static-analysis | 易学教程

Are there any static analysis tools that will report how closely the SOLID principles are followed?

阅读更多关于 Are there any static analysis tools that will report how closely the SOLID principles are followed?

问题 I know blindly following any "best practice" can still lead to a stinking pile of crap that strictly adheres to the best practice. The SOLID principles are just that, principles . They don't apply to every situation but they are still very good heuristics for finding possible improvements in your code. The downside to them is that they sometimes require a deep analysis of your source code to apply them. I, like most programmers, am constantly on the lookout for more efficient ways of doing

Code Contracts: Why are some invariants not considered outside the class?

阅读更多关于 Code Contracts: Why are some invariants not considered outside the class?

问题 Consider this immutable type: public class Settings { public string Path { get; private set; } [ContractInvariantMethod] private void ObjectInvariants() { Contract.Invariant(Path != null); } public Settings(string path) { Contract.Requires(path != null); Path = path; } } Two things to notice here: There is a contract invariant which ensures the Path property can never be null The constructor checks the path argument value to respect the previous contract invariant At this point, a Setting

In Java what is meant by “calling context” (and some other terms)?

阅读更多关于 In Java what is meant by “calling context” (and some other terms)?

I am trying to understand static analysis of Java bytecode/source-code. These terms frequently come up for which I am not able to find satisfactory definitions on the Internet: context (in)sensitive analysis calling context active call site points-to analysis Can anyone please elaborate in layman terms what the above terms mean in the context of Java. A search of "context" "programming" on Google brings up stuff about context sensitive grammar, language theory, etc., but not the definitions I need (unless they mean the same thing). calling context : when analyzing code at a certain location,

Marking primitive types with phantom types in Scala

阅读更多关于 Marking primitive types with phantom types in Scala

问题 In Scala I can use the concept of phantom types (as described e.g. here) to mark types and have this information erased at runtime. I wonder whether it is possible to mark primitive types with phantom types without having them boxed. An example could be a function that lets an Int only pass if it is a prime. The signature might look similar to the following: def filterPrime(i: Int): Option[Int with IsPrime] The function returns the value Some(i) if i is prime or None else. Is the stated idea

Failing compilation if return value is unused for a certain type

阅读更多关于 Failing compilation if return value is unused for a certain type

I would like to make compilation fail for some function call but not others. The function call that I want to fail are those that do not handle return values when the value is of a certain type. In the example below, not handling a function returning Error is a compilation error but not handling a function that returns anything else should succeed just fine. Note: our runtime environment (embedded) does not allow us to use the following constructs: RTTI, exceptions. This code only needs to compiler with Clang, I would prefer not having to annotate each function. We prefer a solution that fails

Fortify Source Analyzer and Apache Lenya

阅读更多关于 Fortify Source Analyzer and Apache Lenya

I am trying to use Fortify Source Code Analyzer for a research project at my school to test the security for open source Java web applications. I am currently working on Apache Lenya. I am working with the last stable release (Lenya v2.0.2). Inside the root directory there is a file named build.sh . This file is called to build Lenya using the version of Ant that ships with the release (in the tools/bin folder). I can build Lenya just fine when I run ./build.sh . So, it would be assumed that running the following command in Fortify would work : sourceanalyzer -b lenya -Xmx1200M touchless .

Is there a need for a “use strict” Python compiler?

阅读更多关于 Is there a need for a “use strict” Python compiler?

问题 There exist static analysis tools for Python, but compile time checks tend to be diametrically opposed to the run-time binding philosophy that Python embraces. It's possible to wrap the standard Python interpreter with a static analysis tool to enforce some "use strict"-like constraints, but we don't see any widespread adoption of such a thing. Is there something about Python that makes "use strict" behavior unnecessary or especially undesirable? Alternatively, is the "use strict" behavior

Measuring the complexity of SQL statements

阅读更多关于 Measuring the complexity of SQL statements

问题 The complexity of methods in most programming languages can be measured in cyclomatic complexity with static source code analyzers. Is there a similar metric for measuring the complexity of a SQL query? It is simple enough to measure the time it takes a query to return, but what if I just want to be able to quantify how complicated a query is? [Edit/Note] While getting the execution plan is useful, that is not necessarily what I am trying to identify in this case. I am not looking for how

Finding unused methods in IntelliJ (excluding tests)

阅读更多关于 Finding unused methods in IntelliJ (excluding tests)

I ran into a method today that is .. not used anywhere .. but is tested. Since it is used by a test, IntelliJ did not flag the method as 'unused'. Does IntelliJ allow for the following search condition "Find methods that are unused with the exception of tests, where test is defined as anything with @Test annotation" There is a related feature request: IDEA-56519 Inspection for unused code needs options to take into account methods run by test harnesses While the first point is already covered by the Configure annotations... option in the inspection settings, the second point is still valid: An

Extract information on usage of functions and packages in R scripts

阅读更多关于 Extract information on usage of functions and packages in R scripts

What would be a proper way to extract function calls and their occuring line in one or more R scripts? Is there a parsing base function or package that allows me to do this or should I build a solution with regular expressions? For example: function_calls("project1/exploratory_analysis.R") should output a dataframe like: ## function line filename ## 1 tapply 35 exploratory_analysis.R ## 2 qplot 80 exploratory_analysis.R What I want to achieve finally is to build a reverse index of function calls and loaded packages as used in one or more R scripts, for educational and reference purposes. (e.g.