靜態(tài)代碼分析中可能存在的10大錯誤

Top10UserMistakes

withStaticAnalysisSateIVMarch2012ParasoftProprietaryandConfidentialAboutParasoftFoundedin198727+PatentsforautomatedqualityprocessesBuildqualityintotheprocessStaticAnalysistoolssince1994WhatISStaticAnalysis?VarietyofmethodsPeerReview/ManualCodeReview/CodeInspectionPattern-basedcodescannersFlow-basedcodescannersMetrics-basedcodescannersCompiler/buildoutputParasoftProprietaryandConfidentialNumber10:Developers10)DevelopersnotincludedinprocessevolutionDeveloperInsightsRules/IssuesdriveneedWorkflowUsabilityCorrectness/NoiseWillourengineersreallyadoptitanduseit?Isthisalong-termsolution?ParasoftProprietaryandConfidentialCodeAnalysisPerceptions“Staticanalysisisapain”FalsepositiveshasvaryingdefinitionsIdon’tlikeitItwaswrongParasoftProprietaryandConfidentialPatternbasedfalsepositivesTruefalsepositivesgenerallyruledeficiencyContextDoesthisapplyhereandnow?In-codesuppressionstodocumentdecisionParasoftProprietaryandConfidentialFlowAnalysisFalsePositivesFalsepositivesareinevitableFindsrealbugsFlowanalysisisnotcomprehensiveParasoftProprietaryandConfidentialNumber9:Expectations9)

WrongexpectationsWhydostaticanalysis?Becauseit’stherightthing?Increasequality?Decreasecosts?Reducedevelopmenttime?FlowanalysisisenoughWhenwillitpay-off?HowcanItellit’spayingoff?ParasoftProprietaryandConfidentialNumber8:Approach8)

TakinganauditapproachRunningSAonallyourcode(Don’t)It’sallaboutthereports(Orisit?)ParasoftProprietaryandConfidentialNumber7:TooMuch7)

StartingwithtoomanyrulesStaticAnalysisisaboutprocessIt’sincrementalAvoidbitingoffmorethanyoucanchewAvoidanyruleyouwon’tstopthebuildforParasoftProprietaryandConfidentialDon’tGetRunOverSamesetofrulesforeveryoneSmallsetofrulesLessrulesthatarefollowedisbetterthanmorethatarenotIfyouwouldn’tfixit,don’tcheckforitParasoftProprietaryandConfidentialNumber6:Workflow6)

WorkflowintegrationHastoworkwithyourdevelopmentUISameconfigurationfordesktopandserverMinimizenegativeimpactMinimizetimetofind/fixviolationsParasoftProprietaryandConfidentialParasoftProprietaryandConfidentialResultswithinIDE1ResultsdeliveredasuniformviewwithinIDE2Directlyaccesslineofcodetofix3Check-inNumber5:Training5)

LackofsufficienttrainingHowtoinstallthetoolHowtoconfigurethetoolHowtosetupthebuildHowtorunthetoolHowtomitigateviolationsHow/whentosuppressParasoftProprietaryandConfidentialNumber4:Process4)

NodefinedprocessDevelopersarenotnecessarilyprocessexpertsProcessshouldminimizeimpactofSAConsistentforteamsandprojectsVettedinapilotprojectParasoftProprietaryandConfidentialNumber3:Automation3)

NoautomatedprocessenforcementReduceeffortConsistencyComplianceParasoftProprietaryandConfidentialNumber2:Policy2)

LackofaclearpolicyWhatteamsneedtodoSA?WhatprojectsrequireSA?Whatrulesarerequired?Whatamountofcompliance?Whencanyousuppress?Howtohandlelegacycode?DoyoushipwithSAviolations?ParasoftProprietaryandConfidentialNumber1:Management1)

Lackofmanagementbuy-inRequirementsAllowedtimeUnderstandingoftheROIEnforcementParasoftProprietaryandConfidentialTheWholeTop1010)Developersnotincludedinprocessevolution9)

Wrongexpectations8)

Takinganauditapproach7)

Startingwithtoomanyrules6)

Workflowintegration5)

Lackofsufficienttraining4)

Nodefinedprocess3)

Noautomatedprocessenforcement2)

Lackofaclearpolicy1)

Lackofmanagementbuy-inParasoftProprietaryandConfidentialHonorableMention:TheWrongStuffWrongToolWrongProcessEmailreportsBlockingPainfulCIworkflowWrongRulesUnimportantrulesToomanyrulesWrongCodeLegacystrategyDon’ttestwhatyouwon’t/can’tchangeParasoftProprietaryandConfidentialHonorableMention:What’sLackingLackofmanagementbuy-inTheedictAllowedtime&budgetLackofdevelopmentbuy-inWillfulnon-complianceLackoftrainingParasoftProprietaryandConfidentialQ&A/FurtherReadingParasoftProprietaryandConfidentialAutomatedDefectPrevention

(Huizinga&Kolawa)

…Principlesandprocessestoimprovethesoftwaredevelopmentprocess.EffectiveC++/MoreEffectiveC++(Meyers)

…Definitive