DIY: Analyse statique en Java par Nicolas Peru et Michael Gumowski Trouver des bugs dans votre code java sans avoir à l’exécuter ? C'est possible. Découvrez de quelle manière l'analyse statique est un moyen de trouver des bugs en comprenant le fonctionnement de l'analyseur Java de SonarQube. Quelles sont les difficultés pour comprendre le langage Java ? Qu'est-ce que l'analyse syntaxique, l'analyse sémantique et l’exécution symbolique ? Et comment, en se basant sur le code source, il est possible de trouver des problèmes dans votre code sans avoir à l’exécuter ? Répondre à toutes ces questions vous permettra d'écrire vos propres règles d'analyse statique !

1. GenevaJug
#sonarqube
DIY:
Java Static Analysis
Nicolas PERU - @benzonico
Michael GUMOWSKI - @m-g-sonar

2. Ego boost
● Nicolas PERU - @benzonico
○ Java developer@SonarSource
○ Developer in language team
○ Lead of sonar java plugin
○ Geneva Jug enthusiast
● Michael GUMOWSKI
○ Java developer@SonarSource
○ Developer in language team
○ Run half marathon in 1h24

3. Static Analysis
Analyze code,
without executing it.

4. ● Back Story
Sonar Java Plugin

5. Challenge
Get the language.

7. Lexical Analysis
Only two things are infinite, the universe and human
stupidity, and I am not sure about the former.

8. Syntactic Analysis
Only two things are infinite, the universe and human
stupidity, and I am not sure about the former.
Albert E.
Subjects Verbs

9. Lexical Analysis
class A {
int b;
}

10. Syntactic Analysis
class A {
int b;
}
Keywords
Identifiers
punctuators

11. Syntax Tree
+
3
21
+
1 + 2 + 3
interface BinaryExpressionTree {
ExpressionTree leftOperand();
SyntaxToken operatorToken();
ExpressionTree rightOperand();
}

12. Java pop quizz !!
[ ]

13. [ ] ) [ ] [ ] {

14. int[ ] foo(int a[ ] ) [ ] [ ] {
return null;
}

15. int[ ] foo(int a[ ] ) [ ] [ ] {
return null;
}

16. int[ ][ ][ ] foo(int[ ] a) {
return null;
}

17. Semantic Analysis
Only two things are infinite, the universe and human
stupidity, and I am not sure about the former.
Albert E.

18. Semantic Analysis
Only two things are infinite, the universe and human
stupidity, and I am not sure about the former.
Albert E.

19. Semantic Analysis
class A {
int b;
A(int b) {
this.b = b;
}
}

20. Java pop quizz !!
class Foo<T> {
class T {
}
T myField;
}

21. Java pop quizz !!
class Foo<T> {
class T {
}
T myField;
}

22. How do you know that ?
JLS is your best friend
http://docs.oracle.com/javase/specs/jls/se8/html/index.html

23. Java pop quizz !!
interface F1 {
}
interface F2 {
}

24. Java pop quizz !!
class A<T extends F1 &
F2>{
void fun(F1 f1){}
void fun(T t){}
}

25. Java pop quizz !!
class A<T extends F2 &
F1>{
void fun(F1 f1){}
void fun(T t){}
}

26. Java pop quizz !!
The erasure of a type
variable is the erasure of
its leftmost bound.

27. How do you know that ?
JLS is your best friend
http://docs.oracle.com/javase/specs/jls/se8/html/index.html

28. Your turn now : Custom rules !

29. Beyond semantic : Symbolic Execution
Object myObject = new Object();
if(a) { myObject = null; }
...
if( !a ) { ... }
else { myObject.toString(); } //NPE

30. Symbolic Execution
Object myObject = new Object();
if(a) { myObject = null; }
...
if( !a ) { … }
else { myObject.toString(); } //NPE
Program State#0
myObject != null

31. Symbolic Execution
Object myObject = new Object();
if(a) { myObject = null; }
...
if( !a ) { … }
else { myObject.toString(); } //NPE
Program State#0
myObject != null
Program State#1
myObject != null
a = false
Program State#2
myObject = null
a = true

32. Symbolic Execution
...
if( !a ) { … }
else {
myObject.toString(); // NPE
}
Program State#1
myObject != null
a = false
Program State#2
myObject = null
a = true
Program State#4
myObject = null
a = true
Program State#3
...

33. Symbolic Execution challenges
Complex flows : Try Catch Finally
try {
methodCall();
methodThrowingException();
} catch ( CustomException e) {
...
}finally {
...
}

34. Symbolic Execution challenges
Complex conditions :
if(a + 1 < (b* 10 - 39) ) {
if( b > a/10 + 4 ) { … } // Always true
}

35. Symbolic Execution challenges
Explosion of states :
if(a) {...} else {...}
if(b) {...} else {...}
if(c) {...} else {...}
instruction; //evaluated by 8 states.

36. Uhoh ?!
From apache vysper:
https://nemo.sonarqube.org/issues/search#issues=AVJ9P2Bzm66gr6MLNW_j

37. Uhoh ?!
From elastic search:
https://nemo.sonarqube.org/issues/search#issues=AVJ9mFy_m66gr6MLNXpJ

38. Reach us
sonarqube@googlegroups.com
https://groups.google.com/forum/#!forum/sonarqube

39. sonarsource
jobs@sonarsource.com

40. Q & A