static analysis (static code analysis)

How is static analysis done?

The static analysis process is relatively simple, as long as it's automated. Generally, static analysis occurs before software testing in early development. In the DevOps development practice, it will occur in the create phases.

Once the code is written, a static code analyzer should be run to look over the code. It will check against defined coding rules from standards or custom predefined rules. Once the code is run through the static code analyzer, the analyzer will have identified whether or not the code complies with the set rules. It is sometimes possible for the software to flag false positives, so it is important for someone to go through and dismiss any. Once false positives are waived, developers can begin to fix any apparent mistakes, generally starting from the most critical ones. Once the code issues are resolved, the code can move on to testing through execution.

Without having code testing tools, static analysis will take a lot of work, since humans will have to review the code and figure out how it will behave in runtime environments. Therefore, it's a good idea to find a tool that automates the process. Getting rid of any lengthy processes will make for a more efficient work environment.

Types of static analysis

There are several static analysis methods an organization could use, which include:

• Control analysis -- focuses on the control flow in a calling structure. For example, a control flow could be a process, function, method or in a subroutine.
• Data analysis -- makes sure defined data is properly used while also making sure data objects are properly operating.
• Fault/failure analysis -- analyzes faults and failures in model components.
• Interface analysis -- verifies simulations to check the code and makes sure the interface fits into the model and simulation.

In a broader sense, with less official categorization, static analysis can be broken into formal, cosmetic, design properties, error checking and predictive categories. Formal meaning if the code is correct; cosmetic meaning if the code syncs up with style standards; design properties meaning the level of complexities; error checking which looks for code violations; and predictive, which asks how code will behave when run.

This image shows some of the objectives within static analysis.

Benefits and drawbacks of static analysis

Benefits of using static analysis include:

• It can evaluate all the code in an application, increasing code quality.
• It provides speed in using automated tools compared to manual code review
• Paired with normal testing methods, static testing allows for more depth into debugging code.
• Automated tools are less prone to human error.
• It will increase the likelihood of finding vulnerabilities in the code, increasing web or application security.
• It can be done in an offline development environment.

However, static analysis comes with some drawbacks. For example, organizations should stay aware of the following:

• False positives can be detected.
• A tool might not indicate what the defect is if there is a defect in the code.
• Not all coding rules can always be followed, like rules that need external documentation.
• Static analysis may take more time than comparable methods.
• Static analysis can't detect how a function will execute.
• System and third-party libraries may not be able to be analyzed.

Static verification vs. dynamic verification

The principal advantage of static analysis is the fact that it can reveal errors that do not manifest themselves until a disaster occurs weeks, months or years after release. Nevertheless, static analysis is only a first step in a comprehensive software quality-control regime. After static analysis has been done, Dynamic analysis is often performed in an effort to uncover subtle defects or vulnerabilities. In computer terminology, static means fixed, while dynamic means capable of action and/or change. Dynamic analysis involves the testing and evaluation of a program based on execution. Static and dynamic analysis, considered together, are sometimes referred to as glass-box testing.

Static analysis tools and vendors

There are plenty of static verification tools out there, so it can be confusing to pick the right one. Software tools will work at a variety of levels. Unit-level tools look at programs or subroutines. Technology-level tools will test between unit programs and a view of the overall program. System-level tools will analyze the interactions between unit programs. And mission-level tools will focus on mission layer terms, rules and processes. Before committing to a tool, an organization should also make sure that the tool supports the programming language they're using as well as the standards they want to comply with.

Embold is an example static analysis tool which claims to be an intelligent software analytics platform. The tool can automatically prioritize issues with code and give a clear visualization of it. The tool will also verify the correctness and accuracy of design patterns used in the code.

Kiuwan is another example of a static analyzer. It is a large platform that focuses on implementing static analysis in a DevOps environment. It features up to 4,000 updated rules based around 25 security standards. It also integrates well with Jenkins.

PyCharm is another example tool that is built for developers who work in Python with large code bases. The tool features code navigation, automatic refactoring as well as a set of other productivity tools.