("The salary is %d\n", a); /* ... */ } I’m hoping that simply adding this to your c_extensions would be sufficient: ‘.sc': 1, # Oracle SQL-embedded C. I believe ‘.pc’ is also commonly used, so you might also want this entry: '.pc': 1, # Oracle SQL-embedded C I see you also already have this entry: '.pcc': 1, # Oracle C++ It would be nice to have an option to allow configuring this list at run time. This is the current list I see: c_extensions = { '.c': 1, '.h': 1, '.ec': 1, '.ecp': 1, # Informix embedded C. '.pgc': 1, # Postgres embedded C. '.C': 1, '.cpp': 1, '.CPP': 1, '.cxx': 1, '.cc': 1, # C++ '.CC': 1, '.c++': 1, # C++. '.pcc': 1, # Oracle C++ '.hpp': 1, '.H': 1, # .h - usually C++. } Thanks, Peter