An Improved Method of Static Code Analysis Based on the Context-Sensitive Rules
Sepideh Mohajer Naraghi, Mir Ali Seyyedi · Majlesi journal of energy management/Majlesi journal of mechatronic systems · 2019
One of the static test methods is the static code analysis, which is used for analyzing the source code by specific tools, without running the code. This method tries to detect possible code vulnerabilities by different techniques including data analysis and flow analysis. Static code analysis contains limitations, one of which is the vulnerability report if it is not. This paper focus is on reducing these false reports, which have been dealt with in many ways. The proposed method is to have a list of code analysis rules and to examine for each context the rules in that context, as a result of which all the rules are not analyzed by the code analyzer. For instance, for security analysis, we just focus on security rules, not design or other rules. Therefore, the error messages are reduced by applying filters to the entire rules.