facebookincubator / nvdtools
Conditional Complexity

The distribution of complexity of units (measured with McCabe index).

Intro
  • Conditional complexity (also called cyclomatic complexity) is a term used to measure the complexity of software. The term refers to the number of possible paths through a program function. A higher value ofter means higher maintenance and testing costs (infosecinstitute.com).
  • Conditional complexity is calculated by counting all conditions in the program that can affect the execution path (e.g. if statement, loops, switches, and/or operators, try and catch blocks...).
  • Conditional complexity is measured at the unit level (methods, functions...).
  • Units are classified in four categories based on the measured McCabe index: 1-5 (simple units), 6-10 (medium complex units), 11-25 (complex units), 26+ (very complex units).
Learn more...
Conditional Complexity Overall
  • There are 849 units with 10,458 lines of code in units (71.7% of code).
    • 1 very complex units (113 lines of code)
    • 1 complex units (68 lines of code)
    • 28 medium complex units (1,240 lines of code)
    • 96 simple units (2,849 lines of code)
    • 723 very simple units (6,188 lines of code)
1% | <1% | 11% | 27% | 59%
Legend:
51+
26-50
11-25
6-10
1-5
Alternative Visuals
Conditional Complexity per Extension
51+
26-50
11-25
6-10
1-5
go1% | <1% | 11% | 27% | 59%
Conditional Complexity per Logical Component
primary logical decomposition
51+
26-50
11-25
6-10
1-5
wfn13% | 7% | 45% | 13% | 20%
cmd/cpe2cve0% | 0% | 46% | 34% | 19%
providers/nvd0% | 0% | 21% | 23% | 54%
cvefeed/nvd0% | 0% | 35% | 32% | 31%
providers/rustsec0% | 0% | 45% | 27% | 27%
providers/idefense0% | 0% | 22% | 36% | 40%
vulndb0% | 0% | 6% | 41% | 52%
cmd/wfnconvert0% | 0% | 15% | 29% | 55%
rpm0% | 0% | 25% | 37% | 37%
providers/snyk0% | 0% | 15% | 22% | 62%
cvefeed0% | 0% | 0% | 38% | 61%
providers/redhat0% | 0% | 0% | 25% | 74%
providers/fireeye0% | 0% | 0% | 39% | 60%
providers/vfeed0% | 0% | 0% | 31% | 68%
providers/flexera0% | 0% | 0% | 43% | 56%
cmd/csv2cpe0% | 0% | 0% | 53% | 46%
providers/lib0% | 0% | 0% | 27% | 72%
vulndb/sqlutil0% | 0% | 0% | 20% | 79%
cvss30% | 0% | 0% | 10% | 89%
providers/rbs0% | 0% | 0% | 33% | 66%
cmd/redhat_filter0% | 0% | 0% | 69% | 30%
cpedict0% | 0% | 0% | 49% | 50%
stats0% | 0% | 0% | 32% | 67%
cvss20% | 0% | 0% | 6% | 93%
cmd/redhat_query0% | 0% | 0% | 42% | 57%
cmd/rpm2cpe0% | 0% | 0% | 20% | 79%
cmd/vfeed2nvd0% | 0% | 0% | 82% | 17%
cmd/vulndb0% | 0% | 0% | 0% | 100%
cmd/snyk2nvd0% | 0% | 0% | 0% | 100%
cmd/nvdsync0% | 0% | 0% | 0% | 100%
cmd/rbs2nvd0% | 0% | 0% | 0% | 100%
cmd/fireeye2nvd0% | 0% | 0% | 0% | 100%
vulndb/mysql0% | 0% | 0% | 0% | 100%
cmd/flexera2nvd0% | 0% | 0% | 0% | 100%
cmd/idefense2nvd0% | 0% | 0% | 0% | 100%
cmd/redhat2nvd0% | 0% | 0% | 0% | 100%
cmd/rustsec2nvd0% | 0% | 0% | 0% | 100%
vulndb/debug0% | 0% | 0% | 0% | 100%
Most Complex Units
Top 50 most complex units
Unit# linesMcCabe index# params
113 52 3
68 32 1
107 24 0
58 23 1
28 23 1
28 23 1
40 21 2
41 20 1
72 18 5
51 18 1
54 18 2
40 17 2
70 15 1
37 15 1
50 14 1
23 14 1
65 13 1
26 13 1
11 13 2
34 12 1
52 12 1
37 12 2
21 12 1
11 12 1
28 12 1
28 12 1
38 12 2
53 11 1
41 11 1
96 11 1
34 10 1
33 10 4
54 10 1
56 10 0
18 10 1
29 9 1
31 9 4
43 9 1
36 9 1
31 9 1
28 9 2
29 9 1
18 9 2
22 9 1
29 8 4
45 8 0
43 8 1
46 8 4
35 8 1
29 8 2