A hands-on introduction to static code analysis
deepsource.io
A hands-on introduction to static code analysis
1–10 of 32 posts
Re: A hands-on introduction to static code analysis
#2Slightly tangential to what the article is about, but at least in the C/C++ world, the most important change to make static analysis popular for "the rest of us" was probably Xcode's decision to integrate clang analyzer right into the Xcode UI under a menu item (Xcode doesn't do many things right, but this is definitely one of the very good features).
This way, analyzing the code is a simple "button press" and works out of the box on every Xcode project.
Soon after, Microsoft followed suit in Visual Studio (even though in my experience, the MS analyzer doesn't catch quite as many things as the clang analyzer).
Before that, static analyzers were those no doubt useful but obscure "magic tools" which were very hard to integrate into an existing build process.
Even the most useful tool will be ignored when it is hard to use.
Re: A hands-on introduction to static code analysis
#3It's good to see discussions of static analysis, but I often feel that these blog posts do a disservice to the techniques. The post leads by mentioning applications like bugfinding and security vuln detection but the examples here are barely above local syntactic checks. This is the common scenario in the majority of blog posts I see about static analysis, probably because it is just much easier to put together a quick write up on AST-linting. Heck, this article has a diagram that directly states that an AST is the input to a static analysis module, but that is true only for some kinds of things!
AST level analysis is certainly useful. Everybody should be using some sort of style checker. But AST pattern matching is a completely different technique from the stuff used to do bugfinding that I worry that these blog posts will give the wrong impression about what static analysis can do and what it can't do.
I'd love to see blog posts about interprocedural pointer analysis, for example.
Re: A hands-on introduction to static code analysis
#4The kinds of analyses mentioned here are typically grouped under "linting"–more advanced static analysis tools will typically do things like dataflow analysis.
Re: A hands-on introduction to static code analysis
#5Slightly tangential to what the article is about, but at least in the C/C++ world, the most important change to make static analysis popular for "the rest of us" was probably Xcode's decision to integrate clang analyzer right into the Xcode UI under a menu item (Xcode doesn't do many things right, but this is definitely one of the very good features). This way, analyzing the code is a simple "button press" and works…
Somewhat annoyingly, the static analyzer that ships with Xcode doesn't seem to be packaged separately as in the command line tools…
Re: A hands-on introduction to static code analysis
#6The kinds of analyses mentioned here are typically grouped under "linting"–more advanced static analysis tools will typically do things like dataflow analysis.
Any beginner friendly articles on more advanced analysis that you'd recommend?
Re: A hands-on introduction to static code analysis
#7Slightly tangential to what the article is about, but at least in the C/C++ world, the most important change to make static analysis popular for "the rest of us" was probably Xcode's decision to integrate clang analyzer right into the Xcode UI under a menu item (Xcode doesn't do many things right, but this is definitely one of the very good features). This way, analyzing the code is a simple "button press" and works…
Somewhat annoyingly, the static analyzer that ships with Xcode doesn't seem to be packaged separately as in the command line tools…
Same with the profiling tools.
Re: A hands-on introduction to static code analysis
#8It's good to see discussions of static analysis, but I often feel that these blog posts do a disservice to the techniques. The post leads by mentioning applications like bugfinding and security vuln detection but the examples here are barely above local syntactic checks. This is the common scenario in the majority of blog posts I see about static analysis, probably because it is just much easier to put together a qui…
Article author here. Agree that the post merely touches the surface for static analysis -- because it was aimed towards an audience looking for an introduction to static analysis. The scope for the examples in this post had to be limited for this reason.
Inter-procedural pointer analysis -- Yes, a lot more trickier than these, but definitely more juicier. Will try to write a post on it in the coming weeks.
Re: A hands-on introduction to static code analysis
#9The kinds of analyses mentioned here are typically grouped under "linting"–more advanced static analysis tools will typically do things like dataflow analysis.
Any beginner friendly articles on more advanced analysis that you'd recommend?
Maybe a bit tangential, but still interestin:
https://cacm.acm.org/magazines/2010/2/69354-a-few-billion-li...
Re: A hands-on introduction to static code analysis
#10It's good to see discussions of static analysis, but I often feel that these blog posts do a disservice to the techniques. The post leads by mentioning applications like bugfinding and security vuln detection but the examples here are barely above local syntactic checks. This is the common scenario in the majority of blog posts I see about static analysis, probably because it is just much easier to put together a qui…
Article author here. Agree that the post merely touches the surface for static analysis -- because it was aimed towards an audience looking for an introduction to static analysis. The scope for the examples in this post had to be limited for this reason. Inter-procedural pointer analysis -- Yes, a lot more trickier than these, but definitely more juicier. Will try to write a post on it in the coming weeks.
The article is great and it is clear it is intended for beginners. Everything is explained as for beginners which is good. A second part is very welcome.