Статический Анализ Кода | Sonar | Qodana | CodeQL

В этом видео мы разберёмся, что такое статический анализ кода, зачем он нужен и как он работает. Кратко посмотрим на историю появления компиляторов и эволюцию разных типов анализа, узнаем про фундаментальные проблемы статического анализа и увидим, как применять его на практике на примере SonarQube, Qodana и CodeQL. 💻 Project and branch: 👉 https://github.com/ivanovec/java-basics/tree/staticanalysis ⏱ Timestamps: 0:00 Introduction 1:00 Static analysis definition 1:30 Computers in 40s, tumblers 2:50 Punched cards, assembler 3:56 Lexical analysis 4:44 Syntax analysis 5:50 Labels, symbol table 7:11 Grace Hopper, System A0, first compiler (linker) 8:22 Fortran 1, transition rules 10:21 RPN stack, expression interpretation, intermediate representation, static checks 13:25 Algol, Parser, Chomsky Hierarchy (regular grammar, context-free grammar, context-dependent, type 0) 19:21 BNF, Algol grammar, parsing tree, symbol table, static checks 23:43 Pascal, Abstract Syntax Tree (AST), Semantic Analysis, Wirth/UCSD/Turbo, p-code, object code, frontend/backend division 26:38 Annotated AST, Java AST example, possible static checks, false positives, false negatives 29:35 Control Flow Graph (CFG), unreachable code, infinite loop 31:41 Data Flow Analysis (DFA), lattice 33:26 Constant Propagation, Live Variables, Available Expressions, Nullness, Dead Code 34:45 Taint Analysis 36:07 Analysis Sensitivities (Flow, Path, Context, Field, Object, Interprocedural) 39:28 Halting Problem, Problems with Loops, Live Variable Analysis 42:02 Gary Kildall and transfer functions, fixpoint 46:13 Interval Analysis, Abstract Interpretation, widening, narrowing, structural induction, abstract domains, Galois connection 49:59 Analysis evolution: local/global widening, guarding, rank functions 51:44 Symbolic execution, SAT solvers 55:31 Other analysis techniques (model checking, CEGAR, ML, MCP) 57:33 Lint 59:00 Sonar architecture, analysis with Sonar plugin for IDEA on java-basics project 1:01:30 Sonar Cloud, import GitHub project, cloud report overview, profile, Quality Gate, Rules 1:04:52 Sonar Scanner configuration, token, sonar.properties, docker run 1:07:05 Analysis results 1:08:53 Test Set for Static Analysis 1:14:09 Sonar Scanner results for Test Set 1:16:08 Huge Class Fun 1:17:25 IntelliJ IDEA inspections, structural search 1:18:19 Global/local inspections, project model loading, indexing, PSI, RefGraph 1:20:53 Qodana architecture 1:22:51 IDEA plugin, local analysis, qodana.yaml, baseline 1:24:54 Analysis of java-basics project, standalone report, cloud report 1:28:09 Using profiles 1:29:03 Qodana results for Test Set 1:29:45 Qodana security plugin 1:30:42 Continue of Qodana results for Test Set, Qodana CLI, create organization, get token 1:34:09 Flexinspect, Kotlin, first local inspection for index out of bounds exception 1:38:16 Second implementation of inspection for index out of bounds exception 1:41:38 Third implementation of inspection for index out of bounds exception 1:42:40 Final implementation of inspection for index out of bounds exception 1:49:41 Implementation of global inspection for NullPointerException with respect to interprocedural calls 1:53:36 CI pipelines, GitHub Actions 1:54:48 CodeQL architecture, configuring analysis 1:57:20 Create custom QL query for index out of bounds exception #simpleautomation #qa #staticanalysis #compilerdesign #sonar #qodana #codeql #java #softwareengineering #lint #codeanalysis