Program analysis in java

Saved searches

Use saved searches to filter your results more quickly

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

An example of how we can use the Soot environment to do program analysis in Java

rtrimana/program_analysis

This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Sign In Required

Please sign in to use Codespaces.

Launching GitHub Desktop

If nothing happens, download GitHub Desktop and try again.

Launching GitHub Desktop

If nothing happens, download GitHub Desktop and try again.

Launching Xcode

If nothing happens, download Xcode and try again.

Launching Visual Studio Code

Your codespace will open once ready.

There was a problem preparing your codespace, please try again.

Latest commit

Git stats

Files

Failed to load latest commit information.

README.md

An example of how we can use the Soot environment to do program analysis in Java

###Please supply rt.jar file in the second class path while running the transform. It can usually be found at $JAVA_HOME/jre/lib/rt.jar

The first assignment of Program Analysis class — Fall 2016

We will write an optimization pass. We will implement a dead code elimination pass with the following characteristics:

1. This pass tries to detect recursively the presence of essential/anchor statements:
   • Method invocations
   • Field references (including global fields)
   • Array references
   • Return statements (also preserves void returns)
   • Conditional branches, e.g. loops (while, for, etc.), if-statements (including switch-case)
2. In a recursive manner, the method goTagStatement will try to tag statements as LIVE or DEAD with the following conditions:
   • Essential/anchor statements are always LIVE
   • Other statements, i.e. non-essentials, that are chained in some way with the essential/anchor statements are tagged as LIVE
   • Otherwise, those other statements are tagged as DEAD
3. Some special conditions:
   • Field and array references are always considered as LIVE
   • Field and array dereferences depend on the variables dereferencing the field / array. If the variable is connected in some way and pass its value to other variables that end up being connected with an essential/anchor statement, then it is LIVE. It is DEAD otherwise.
4. Optimized code behaves the same as the original code for executions in which the original code does not throw any exceptions. This means that we can safely optimize away statements that could cause exceptions, e.g. division-by-zero, etc., but they are never chained to any of the essential/anchor statements.

How to run the optimization:

Note: USE JAVA Version 7 ONLY

1. Extract tar ball.
2. Navigate to src folder cd src/ .
3. Modify the Makefile accordingly by setting up the path to rt.jar and setting up the path to soot.2.5.0.jar
4. Use the GNU Make utility to run make .

Directory structure (important files/folders):

1. src/ folder has all the src code for the project.
2. Adapter.java loads the target class and applies the transform to it.
3. Buster.java contains the actual code for the transformation.
4. RJUtils.java contains some static methods for testing for live anchor statements.
5. Status.java contains a tag implementation for use in buster to tage code as dead or alive.
6. src/Tests folder contains all the test files we used as test suite for this pass.

By Rahmadi Trimananda and Joel Bandi

About

An example of how we can use the Soot environment to do program analysis in Java

Источник

Static Code Analysis Tools For Java To Provide Quality Measurements

Top 10 Best Static Code Analysis Tools For Java. Do you know what Netflix, Minecraft, Slack, Android, Hadoop, and Jenkins have in common? They are written in Java. Not only that, but most of the apps that you run on your smartphones are developed using Java. It completed its 25 years in December 2020 and is still one of the most popular and widely used programming languages in the world.

Java is a class-based, object-oriented programming language that focuses on having a low number of implementation dependencies. It is a language that intends to let the programmers write a code once and run it anywhere. Simply, it can be said that Java codes are independent of platforms and its code can run on the platforms supporting Java without the need for recompilation.

However, as a beginner, it might be confusing for you to check if the code you have written is working accurately or not. That’s why we are going to discuss what code analysis is and how its tools can help you in recognizing the quality of code.

What is Code Analysis?

Code analysis refers to the analysis of source code or compiled code program to find errors. It can be done in one of two ways — through static analysis or dynamic analysis. On one hand, static analysis is a way programmers can test the code without executing it. The static code analysis tools provide an effective manner to identify faults at an early stage so that they can be fixed before creating havoc at the time code is being released.

While on the other hand, dynamic analysis is done while the code is being executed on a processor. It can assist in detecting the error of the code interacts with other servers, services, or databases. Dynamic analysis can only find faults in the specific code excerpt instead of the complete codebase.

Why is Code Analysis Important?

Poor source code can lead to plenty of problems along with overworked days for the programmers. It often happens that the management ignores the analysis of code, resulting in long-lasting negative effects on the development process.

If left unchecked, then the issues a programmer can face entails:

• Difficulty in adding new features while disrupting the existing ones
• Prolonged updates, missed deadlines, and low productivity due to bug fixes
• While onboarding a new developer, the complexity of the code makes it difficult to understand the functionality of the project
• It can also lead to compatibility issues with different operating systems and devices
• Gains vulnerabilities
• Poor documentation

So what can a programmer do to avoid such issues? Let’s check it out!

Top 10 Best Static Code Analysis Tools For Java Programmers

Here is the list of top 10 Static Code Analysis Tools For Java Programmers

1. Checkstyle

Checkstyle is a tool that is used to check Java Source Code for Code standard or validation rules affirmation. It automates the Java code analysis process. Moreover, it is profoundly configurable and can support nearly every coding standard. Checkstyle will help you in detecting class design problems, formatting issues, and method design problems while checking code layout as well.

The standard checks for Checkstyle can be applied to general Java code with no need for external libraries. It is directly applicable to source code. You can access the standard check from Checkstyle, which is written in alphabetical order for ease of navigation.

2. Error Prone

Error Prone is a tool for code analysis in Java that catches common errors at compile time. It hooks into the standard build, instantly shows the mistakes, and displays recommended fixes to enable enhanced productivity. You can enforce an automatic bug checker by writing a bug checker. Here is the basic skeleton code that will help you understand the working of Error Prone.

3. Infer

Infer is another useful static analysis tool for code in java but can also be used in C, C++, or Objective-C. It can be used to deflect bugs from reaching the end-users. With the assistance of Infer, one can easily prevent bad performance or crashes. In Java codes, infer identifies resource leaks, missing lock guards, null pointer exceptions, and annotation reachability. You can get the complete guidelines on getting started with detecting errors or faults from Infer.

4. jQAssistant

jQAssistant enables the validation and definition of project-based rules on the architectural level. Built upon Neo4j, it can be rammed into the build process to automatically detect the violation constraints while creating reports about user-defined metrics and concepts.

It validates the module dependencies of the project, detects usual problems like tests with no assertions, and separate API & implementation packages. If you want to learn more about jQAssistant or want the on-point tutorials, then you need to check jQAssistant’s site as soon as possible.

5. NullAway

As the name suggests, NullAway is a tool that will enable you to eliminate Null Pointer Exceptions from your code in Java. To use this tool, you will have to add @Nullable annotation wherever a method parameter or return value in your code may become null. It’s fast and can run every build of code. You can check the build configuration from Github.

6. PMD

A source code analyzer, PMD detects programming errors that are common including empty catch blocks, unused variables, unused project creation, and so on. Alongside Java, it supports JavaScript, PLSQL, XML, Salesforce Apex and VisualForce, XSL, and Apache velocity. PMD is available as a zip archive, which has both PMD and CPD. After downloading, you can unzip it into the directory you want. To learn how to install PMD in detail then check out PMD Java’s documentation.

7. SonarJava

Sonar Source’s is a static code analysis tool for Java that uses highly advanced techniques like dataflow analysis and pattern matching for analyzing source code to detect bugs, vulnerabilities, and code smells. It has a significant coverage of quality standards that are well-established. It also supports custom-written rules in Java. Whether you are using it in Sonar Lint (IntelliJ, Eclipse, VS Code), Sonar Cloud, or SonarQube, you can automate the code analysis through the codes mentioned in SonarSource.

8. Sourcetrail

Sourcetrail is yet another static code analysis tool for Java codes that offers an overview of all relevant dependencies and errors. Its in-depth static code analysis searches all the references and definitions available in the source files. It comes with a search field that can help you in finding any symbol within the codebase with a few keystrokes. Sourcetrail will help you in understanding the accurate way to index your source code with its analyzer.

9. Spoon

Spoon has also made its place in the list of best static code analysis tools for Java as it’s an open-source library that guides you in analyzing, transforming, rewriting, and transpiling Java Source code. It completely backs advanced Java versions like Java 11, 12, 13, and 14. With the parsing of source code, it develops an enhanced Abstract Syntax Tree (AST) having powerful API and analysis capabilities. You can learn the core concepts and their basics from Spoon easily.

10. Spotbugs

Spotbugs is an inheritor of Findbugs that carries the point which was missing before. It is a static code analysis tool for Java code that looks into bugs for better work efficiency. It can spot up to 400 bug patterns and can be used through different integrations. For more information on the method in which Spotbugs can be configured or built, check Github.

In a nutshell, these tools can guide programmers in their journey of developing software, web-application, or website with ease. By saving time spent on fixing the entire code, these tools increase productivity. The tools that have been recommended here are based on a few past experiences and preferences. So, the tools you choose must be according to the amount of testing and requirements of the project on which you are working. check for java assignment help.

If at any point you feel the need for guidance during code analysis, do not hesitate to reach out or leave a comment below.

Источник