Questions tagged [static-analysis]

"Static Analysis" refers to the software tools (or their use) to analyze application code for arbitrary properties, such as errors (uninitialized variables, possible SQL injection-attack, is this code-dead, can an argument be null,...) or structure (what is the call graph for this code? is there duplicate code? what information is passed between components?).

Filter by
Sorted by
Tagged with
1 vote
0 answers
13 views

CodeChecker Warning: file contents changed or missing since the latest analysis

I executed locally a static analysis using Codechecker. Now I want to store the results (generated in the reports folder) in CodeChecker database using the command CodeChecker store ./reports --name ...
Roberto's user avatar
  • 21
-1 votes
0 answers
22 views

python's ruff linter not detecting mistake [closed]

I'm using ruff for python. this is my code: def func(b): print(b) func(1,2,3,4) yet ruff doesnt highlight that there are too many arguments in func call. any idea on how to fix?
kukelia's user avatar
  • 83
-4 votes
0 answers
27 views

I need help in Analyze A/B Test Results [closed]

Hello I been taking a Statistics for Data Analysis in which I'm making my final proyect but in the point of EXPERIMENT I really dont understand how to make it special in the point E) and G) github ...
user22201196's user avatar
-2 votes
0 answers
34 views

How/Where can I find open sourced project which uses the majority/most of C11 standard's new features? [closed]

I am learning on static code analysis, but have been struggling to find such real world projects that would be decent test cases for C11 features. Current GitHub filters and search prompts do not give ...
Liu Wescer's user avatar
0 votes
1 answer
59 views

F-statistic formula for Multiple Linear Regression

Can anyone help explaining step by step the following formula in the context of linear regression, in order to compare against the null function: E{(TSS − RSS)/p} = σ^2 p: number of predictors In ...
Federico's user avatar
  • 185
0 votes
0 answers
24 views

Ban uses of error() method call with detekt

I wish to ban the uses of error() method. My goal is to Ban the use of Generic exception. I can use rule TooGenericExceptionThrown if the code throws the error explicitly. However, when folks use ...
pr4bh4sh's user avatar
  • 664
1 vote
0 answers
15 views

TypeScript says type has no call signatures despite asserting typeof === "function" [duplicate]

I have a type that looks like this: type Config<T, U> = { A: T | (() => T); B: U | (() => U); } with the goal being to allow a user to provide either a value, or a function returning ...
JMA's user avatar
  • 344
2 votes
1 answer
48 views

How to demangle a function name generated by opt with LLVM's c++filt and how to omit some intermediate nodes?

I am reading this answer to generate a well-look call graph with clang++-13 and opt-13 ❯ clang++-13 --version Homebrew clang version 13.0.1 Target: x86_64-apple-darwin22.5.0 Thread model: posix ...
LiuYuan's user avatar
  • 194
-2 votes
0 answers
40 views

Parsing part of Java code without executing it, is there a way other then statically analysing it

I have a large scale non-compiled project developed using Java and its frameworks like Spring and Spring Boot. This project has database interaction point like JDBC's connection.prepareStatement(sql). ...
Arsalan Siddiq's user avatar
0 votes
0 answers
18 views

Configure SQL linter casing depending on keyword

Is it possible to configure SQLFluff to make some keywords upper case and other lower case? upper case: SELECT, FROM, JOIN lower case: as, on, case, when, else, end The following snippet should be ...
VV5198722's user avatar
  • 374
0 votes
0 answers
61 views

release_handle - detect double release

I'm trying to get a handle (du-dum-tsh) on clang's acquire_handle and release_handle attributes. I've written int create_foo(void) __attribute__((acquire_handle("foo"))); void destroy_foo(...
Daniel Walker's user avatar
7 votes
1 answer
168 views

malloc attribute takes no arguments

I've created a pair of functions: void destroy_foo(void *ptr); void *create_foo(void); As the names suggest, these function akin to malloc and free. I'd like to use the malloc gcc function attribute ...
Daniel Walker's user avatar
1 vote
1 answer
47 views

Problem estimating Qt Slot as Error in Cppcheck Analysis

While performing static analysis with Cppcheck, the corresponding error message was printed in the slots part, but I don't know how to solve this part. Can you help me? err_msg : There is an unknown ...
Jin's user avatar
  • 13
2 votes
0 answers
33 views

Linting with splint: Preprocessor behaves different from compiler

I'm trying to lint C code with splint. However, I'm including the standard lua.h header file, which does some preprocessing to set internal types. GCC and splint take different paths. I've narrowed ...
pschulz's user avatar
  • 1,406
0 votes
0 answers
34 views

dotnet Code Analysis ignoring certain entries in .editorconfig file

In a test project I am trying to ignore certain Code Analysis warnings, but I am struggling to understand what I am missing. I have a simple dotnet6.0 console app with the following structure. Project ...
William James's user avatar
0 votes
0 answers
14 views

Is the summary-based interprocedural analysis method context-sensitive

int foo(int x, int y, int *z) { *z = 2; return x + y; } for function foo, I will get a symbolic summary: input symbol: x, y return value: x + y side effect: *z -> 2 and when I apply this ...
Junjie Shen's user avatar
1 vote
1 answer
632 views

Static Analysis Failed. Error Details: PMD Command Failed! Enable "Show StdErr" setting for more info

I have installed APEX PMD extension in vscode. I have added C:\Program Files\Java\jre1.8.0_202\bin\java to Sys env Path variable. I have downloaded pmd-bin-7.0.0-rc3 and added C:\pmd-bin-7.0.0-rc3\...
maverick's user avatar
0 votes
1 answer
20 views

How to solve a problem with a DocblockTypeContradiction in Psalm

I have the simplified code example from my library, to which psalm, for reasons I don't understand, outputs warnings. class Example { public const C_1 = 'val1'; public const C_2 = 'val2'; ...
XYZ's user avatar
  • 155
0 votes
0 answers
24 views

Integrating Custom build of clang-tidy in CodeChecker

I successfully installed CodeChecker (https://codechecker.readthedocs.io/en/latest/#install-guide). The check and analyze commands that CodeChecker provided work on my input files. Now, my task is to ...
Nachiket Deo's user avatar
1 vote
0 answers
47 views

Why isn't CLion checking for MISRA?

I want to run the MISRA checks on my code and when I click "Inspect Code" it shows only Clang-Tidy even though I have checked the MISRA setting in the Inspections menu. Inspections menu And ...
I4mbut4mI's user avatar
0 votes
0 answers
9 views

Is there some way to point Visual Studio Code's class Intellisense to prebuilt jars

I am currently working on a large code base that involves automatically generated code. In the code base we use these automatically generated classes and functions. However, VS code doesn't know these ...
LSR's user avatar
  • 35
1 vote
2 answers
77 views

How to solve " Controlling expression is not an 'essentially Boolean' expression " in MISRA code?

I have a simple macro function which will check the condition and return an Boolean value. Below is the snippet of code assume: #define boolean bool Test.h file #define CHECK_STATE(X) (...
user2986042's user avatar
  • 1,098
1 vote
0 answers
47 views

Callstack aware Variable Liveness Analysis

Problem I have a system (basically an interpreter) with a global table of identifiers pointing to resources. I am trying to perform liveness analysis for these resources on the basic blocks of ...
ChrisB's user avatar
  • 1,688
0 votes
0 answers
12 views

ADFORM + GA4 - statistics differences

I have a problem where my stats between Adform RTB plafotm and new GA4 disappear. Differences (depending on the day) oscillate in between the range of 40-50%. I'm trying to locate the source of the ...
meeshiura's user avatar
0 votes
1 answer
17 views

additional TaintStep for taint tracking in python programs

I am using codeql TaintTracking and I noticed by default it does not follow data for functions it doesn't know. for exapmple for this code: import pd a = src + anything df = pd.DataFrame(a) if src ...
Atlantis's user avatar
  • 592
0 votes
0 answers
27 views

Suppress Code Analysis message CA1704 for HbA1c, Multi, Num, Exp using CustomDictionary.xml

I use CustomDictionary.xml to Suppress Code Analysis warning CA1704. This works in almost all cases except for few like below 'Exp' in type name '...
Srikanth's user avatar
  • 978
2 votes
0 answers
23 views

Bearer detects CWE-693 even after disabling x-powered-by header

Upon running the below command for a node.js project bearer scan . bearer detects LOW: Security misconfiguration detected. [CWE-693] vulnerability. After using this and this article as reference, I ...
Abhinav Pathak's user avatar
0 votes
0 answers
22 views

How to generate the Microsoft code analysis xml file in a Visual C++ project?

I have created c++ project from visual studio 2019 and ran below syntax from command prompt. But log file was not generated. How to generate the Microsoft code analysis xml file in a Visual C++ ...
Chaya's user avatar
  • 137
0 votes
1 answer
32 views

programs that can't run parallely

I am building a python program to initiates the same program (benchmark_program in this example) with different parameters and then examine the results. To improve efficiency I invoke several ...
Rahn's user avatar
  • 4,783
0 votes
1 answer
51 views

Getting seemingly useless "performance-inefficient-string-concatenation" warning with clang-tidy

In my C++ app I'm concatenating a few strings using the + operator as follows in a reproducible example: #include <string> #include <curlpp/Easy.hpp> #include <curlpp/Options.hpp> #...
BullyWiiPlaza's user avatar
5 votes
0 answers
118 views

How can I find math operations that would be optimized by `-ffast-math`?

The -ffast-math C++ compiler option allows the compiler to perform more math optimizations that may slightly change behavior. For example, x * 10 / 10 should cancel but due to the possibility of ...
Aaron Franke's user avatar
  • 3,288
-1 votes
1 answer
160 views

Is SonarQube the only open source SAST tool

I want to implement SAST on our CICD pipeline and I can't find opensource SAST tools except sonarqube. Is there any alternative tools to sonarqube? I just want to explore other tools but can't find ...
Syed ayaz's user avatar
0 votes
0 answers
90 views

Is it possible to construct a Data Flow Graph DIRECTLY from an AST of a program?

I'm trying to perform static taint analysis on multiple programming languages, and was trying to find out if it's possible to construct a Data Flow Graph (DFG) from an Abstract Syntax Tree (AST) ...
George's user avatar
  • 1
0 votes
0 answers
47 views

Issue with Fortify SCA scanning multiple GitHub repositories at the same time

I'm running into an issue where if I specify a folder path containing multiple GitHub repos for Fortify SCA (23.1) to scan, it'll run the analysis slowly but never generate an FPR file at the end of ...
murkywaters's user avatar
1 vote
1 answer
180 views

Android Studio lint warns of missing permissions that are not required at my target API level

I'm doing some work on an internal, legacy Android app. The target SDK version is set to 28 in the Gradle build file, and the compile SDK version is set to 33. The issue I face is that Android Studio ...
E_Cross's user avatar
  • 21
1 vote
1 answer
126 views

How to tell PHP static code analysers to read the generic type hint from a callable, instead of expecting the class name as a string?

I'm trying to remove some code duplication that has proven to be prone to human errors. I created a working sample code at https://3v4l.org/QFA6m#v8.2.7 and a demo of PHPStan failing where expected, ...
Jan Klan's user avatar
  • 677
0 votes
0 answers
41 views

How to make Pycharm raise warning for setting non existing attributes

In Pycharm, I get the following warning when I get a field that does not exists in a class. However, no warning when a field set. xyz class Foo: def __init__(self, bar): self.bar = bar ...
TSR's user avatar
  • 17.4k
0 votes
1 answer
82 views

Checkov - creating a basic custom policy to ensure that an annotation is set on a Kubernetes Deployment

I've been looking at checkov to see if it can flag up if any Kubernetes Deployments which are missing the annotation kubectl.kubernetes.io/default-container. I cannot seem to get this to work. It ...
Scottm's user avatar
  • 7,004
2 votes
1 answer
87 views

Mypy complains correct protocol implementation as invalid return type

attached is a minimal implementation to which I cannot figure out the error message from mypy and would like to know if any of you have an idea or experience on how I can convince mypy that the return ...
Zap's user avatar
  • 81
0 votes
0 answers
57 views

PhanEnumCannotImplement - Interface not allowed to extend BackedEnum interface

I am creating an interface SurveyAnswer that extends BackedEnum. I am extending BackedEnum to make sure that the enums that are created are backed. interface SurveyAnswerInterface extends BackedEnum { ...
Milan Maharjan's user avatar
4 votes
1 answer
135 views

How can I get clang-tidy to not complain about passing kind-of-lightweight types by value?

CLion (2023.1.2) is running clang-tidy v17 on a project of mine. It's complaining about me passing an std::experimental::optional (from C++14) by value instead of by reference. That seems egregious to ...
einpoklum's user avatar
  • 119k
0 votes
1 answer
159 views

Does PhpStan and Psalm measures cyclomatic complexity?

I've read the documentation from PhpStan and Psalm, and i couldn't find the rules where it checks the Cyclomatic Complexity like Phpmd does here Also, is it possible to cusomise rules within levels ...
Mali C.'s user avatar
  • 11
1 vote
0 answers
76 views

Lint check for assignments to a range element field

A common Go programming error we've seen is: for _, item := range items { item.SomeField = value // oops } As range copies the value, assigning to the struct field effectively does nothing. The ...
TrueWill's user avatar
  • 25.2k
0 votes
0 answers
23 views

What could be the fix for Calling a method on null object base.Request.Headers issue?

Some static code analysis tool giving error for below code where I am trying to access the ControllerBase.Request method and it's saying trying to access a method of null object t base.Request.Headers....
user584018's user avatar
  • 10.2k
0 votes
0 answers
50 views

clang-tidy false positive: stddef.h size_t

On Windows 11 with vscode and the ESP-IDF plugin compiling with riscv32-esp-elf/esp-2022r1-11.2.0/riscv32-esp-elf/bin/riscv32-esp-elf-gcc.exe, if settings.json has "C_Cpp.codeAnalysis....
Reinderien's user avatar
  • 11.9k
0 votes
1 answer
117 views

Is it possible to run Slither without Hardhat?

I have a Foundry project, and I prefer to not install Hardhat. Would it be possible to run Slither as specified in the Foundry Book? Currently, if I run at the root folder of my Foundry project: ...
gagiuntoli's user avatar
2 votes
1 answer
57 views

Defining hardware "storage" for processing by Frama-C EVA

The general structure of the headers for STM32 peripherals inside CMSIS, typedef struct { __IO uint32 REGn; // ... } SOC_PER_TypeDef; #define SOC_PER_BASE 0x40003000 #define ...
artless noise's user avatar
0 votes
1 answer
38 views

Static type of Future<T> in classes not working | Dart

I want to make a Class in Dart with a static type of Future<T>. Because I want to implement its Call-Function async with type T, so I can call it like this: MyFunction<T> func = MyFunction&...
mathisxy's user avatar
0 votes
0 answers
44 views

How can I find all ASP.NET endpoints that could be affected by a code change

I'm currently working on a large messy codebase that is not unit tested very well, and I have had to make a small change to a method that will potentially impact a number of API endpoints. I've done ...
Dan Marshall's user avatar
1 vote
1 answer
55 views

Python linter with variables in conditional code block

Consider the following code: testvar: bool = True if testvar: foo: str = '' # Statements that do not affect value of testvar if testvar: bar: str = foo Any linter I've tried will complain ...
Nikša Baldun's user avatar

1
2 3 4 5
44