1

Not sure Programmers Stack Exchange is the place to ask this question, but thought I'd give it a go.

Our team had a near miss recently with a nasty error where a method call had been added to the wrong area of code,such that it deleted the an order immediately after the user had been through the checkout. There was no warning to the customer or us due to the nature of the API we were using (and can't modify).

It occurred to me that what we wanted was some sort of Audit tool, a bit like a linter, that we could configure to check each new Github commit for use of certain key method calls. If someone made that method call, it would flag it for extra scrutiny. Maybe a Jenkins plug-in would be the best place for this, as our code runs through Jenkins CI every time we push to our main pre-release branch?

For clarity, this code had been fully tested and code reviewed. While there are lessons to learn in both these areas, this feels like something an automated process could help with. Ultimately finding the bug was something of good fortune, as one of the developers was tidying something else up in that area of the code.

Some of the questions I have:

  • Do such tools exist?
  • Where would they typically be best applied; in the IDE, during the source control check in process or in something like Jenkins during CI?
  • Are they all programming language specific? Or really,are we limited to simply as running a grep over our code-base?

Any thoughts or ideas really appreciated.

5
  • 2
    You may wish to read this answer about the difficulties with static analysis in some languages. If you are looking for a tool, consider asking on Software Recomenadtions.SE, given you provide enough information (you don't have enough currently) to get a good answe (language, environment, what you want to check, what it runs on, etc...).
    – user40980
    Commented Sep 22, 2014 at 4:29
  • Thanks for that link - it made a lot of sense. I specifically left the question vague as I wanted to think about it more in 'does this type of thing exist' terms, and if it does, where is the best place to check. However, I was not aware of the Software Recommendations SE, so I'll post there shortly with a more specific question.
    – JonRed
    Commented Sep 22, 2014 at 4:34
  • What is the compiler you are using? If using GCC you could customize it with MELT
    – Basile Starynkevitch
    Commented Sep 24, 2014 at 5:25
  • The actual issue happened in Javascript code; it made an AJAX request that deleted an item. After the we'd got confirmation that the item was successfully saved, and sent out customer emails. Lucky we spotted it. The more I think about this, the more I think in something like Javascript this is a practically impossible task.
    – JonRed
    Commented Sep 24, 2014 at 5:28
  • If you are using git, just add a git hook that greps the diff for keywords and sends an email if it founds anything. Of course you can include such a script in the daily routine for the team or a lead developer or during reviews.
    – Jens Schauder
    Commented Sep 24, 2014 at 7:51

1 Answer 1

Reset to default
3

For clarity, this code had been fully tested and code reviewed

tested and reviewed, but not fully, obviously. I think that's the area you should be looking at.

As for a tool - surely a simply regex running over every file in the build is what you want. Alternatively get a open-source static analyis tool and modify it to handle cases where your method is called. These tools will already have checks for other, dangerous methods (eg memcpy in C) so it should be an easy task to modify to handle your own methods.

3
  • Yes, obviously the testing and code reviewed failed to identify the issue. But in this instance, it was a very easy thing to miss. I've been doing a lot of thinking, and I think improved unit tests would have caught this. Thanks for taking the time to answer.
    – JonRed
    Commented Sep 24, 2014 at 5:30
  • I really doubt a unit test would have picked this up, not unless it handles the insertion of data as well as checks the order. There is no easy way to est code properly but a better set of integration tests, like how things used to be done the old-fashioned boring ways.
    – gbjbaanb
    Commented Sep 24, 2014 at 7:46
  • I only say that because the error was an ajax call, and if I hadn't mocked out the ajax call it would have not executed. But yes, I agree, it is a lesson learned for what to add to our integration test checklist.
    – JonRed
    Commented Sep 25, 2014 at 1:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.