2022 Developer Survey is open! Take survey.

Questions tagged [static-analysis]

The analysis of source code or object code without executing the program. This may be done by automated tools or by human analysis.

Filter by
Sorted by
Tagged with
1 vote
6 answers
406 views

When to NOT use static code analysis tools?

There are many posts about the benefits of static code analysis tools. However, in which scenarios would you recommend NOT using (or significantly limit) them? For example, do you also run them on ...
user avatar
3 votes
1 answer
160 views

How can I create a workflow for physical unit safety in Python?

I work for an engineering firm which builds most of our physics models in Excel with VBA. For myself and many other younger mechanical engineers in the company, this is not a good solution - we grew ...
user avatar
-1 votes
1 answer
94 views

Building a function call tree at runtime

Edit #1 I believe that I misrepresented my intent when writing this question by focusing too much on the issues that have arisen from our misuse/misunderstanding of locks. I am making this edit to try ...
user avatar
2 votes
3 answers
216 views

Where is the boundary between things which can be statically typechecked, and those which must be typechecked dynamically?

I am brain storming on how to create a type system for a programming language, and what the compiler will do with the typing information. Here is what I have found, followed by the main question, ...
user avatar
  • 2,412
1 vote
3 answers
306 views

Strategies for introducing or enforcing new linting or other code quality tooling rules

I'm in a situation where there is a code base that has TypeScript and ESlint but: There are a lot of type errors (code compiles despite errors using Babel) There are a lot of lint warnings. We may ...
user avatar
  • 2,412
1 vote
1 answer
95 views

How could I programmatically generate a chart of interservice messaging flows before runtime?

My team is currently developing an application using a microservice architecture with publish/subscribe interservice communication over a message bus. Certain types of HTTP requests and messages ...
user avatar
2 votes
4 answers
418 views

Does linting without auto-correction make sense?

In our Ruby on Rails projects we use a linter for our slim templates: slim-lint. It doesn't support any automatic fixes, not even the easiest ones. So I'd like to abandon it because I don't like to go ...
user avatar
  • 179
1 vote
3 answers
342 views

Automated test "all changes are feature-flagged", possible?

Let's say in an effort to improve quality, your team agrees on the following policy: all commits to the master branch (direct or via pull request) have to be categorized as either bugfixes or ...
user avatar
  • 157
0 votes
1 answer
76 views

Effective ways of dealing with static analyser warnings caused by incidental use of reflection

I don't normally use reflection directly while programming in Java. But I do use APIs and frameworks that internally rely on reflection or annotations to provide customization points. A lot of ...
user avatar
0 votes
0 answers
59 views

Program Simulation Techniques

I've noticed that data-flow analysis uses approximations of a programs steps by simulating the value flow in some way (which I don't fully understand yet). They describe it well here. On page 4 they ...
user avatar
  • 2,412
10 votes
1 answer
8k views

Difference Between Linter, Sanitizer and Static Analysis Tools

I've recently been looking at C++ static analysis tools. One thing that confuses me is the terminology used with these tools: Some tools are simply called "static analysis tools" (e.g. CppCheck), ...
user avatar
  • 113
0 votes
4 answers
1k views

How to evaluate efficiency of assembler code?

I was coding some functions in C++ and wondered how different versions of those functions would affect generated assembly code. I put different versions into the Godbolt Compiler Explorer Tool and ...
user avatar
  • 175
5 votes
3 answers
2k views

Nesting class and enums types

If an enum type is dedicate only to a specific class, does it make sense to declare it inside the class itself? I mean, would it help to understand that this enum type was designed to be used only ...
user avatar
  • 169
5 votes
7 answers
1k views

Can technical debt be detected by code analysis?

SonarQube is a software product which runs various coding style rules and other metrics similar to FxCop or Re-sharper. It defines breaking the style rules as: "MAINTAINABILITY ISSUE This is ...
user avatar
  • 64.1k
8 votes
2 answers
327 views

Is practice of using Annotations detrimental to code quality and longer term code maintenance?

With Doctrine annotation processing engine for PHP, and Annotatons being used for Doctrine Entities and for Zend Form, and possibly other things, and use in other languages as well, it looks like ...
user avatar
  • 8,021
28 votes
8 answers
5k views

How to argue against lowering quality standards for legacy codebase? [closed]

We have here a large legacy code base with bad code you can't imagine. We defined now some quality standards and want to get those fulfilled in either completely new codebase, but also if you touch ...
user avatar
  • 481
8 votes
2 answers
705 views

Is it wise to use Clang for personal code analysis in a project that builds with gcc?

I started to work on several C projects that are building using gcc. I believe this choice was made for several reasons: Had to cross-compile for arm very early on (I think). Performance is the first ...
user avatar
  • 271
0 votes
1 answer
58 views

Static analysis criteria different for various parts of solution

We have quite a large project where and tend to apply risk based approach to stringency of unit tests and code reviews. E.g. components classified as A need to have higher coverage than components ...
user avatar
  • 153
2 votes
3 answers
220 views

What is the difference between Static code analysis and code quality?

I need to know whether Static code analysis and code Quality are same or not because, I need to find out the tools for code quality and each time I google for it, I'm getting response for the tools ...
user avatar
19 votes
3 answers
1k views

Are there alternatives to types for static analysis?

Static typing in a programming language can be helpful for enforcing certain guarantees at compile time- but are types the only tool for this job? Are there other ways of specifying invariants? For ...
user avatar
5 votes
2 answers
338 views

How much static analysis history should a company keep?

Supposing you work in a very large global company with lot of code at all levels (e.g. from embedded to mobile platform application code), and projects can last anything between 6 months to 5 years... ...
user avatar
  • 13.8k
3 votes
2 answers
153 views

How to integrate static analysis tools in a running project

I've started in a company that has been developing an app for 4 years. They haven't used any static analysis tool until now so if we include them we will have tons of warnings. Do you know how can we ...
user avatar
5 votes
2 answers
361 views

Should static analysis be integrated with code review? [closed]

I want to integrate various static analysis tools, and then add the results as comments on a file within code review tools, such as Stash or Review board. I am exploring the feasibility of writing ...
user avatar
1 vote
2 answers
9k views

Why am I getting field visibility warnings in Sonar?

Some static analysis tools flag non-private fields with Variable '[nameHere]' must be private and have accessor methods. Sonar consistently presents such warnings and wants to change all protected ...
user avatar
  • 113
26 votes
1 answer
16k views

What is the purpose of Code analysis and when do I need to use it?

I heard about Visual Studio's Code analysis but never used one. I've read MSDN, but still don't understand the real use of Code analysis. Isn't it the same as StyleCop? Somewhere, FxCop was also ...
user avatar
0 votes
1 answer
58 views

Static analysis for finding capitalisation / case inconsistencies in file names

TLDR; I'm looking for ideas on how to flag code containing file names/paths that have inconsistent capitalisation with the actual file/directory. Situation I am migrating a significant code base ...
user avatar
  • 1,135
0 votes
1 answer
756 views

To what extent can impact analysis of a code change be automated?

I'm not sure how possible it even is but as a programmer I have a sense of risk involved when I'm making changes to a code base. I've never seen a tool which basically tells me, as I'm coding, how ...
user avatar
51 votes
4 answers
50k views

Why shouldn't a method throw multiple types of checked exceptions?

We use SonarQube to analyse our Java code and it has this rule (set to critical): Public methods should throw at most one checked exception Using checked exceptions forces method callers to ...
user avatar
  • 639
8 votes
3 answers
1k views

Is it safe to rely on static analysis to "reproduce" concurrency bugs reliably?

I've inherited some Java code which I suspect harbours some concurrency bugs when synchronizing between a thread that queries data and an IO event that updates the same data. I'm trialling a static ...
user avatar
  • 191
2 votes
2 answers
443 views

Checking program robustness using static code analysis

(Building on this question) If you have a static code analyser such as Checkstyle, is it possible to to relate any of the stuff that it checks for to actual robustness? Some of the things that ...
user avatar
  • 623
2 votes
2 answers
609 views

How to set up something like an integration server that measures the quality of code and reject the code if the score is below a certain number?

Even if I don't like enforcing people to do things (and I believe that it may decline the productivity and cause anger), I really want to enforce good coding style. Is there a way to set up ...
user avatar
  • 179
3 votes
3 answers
1k views

Query Language for Java Code Analysis

I want to write a refactoring tool for the Java programming language. For this reason I need to do structural queries against the abstract syntax tree. Given this AST how do I get answers to the ...
user avatar
  • 1,181
79 votes
5 answers
10k views

Is there a correlation between the scale of the project and the strictness of the language?

Explaining the difference between strictness of languages and paradigms to a colleague of mine, I ended up asserting that: Tolerant languages, such as dynamic and interpreted languages, are used best ...
user avatar
38 votes
4 answers
26k views

Why would anyone invest time in Microsoft "Roslyn"?

I have just been reading through some of the white papers & examples from Microsoft "Roslyn" and the concept seems very interesting. From what I can tell, it opens up the black box that is the ...
user avatar
9 votes
2 answers
2k views

How is it possible to build the whole codebase from source at Google scale?

The first answer to an old, recently active question linked to a video which talks about how Google repository is done. One interesting thing which was mentioned is the fact that everything is build ...
user avatar
4 votes
2 answers
253 views

Strategies for using a code metric evaluation tool

Should code quality metric evaluation tools like Sonar be integrated with IDE for running local analysis or should they be a part of the build process (like integrated with maven) for continuous ...
user avatar
  • 5,049
0 votes
2 answers
636 views

Static analysis, dynamic analysis and testing

Based on answers I have received here and then confirmed in some authoritative sources (not ISTQB which seems to be too vague), there are 3 activities: Static analysis Dynamic analysis Testing ...
user avatar
  • 4,878
5 votes
3 answers
3k views

Inspection, code review - is it really testing?

ISTQB, Wikipedia or other sources classify verification acitivities (reviews etc.) as a static testing, yet other do not. If we can say that peer reviews and inspections are actually a kind of a ...
user avatar
  • 4,878
2 votes
1 answer
3k views

Automatic static analysis vs White box testing

Many sources note that automatic static code analysis include data flow and control flow. But these two are included in white box testing as well. Is there a difference in the automation? That in ...
user avatar
  • 4,878
2 votes
3 answers
2k views

Why some consider static analysis a testing and some do not?

Preparing myself also to ISTQB certification, I found they call static analysis actually as a static testing, while some engineering book distinct between static analysis and testing, which is the ...
user avatar
  • 4,878
11 votes
5 answers
878 views

Programmaticaly finding the Landau notation (Big O or Theta notation) of an algorithm?

I'm used to search for the Landau (Big O, Theta...) notation of my algorithms by hand to make sure they are as optimized as they can be, but when the functions are getting really big and complex, it's ...
user avatar
  • 219
17 votes
7 answers
2k views

How to avoid the pitfalls of static analysis

I'm working at a company that would score 11 on Joel Test - at least on paper. In practice, however, nothing works quite as well as expected, and the project has been on DEFCON 1 for half a year. Now,...
user avatar
4 votes
2 answers
1k views

Why does the code auditing tools like FindBugs require a compile step to work properly?

Basically I ran Intellij Idea 's plug in called FindBugs-Idea to analyze my code . I corrected whatever errror was caught and then ran the tool again but it was still complaining about the same error ...
user avatar
  • 5,049
2 votes
5 answers
2k views

Is automatically checking code quality via metrics possible?

For several years now I am a big fan of using static code analysis tools for checking the source code quality. We are mostly doing C# development so NDepend was the best way to go for me. Most of the ...
user avatar
  • 231
3 votes
2 answers
319 views

"continue" and "break" for static analysis

I know there have been a number of discussions of whether break and continue should be considered harmful generally (with the bottom line being - more or less - that it depends; in some cases they ...
user avatar
  • 609
2 votes
1 answer
397 views

is there a formal algebra method to analyze programs?

Is there a formal/academic connection between an imperative program and algebra, and if so where would I learn about it? The example I'm thinking of is: if(C1) { A1(); A2(); } if(C2) { A1(); A2(); } ...
user avatar
5 votes
2 answers
2k views

Static Analysis tools to detect architectural patterns

Currently for school we are working on a research project. The central question of this project is: Which architectural patterns can be detected using static code analysis? With architectural pattern ...
user avatar
  • 151
4 votes
4 answers
4k views

Difference between static testing and code review [duplicate]

Possible Duplicate: What is the difference between Static code analysis and code review? What is the difference between static testing and code review? I found some information on wikipedia that ...
user avatar
  • 141
4 votes
1 answer
238 views

Rapid code analysis

I have recently moved to a new company where I am tasked (in part) with evaluating the existing code base and coming up with patterns and best practices. Our development team consists of around 20 ...
user avatar
18 votes
3 answers
508 views

Is there a correlation between complexity and reachability?

I've been studying cyclomatic complexity (McCabe) and reachability of software at uni recently. Today my lecturer said that there's no correlation between the two metrics, but is this really the case? ...
user avatar