Static code analysis method suitable for domestic embedded integrated development environment

Abstract

According to the static code analysis method suitable for the domestic embedded integrated development environment, a plug-in analysis tool formed through the method can greatly simplify the operation of a user during static code analysis, improve the visualization degree of an analysis result, help developers to quickly and accurately understand the analysis result, and improve the development efficiency. And the code quality improvement is further promoted.

Description

Technical Field

[0001] The present invention relates to the technical field of static code analysis, and in particular to a static code analysis method suitable for a domestic embedded integrated development environment. Background Art

[0002] As software development continues to deepen, code quality assurance becomes increasingly important. Static code analysis, as an effective technical means, can discover potential defects and security risks without executing the program. Among the many static analysis standards, the GJB 8114 standard is widely used in the defense field, focusing on the security and reliability of software. However, existing static code analysis tools often require users to perform complex configuration and secondary development during use to meet the requirements of specific standards, which limits the popularity of their application.

[0003] The static analysis tool Clang Static Analyzer can detect potential programming errors without running the code. It can detect potential memory leaks, null pointer applications, array out-of-bounds errors, and other errors.

[0004] CppCheck is an open source static code analysis tool that can help developers find vulnerabilities in the code, irregular code styles, etc. It can also be integrated with some IDEs.

[0005] Klocwork is a commercial static code analysis tool that provides not only visualization tools but also detailed reports to help teams track issues and code quality indicators.

[0006] like Figure 1 As shown, patent CN118796688A discloses a static code analysis method based on lexical and syntactic analysis, which aims to improve the development efficiency and security of PLC programs, parse the ST source program into a parse tree, and detect the lexical and syntactic errors of the program; construct an abstract syntax tree of the ST program based on the parse tree, and check the semantic errors of the program based on the abstract syntax tree analysis technology; construct a control flow graph based on the abstract syntax tree, and perform constraint collection, constraint solving and loop expansion operations based on symbolic execution technology and depth-first search traversal technology to detect the static constraints of the program.

[0007] Although there are some static code analysis tools on the market, most of them lack a friendly graphical interface, which makes it difficult for developers to view and understand the analysis results. Although some tools are powerful, their user interface design is complex, the learning curve is steep, and high professional knowledge is required for use. In addition, many tools cannot directly support the GJB8114 standard, and users must invest extra time and resources to configure and adapt, which increases development costs and time.

[0008] To address this problem, although some tools provide plug-in mechanisms, these plug-ins often cannot be seamlessly integrated into existing workflows, causing users to spend a lot of time configuring and debugging them. These shortcomings are mainly due to insufficient consideration of user needs when designing tools, as well as limited support for standards.

[0009] Clang Static Analyzer does not have an independent graphical interface and usually needs to be used in the command line, but it can be integrated with the IDE to provide certain graphical support. It does not support the GJB8114 standard and requires writing one or more plug-ins to extend its functionality.

[0010] CppCheck is mainly used in command line mode, lacks graphical interface support, does not support direct detection of GJB 8114 standard, and requires developers to write python plug-ins to support GJB8114 standard. Similarly, klocwork does not directly support GJB8114 standard, and the degree of customization is limited. Developers need to use klocwork's rule definition language or create XML files to describe these rules. In addition, klocwork's license fee and upgrade fee are high, and the control of license is relatively strict.

[0011] Patent CN118796688A provides a method, apparatus, device and storage medium for static code analysis in a standard ST language, which is mainly customized according to the IEC 61131-3 standard and does not provide support for the GJB8114 standard. Summary of the invention

[0012] The technical solution of the present invention aims to provide a plug-in form, directly support the GJB 8114 standard, and have a simple and easy-to-use graphical interface.

[0013] The technical solution of the present invention provides a static code analysis method suitable for a domestic embedded integrated development environment, comprising the following steps:

[0014] The GJB8114 rule set is built into the code static check module;

[0015] Create an AST matcher that matches the rule to be detected in the GJB8114 rule set and register it in the MatchFinder object;

[0016] In the embedded development environment, obtain variable declaration and function declaration nodes and use AST matcher to match them, check the validity of the nodes, and build multiple error messages;

[0017] Record multiple error messages to obtain diagnostic information and specify diagnostic types, obtain specific code locations corresponding to multiple error messages, and obtain warning information that violates the rules to be detected;

[0018] The user interaction and visualization module processes multiple error messages, specific code locations, and warning messages according to user instructions to obtain a code static analysis report in text form;

[0019] Use Java's Json parser to parse the Json nodes of the code static analysis report to obtain the current detection standard, current detection file, diagnostic information, error location, modification suggestions, violated detection standards, and information corresponding to the current detection rule set, and display them in the interface of the user interaction and visualization module.

[0020] Preferably, the code static checking module is built based on clang.

[0021] Preferably, the rule to be detected is the GJB8114-R-1-1-17 rule, which prohibits the function body from using external declarations.

[0022] Preferably, the external declaration includes function external declaration and variable external declaration. For variable declaration in function declaration, it is determined whether it is an external declaration, and an error is reported if it is. If a function is declared in a function, the compiler reports an error, unless it is an externally declared function, and an error is reported if a function declaration appears inside a function.

[0023] Preferably, the interface is extended using the view in the Eclipse system and is written using the Table of SWT.

[0024] The technical solution of the present invention proposes a static code analysis method suitable for a domestic embedded integrated development environment and customized for the GJB8114 standard. The plug-in analysis tool formed by this method will greatly simplify the user's operation when performing static code analysis, improve the visualization of the analysis results, help developers quickly and accurately understand the analysis results, and further promote the improvement of code quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A device for static code analysis of the IEC61131-3 standard ST language in the prior art;

[0026] Figure 2 A flowchart of the integration part of a static code analysis method suitable for a domestic embedded integrated development environment provided by an embodiment of the present invention;

[0027] Figure 3 A static code analysis report provided for an embodiment of the present invention;

[0028] Figure 4 A flowchart of a static code analysis method suitable for a domestic embedded integrated development environment is provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0030] The embodiments of the present invention include the following key processes and technical methods:

[0031] 1. Code static inspection module

[0032] The code static check module is built based on clang, performs static checks according to the rule set, and supports the GJB8114 rule set.

[0033] AST (Abstract Syntax Tree) is a tree representation of the syntax structure of a programming language and is an important tool for static code analysis. In the embodiment of the present invention, the following steps are required to detect specific rules in the GJB8114 rule set:

[0034] 1. Register the matcher. Use Clang's AST Matchers to define the code pattern to be detected. First, define the matching conditions, create matchers related to specific rules, and then register the defined matchers so that they can be matched when traversing the AST.

[0035] 2. Implement the check logic. After obtaining the matching variable declaration and function declaration nodes, check the validity of the nodes to ensure the safety of subsequent traversal.

[0036] 3. Trigger diagnosis. After building the error information, record the diagnostic information, obtain the specific code location, and determine whether it is an error type or a warning type.

[0037] 2. User Interaction and Visualization Module

[0038] 1. Compile the project in cygwin to get the executable file and dependent libraries. You can perform batch detection of the code by writing scripts. And output the code static analysis results in text form.

[0039] 2. Design and implement a user-friendly visual interface to graphically display the text-based code static analysis report. The visual interface will provide information about the current detection standard, current detection file, diagnostic information, error location, modification suggestions, violated detection standards, and the current detection rule set. At the same time, a text-based code static analysis report will be generated for viewing under the project.

[0040] 3. Plugin development and IDE integration

[0041] 1. Use eclipse for development, use the view extension in the Eclipse system for the interface, and use SWT's Table to write the display interface.

[0042] 2. It is integrated into Ruihua embedded integrated development environment ReDe in the form of a plug-in. As a static code analysis tool, users can select the GJB8114 code specifications to be tested and perform batch testing on the C / C++ codes in the specified project. Figure 2 shown.

[0043] Example:

[0044] The present invention provides a specific static code analysis rule implementation example, targeting the GJB8114-R-1-1-17 rule: prohibiting the use of external declarations in function bodies. External declarations are divided into function external declarations and variable external declarations. For variable declarations in function declarations, it is determined whether they are external declarations, and an error is reported if they are; if a function is declared in a function, the compiler will report an error, unless it is an externally declared function, so an error is reported if a function declaration appears in a function.

[0045] 1. Register the matcher. Write the registerMatcher method and use Clang's AST matcher to define the code pattern to be detected. The specific steps are as follows:

[0046] (1) Define the matching conditions, create a matcher related to detection rule R-1-1-17, and match the external declaration in the function body;

[0047] (2) Register the matcher to MatchFinder, that is, add it to the MatchFinder object, and matching will be performed when traversing the AST.

[0048] 2. Implement the check logic. Write a check method to process the matching results and perform further checks.

[0049] (1) Obtain the matching results. Obtain the matched node information through the MatchResult object.

[0050] (2) Execution logic: Specific check logic is applied according to the matched nodes. In this embodiment, it is necessary to detect whether external declarations are used in the function body. If they are used, it violates the GJB8114: R-1-1-17 standard and an error needs to be reported.

[0051] 3. Trigger diagnosis. If there is an external declaration in the function body, the diagnosis is triggered. Use the diag method to record the diagnostic information, specify the diagnostic type, and use SourceLocation to record the specific location of the alarm code to obtain the warning information.

[0052] 4. When the analyzer traverses the code, the matcher is automatically applied and the corresponding inspection logic is triggered.

[0053] 5. Open Ruihua embedded integrated development environment ReDe, create a new project, and there is a cpp file under the project, which contains code segments that violate the R-1-1-17 rule. Right-click the project, select [Static Code Analysis Tool], and select the violation standard to be detected in the pop-up dialog box: R-1-1-17.

[0054] 6. According to the selected detection standard, a script file is automatically generated and executed under the project. This script file traverses all cpp files under the project, calls the executable file of the static code analysis tool compiled previously, and generates a static code analysis report in text form under the project, such as Figure 3 shown.

[0055] 7. Use Java's Json parser (gson) to parse the Json nodes of the text report to obtain the current detection standard, current detection file, diagnostic information, error location, modification suggestions, violated detection standards, and the corresponding information of the current detection rule set, and display them in the interface. Figure 4 shown.

Claims

1. A static code analysis method suitable for domestic embedded integrated development environment, characterized in that: The following steps are involved: The GJB8114 rule set is built into the code static check module; Create an AST matcher that matches the rule to be detected in the GJB8114 rule set and register it in the MatchFinder object; In the embedded development environment, obtain variable declaration and function declaration nodes and use AST matcher to match them, check the validity of the nodes, and build multiple error messages; Record multiple error messages to obtain diagnostic information and specify diagnostic types, obtain specific code locations corresponding to multiple error messages, and obtain warning information that violates the rules to be detected; The user interaction and visualization module processes multiple error messages, specific code locations, and warning messages according to user instructions to obtain a code static analysis report in text form; Use Java's Json parser to parse the Json nodes of the code static analysis report to obtain the current detection standard, current detection file, diagnostic information, error location, modification suggestions, violated detection standards, and information corresponding to the current detection rule set, and display them in the interface of the user interaction and visualization module.

2. A static code analysis method suitable for a domestic embedded integrated development environment as claimed in claim 1, characterized in that: The code static checking module is built based on clang.

3. A static code analysis method suitable for a domestic embedded integrated development environment as claimed in claim 1, characterized in that: The rule to be detected is the GJB8114-R-1-1-17 rule, which prohibits the use of external declarations in the function body.

4. A static code analysis method suitable for a domestic embedded integrated development environment as claimed in claim 3, characterized in that: The external declaration includes function external declaration and variable external declaration. For variable declaration in function declaration, determine whether it is an external declaration. If it is, an error is reported. If a function is declared in a function, the compiler reports an error, unless it is an externally declared function. If a function declaration appears inside a function, an error is reported.

5. A static code analysis method suitable for a domestic embedded integrated development environment as claimed in claim 1, characterized in that: The interface is extended using the view in the Eclipse system and is written using the Table of SWT.

Images