On language-agnostic abstract-syntax trees
Jacob Curtis · Proceedings of the 37th ACM/SIGAPP Symposium on Applied Computing · 2022
As modern software systems have grown in complexity and heterogeneity, static code analysis of these systems has become more difficult. Due to increasing heterogeneity of software systems and static analysis tools being language specific, multiple of these tools are typically required to fully analyze these systems. Due to this, current tools for static code analysis are no longer well-suited to analyzing these modern systems. This paper presents an approach to solving the problem of needing multiple language-specific static analysis tools to fully perform static code analysis of such systems. This can be done by converting the software system's source code into an intermediate representation or abstraction known as a Langage-Agnostic Abstract-Syntax Tree. This abstraction provides a common interface for static analysis tools to operate with, no longer requiring the usage of multiple language-specific static analysis tools for a given heterogeneous system. The methodology for creating such an abstraction is presented here, along with an evaluation of two microservice system testbeds, DeathStarBench and TrainTicket, written in C++ and Java, respectively. By utilizing a higher abstraction for source code representations, we are much better prepared to perform static code analysis of modern software systems.