Questions tagged [static-analysis]
The analysis of source code or object code without executing the program. This may be done by automated tools or by human analysis.
55 questions
2
votes
1
answer
222
views
Why are most of the .NET code analysis rules disabled?
I've began studying how the .NET Code Analysis works. It seems that it can be either enabled via a NuGet package or a property in the SDK-style *.csproj files. Also, starting in .NET 5, it is enabled ...
- 750
2
votes
6
answers
1k
views
When to NOT use static code analysis tools?
There are many posts about the benefits of static code analysis tools. However, in which scenarios would you recommend NOT using (or significantly limit) them? For example, do you also run them on ...
- 261
5
votes
1
answer
191
views
How can I create a workflow for physical unit safety in Python?
I work for an engineering firm which builds most of our physics models in Excel with VBA. For myself and many other younger mechanical engineers in the company, this is not a good solution - we grew ...
- 213
-1
votes
1
answer
356
views
Building a function call tree at runtime
Edit #1
I believe that I misrepresented my intent when writing this question by focusing too much on the issues that have arisen from our misuse/misunderstanding of locks. I am making this edit to try ...
- 107
2
votes
3
answers
256
views
Where is the boundary between things which can be statically typechecked, and those which must be typechecked dynamically?
I am brain storming on how to create a type system for a programming language, and what the compiler will do with the typing information. Here is what I have found, followed by the main question, ...
- 2,661
1
vote
3
answers
948
views
Strategies for introducing or enforcing new linting or other code quality tooling rules
I'm in a situation where there is a code base that has TypeScript and ESlint but:
There are a lot of type errors (code compiles despite errors using Babel)
There are a lot of lint warnings.
We may ...
- 2,677
2
votes
1
answer
170
views
How could I programmatically generate a chart of interservice messaging flows before runtime?
My team is currently developing an application using a microservice architecture with publish/subscribe interservice communication over a message bus. Certain types of HTTP requests and messages ...
- 131
2
votes
4
answers
540
views
Does linting without auto-correction make sense?
In our Ruby on Rails projects we use a linter for our slim templates: slim-lint. It doesn't support any automatic fixes, not even the easiest ones. So I'd like to abandon it because I don't like to go ...
- 189
1
vote
3
answers
432
views
Automated test "all changes are feature-flagged", possible?
Let's say in an effort to improve quality, your team agrees on the following policy:
all commits to the master branch (direct or via pull request) have to be categorized as either bugfixes or ...
- 157
0
votes
1
answer
84
views
Effective ways of dealing with static analyser warnings caused by incidental use of reflection
I don't normally use reflection directly while programming in Java. But I do use APIs and frameworks that internally rely on reflection or annotations to provide customization points.
A lot of ...
- 129
0
votes
0
answers
63
views
Program Simulation Techniques
I've noticed that data-flow analysis uses approximations of a programs steps by simulating the value flow in some way (which I don't fully understand yet). They describe it well here. On page 4 they ...
- 2,661
12
votes
1
answer
15k
views
Difference Between Linter, Sanitizer and Static Analysis Tools
I've recently been looking at C++ static analysis tools. One thing that confuses me is the terminology used with these tools:
Some tools are simply called "static analysis tools" (e.g. CppCheck), ...
- 133
0
votes
5
answers
3k
views
How to evaluate efficiency of assembler code?
I was coding some functions in C++ and wondered how different versions of those functions would affect generated assembly code. I put different versions into the Godbolt Compiler Explorer Tool and ...
- 183
6
votes
3
answers
3k
views
Nesting class and enums types
If an enum type is dedicate only to a specific class, does it make sense to declare it inside the class itself? I mean, would it help to understand that this enum type was designed to be used only ...
- 217
6
votes
8
answers
2k
views
Can technical debt be detected by code analysis?
SonarQube is a software product which runs various coding style rules and other metrics similar to FxCop or Re-sharper. It defines breaking the style rules as:
"MAINTAINABILITY ISSUE
This is ...
- 79.8k
8
votes
2
answers
364
views
Is practice of using Annotations detrimental to code quality and longer term code maintenance?
With Doctrine annotation processing engine for PHP, and Annotatons being used for Doctrine Entities and for Zend Form, and possibly other things, and use in other languages as well, it looks like ...
- 8,257
28
votes
8
answers
5k
views
How to argue against lowering quality standards for legacy codebase? [closed]
We have here a large legacy code base with bad code you can't imagine.
We defined now some quality standards and want to get those fulfilled in either completely new codebase, but also if you touch ...
- 481
8
votes
2
answers
853
views
Is it wise to use Clang for personal code analysis in a project that builds with gcc?
I started to work on several C projects that are building using gcc. I believe this choice was made for several reasons:
Had to cross-compile for arm very early on (I think).
Performance is the first ...
- 271
0
votes
1
answer
59
views
Static analysis criteria different for various parts of solution
We have quite a large project where and tend to apply risk based approach to stringency of unit tests and code reviews. E.g. components classified as A need to have higher coverage than components ...
- 153
2
votes
3
answers
321
views
What is the difference between Static code analysis and code quality?
I need to know whether Static code analysis and code Quality are same or not because, I need to find out the tools for code quality and each time I google for it, I'm getting response for the tools ...
- 137
19
votes
3
answers
1k
views
Are there alternatives to types for static analysis?
Static typing in a programming language can be helpful for enforcing certain guarantees at compile time- but are types the only tool for this job? Are there other ways of specifying invariants?
For ...
- 393
5
votes
2
answers
424
views
How much static analysis history should a company keep?
Supposing you work in a very large global company with lot of code at all levels (e.g. from embedded to mobile platform application code), and projects can last anything between 6 months to 5 years... ...
- 14k
3
votes
2
answers
169
views
How to integrate static analysis tools in a running project
I've started in a company that has been developing an app for 4 years. They haven't used any static analysis tool until now so if we include them we will have tons of warnings.
Do you know how can we ...
- 1,574
5
votes
2
answers
379
views
Should static analysis be integrated with code review? [closed]
I want to integrate various static analysis tools, and then add the results as comments on a file within code review tools, such as Stash or Review board.
I am exploring the feasibility of writing ...
- 151
1
vote
2
answers
11k
views
Why am I getting field visibility warnings in Sonar?
Some static analysis tools flag non-private fields with
Variable '[nameHere]' must be private and have accessor methods.
Sonar consistently presents such warnings and wants to change all protected ...
- 113
26
votes
1
answer
17k
views
What is the purpose of Code analysis and when do I need to use it?
I heard about Visual Studio's Code analysis but never used one. I've read MSDN, but still don't understand the real use of Code analysis.
Isn't it the same as StyleCop?
Somewhere, FxCop was also ...
- 136k
0
votes
1
answer
68
views
Static analysis for finding capitalisation / case inconsistencies in file names
TLDR; I'm looking for ideas on how to flag code containing file names/paths that have inconsistent capitalisation with the actual file/directory.
Situation
I am migrating a significant code base ...
- 1,175
0
votes
1
answer
824
views
To what extent can impact analysis of a code change be automated?
I'm not sure how possible it even is but as a programmer I have a sense of risk involved when I'm making changes to a code base.
I've never seen a tool which basically tells me, as I'm coding, how ...
- 5,673
55
votes
4
answers
53k
views
Why shouldn't a method throw multiple types of checked exceptions?
We use SonarQube to analyse our Java code and it has this rule (set to critical):
Public methods should throw at most one checked exception
Using checked exceptions forces method callers to ...
- 679
8
votes
3
answers
1k
views
Is it safe to rely on static analysis to "reproduce" concurrency bugs reliably?
I've inherited some Java code which I suspect harbours some concurrency bugs when synchronizing between a thread that queries data and an IO event that updates the same data. I'm trialling a static ...
- 191
2
votes
2
answers
473
views
Checking program robustness using static code analysis
(Building on this question)
If you have a static code analyser such as Checkstyle, is it possible to to relate any of the stuff that it checks for to actual robustness? Some of the things that ...
- 643
2
votes
2
answers
647
views
How to set up something like an integration server that measures the quality of code and reject the code if the score is below a certain number?
Even if I don't like enforcing people to do things (and I believe that it may decline the productivity and cause anger), I really want to enforce good coding style.
Is there a way to set up ...
- 189
3
votes
3
answers
1k
views
Query Language for Java Code Analysis
I want to write a refactoring tool for the Java programming language.
For this reason I need to do structural queries against the abstract syntax tree. Given this AST how do I get answers to the ...
- 1,261
79
votes
5
answers
11k
views
Is there a correlation between the scale of the project and the strictness of the language?
Explaining the difference between strictness of languages and paradigms to a colleague of mine, I ended up asserting that:
Tolerant languages, such as dynamic and interpreted languages, are used best ...
- 136k
40
votes
4
answers
26k
views
Why would anyone invest time in Microsoft "Roslyn"?
I have just been reading through some of the white papers & examples from Microsoft "Roslyn" and the concept seems very interesting. From what I can tell, it opens up the black box that is the ...
- 717
9
votes
2
answers
2k
views
How is it possible to build the whole codebase from source at Google scale?
The first answer to an old, recently active question linked to a video which talks about how Google repository is done.
One interesting thing which was mentioned is the fact that everything is build ...
- 136k
4
votes
2
answers
256
views
Strategies for using a code metric evaluation tool
Should code quality metric evaluation tools like Sonar be integrated with IDE for running local analysis or should they be a part of the build process (like integrated with maven) for continuous ...
- 5,217
0
votes
2
answers
660
views
Static analysis, dynamic analysis and testing
Based on answers I have received here and then confirmed in some authoritative sources (not ISTQB which seems to be too vague), there are 3 activities:
Static analysis
Dynamic analysis
Testing
...
- 4,936
5
votes
3
answers
3k
views
Inspection, code review - is it really testing?
ISTQB, Wikipedia or other sources classify verification acitivities (reviews etc.) as a static testing, yet other do not. If we can say that peer reviews and inspections are actually a kind of a ...
- 4,936
2
votes
1
answer
3k
views
Automatic static analysis vs White box testing
Many sources note that automatic static code analysis include data flow and control flow. But these two are included in white box testing as well. Is there a difference in the automation? That in ...
- 4,936
2
votes
3
answers
2k
views
Why some consider static analysis a testing and some do not?
Preparing myself also to ISTQB certification, I found they call static analysis actually as a static testing, while some engineering book distinct between static analysis and testing, which is the ...
- 4,936
11
votes
5
answers
918
views
Programmaticaly finding the Landau notation (Big O or Theta notation) of an algorithm?
I'm used to search for the Landau (Big O, Theta...) notation of my algorithms by hand to make sure they are as optimized as they can be, but when the functions are getting really big and complex, it's ...
- 219
17
votes
7
answers
2k
views
How to avoid the pitfalls of static analysis
I'm working at a company that would score 11 on Joel Test - at least on paper.
In practice, however, nothing works quite as well as expected, and the project has been on DEFCON 1 for half a year. Now,...
user2582
4
votes
2
answers
1k
views
Why does the code auditing tools like FindBugs require a compile step to work properly?
Basically I ran Intellij Idea 's plug in called FindBugs-Idea to analyze my code . I corrected whatever errror was caught and then ran the tool again but it was still complaining about the same error ...
- 5,217
2
votes
5
answers
2k
views
Is automatically checking code quality via metrics possible?
For several years now I am a big fan of using static code analysis tools for checking the source code quality. We are mostly doing C# development so NDepend was the best way to go for me. Most of the ...
- 241
3
votes
2
answers
349
views
"continue" and "break" for static analysis
I know there have been a number of discussions of whether break and continue should be considered harmful generally (with the bottom line being - more or less - that it depends; in some cases they ...
- 609
2
votes
1
answer
441
views
is there a formal algebra method to analyze programs?
Is there a formal/academic connection between an imperative program and algebra, and if so where would I learn about it?
The example I'm thinking of is:
if(C1) { A1(); A2(); }
if(C2) { A1(); A2(); }
...
- 5,673
5
votes
2
answers
3k
views
Static Analysis tools to detect architectural patterns
Currently for school we are working on a research project. The central question of this project is: Which architectural patterns can be detected using static code analysis? With architectural pattern ...
- 151
4
votes
4
answers
4k
views
Difference between static testing and code review [duplicate]
Possible Duplicate:
What is the difference between Static code analysis and code review?
What is the difference between static testing and code review?
I found some information on wikipedia that ...
- 141
4
votes
1
answer
245
views
Rapid code analysis
I have recently moved to a new company where I am tasked (in part) with evaluating the existing code base and coming up with patterns and best practices.
Our development team consists of around 20 ...
- 227