Being vaguely familiar with the Java world I was googling for a static analysis tool that would also was intelligent enough to fix the issues it finds. I ran at CodePro tool but, again, I&#39;m new to the Java community and don&#39;t know the vendors. 

What tool can you recommend based on the criteria above?

Static Analysis tool recommendation for Java?

What is the difference between the two? Both seem to mean that the value may be null and should be dealt with accordingly i.e. checked for null.

**Update:**
The two annotations above are part of JSR-305/FindBugs:
http://findbugs.sourceforge.net/manual/annotations.html

javax.annotation: @Nullable vs @CheckForNull

I have a large legacy C++ project compiled under Visual Studio 2008.  I know there is a reasonably amount of &#39;dead&#39; code that is not accessed anywhere -- methods that are not called, whole classes that are not used.

I&#39;m looking for a tool that will identify this by **static analysis**.

This question: [Dead code detection in legacy C/C++ project][1] suggests using code coverage tools.  This isn&#39;t an option as the test coverage just isn&#39;t high enough.  

It also mentions a  -Wunreachable-code. option to gcc. I&#39;d like something similar for Visual Studio.  We already use the linker&#39;s /OPT:REF option to remove redundant code, but this doesn&#39;t report the dead code at a useful level (when used with /VERBOSE there are over 100,000 lines, including a lot from libraries).

Are there any better options that work well with a Visual Studio project?


  [1]: https://stackoverflow.com/questions/229069/dead-code-detection-in-legacy-cc-project

Dead code identification (C++)

Java has some very good open source static analysis tools such as [FindBugs][1], [Checkstyle][2] and [PMD][3].  Those tools are easy to use, very helpful, runs on multiple operating systems and *free*.

Commercial C++ static analysis products are available. Although having such products are great, the cost is just way too much for students and it is usually rather hard to get trial version.

The alternative is to find open source C++ static analysis tools that will run on multiple platforms (Windows and Unix). By using an open source tool, it could be modified to fit certain needs.  Finding the tools has not been easy task.


Below is a short list of C++ static analysis tools that were found or suggested by others.  

  - C++ Check http://sf.net/projects/cppcheck/
  - Oink http://danielwilkerson.com/oink/index.html
  - C and C++ Code Counter http://sourceforge.net/projects/cccc/
  - Splint (from answers)
  - Mozilla&#39;s Pork (from answers) (This is now part of Oink)
  - Mozilla&#39;s Dehydra (from answers)
  - Use option `-Weffc++` for GNU g++ (from answers)

What are some **other** portable open source C++ static analysis tools that anyone knows of and can be recommended?

Some related links.

  - http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis
  - http://www.chris-lott.org/resources/cmetrics/
  - https://stackoverflow.com/questions/93260/a-free-tool-to-check-cc-source-code-against-a-set-of-coding-standards
  - http://spinroot.com/static/
  - https://stackoverflow.com/questions/2873/choosing-a-static-code-analysis-tool
  
  [1]: http://findbugs.sf.net/
  [2]: http://checkstyle.sf.net/
  [3]: http://pmd.sf.net/
  [4]: http://www.klocwork.com/
  [5]: http://www.gimpel.com/
  [6]: http://www.coverity.com/
  [7]: https://wiki.mozilla.org/Static_Analysis
  [8]: https://wiki.mozilla.org/Static_Analysis
  [9]: http://viva64.com

What open source C++ static analysis tools are available?

I&#39;m writing the startup code for an embedded system -- the code that loads the initial stack pointer before jumping to the main() function -- and I need to tell it how many bytes of stack my application will use (or some larger, conservative estimate).

I&#39;ve been told the gcc compiler now has a -fstack-usage option and -fcallgraph-info option that can somehow be used to statically calculates the exact &quot;Maximum Stack Usage&quot; for me.
( [&quot;Compile-time stack requirements analysis with GCC&quot;][1] by Botcazou, Comar, and Hainque ).

Nigel Jones says that recursion is a really bad idea in embedded systems ([&quot;Computing your stack size&quot;][2] 2009), so I&#39;ve been careful not to make any mutually recursive functions in this code.

Also, I make sure that none of my interrupt handlers ever re-enable interrupts until their final return-from-interrupt instruction, so I don&#39;t need to worry about re-entrant interrupt handlers.

Without recursion or re-entrant interrupt handlers, it should possible to statically determine the maximum stack usage. (And so most of the answers to https://stackoverflow.com/questions/389219/how-to-determine-maximum-stack-usage do not apply).
My understanding is I (or preferably, some bit of code on my PC that is automatically run every time I rebuild the executable) first find the maximum stack depth for each interrupt handler when it&#39;s not interrupted by a higher-priority interrupt, and the maximum stack depth of the main() function when it is not interrupted.
Then I add them all up to find the total (worst-case) maximum stack depth. That occurs (in my embedded system) when the main() background task is at its maximum depth when it is interrupted by the lowest-priority interrupt, and that interrupt is at its maximum depth when it is interrupted by the next-lowest-priority interrupt, and so on.

I&#39;m using YAGARTO with gcc 4.6.0 to compile code for the LM3S1968 ARM Cortex-M3.

So how do I use the -fstack-usage option and -fcallgraph-info option with gcc to calculate the maximum stack depth? Or is there some better approach to determine maximum stack usage?

(See https://stackoverflow.com/questions/6375762/how-to-determine-maximum-stack-usage-in-embedded-system for almost the same question targeted to the Keil compiler .)

  [1]: https://www.adacore.com/uploads/technical-papers/Stack_Analysis.pdf
  [2]: https://embeddedgurus.com/stack-overflow/2009/03/computing-your-stack-size/

How to determine maximum stack usage in embedded system with gcc?

I was reading the [lifetimes chapter](https://doc.rust-lang.org/book/first-edition/lifetimes.html) of the Rust book, and I came across this example for a named/explicit lifetime:

    struct Foo&lt;&#39;a&gt; {
        x: &amp;&#39;a i32,
    }
    
    fn main() {
        let x;                    // -+ x goes into scope
                                  //  |
        {                         //  |
            let y = &amp;5;           // ---+ y goes into scope
            let f = Foo { x: y }; // ---+ f goes into scope
            x = &amp;f.x;             //  | | error here
        }                         // ---+ f and y go out of scope
                                  //  |
        println!(&quot;{}&quot;, x);        //  |
    }                             // -+ x goes out of scope

It&#39;s quite clear to me that the error being prevented by the compiler is the *use-after-free* of the reference assigned to `x`: after the inner scope is done, `f` and therefore `&amp;f.x` become invalid, and should not have been assigned to `x`.

My issue is that the problem could have easily been analyzed away *without* using the *explicit* `&#39;a` lifetime, for instance by inferring an illegal assignment of a reference to a wider scope (`x = &amp;f.x;`).

In which cases are explicit lifetimes actually needed to prevent use-after-free (or some other class?) errors?

Why are explicit lifetimes needed in Rust?

 What tools are there available for static analysis against C# code? I know about FxCop and StyleCop. Are there others? I&#39;ve run across NStatic before but it&#39;s been in development for what seems like forever - it&#39;s looking pretty slick from what little I&#39;ve seen of it, so it would be nice if it would ever see the light of day. 

Along these same lines (this is primarily my interest for static analysis), tools for testing code for multithreading issues (deadlocks, race conditions, etc.) also seem a bit scarce. Typemock Racer just popped up so I&#39;ll be looking at that. Anything beyond this?

Real-life opinions about tools you&#39;ve used are appreciated.

What static analysis tools are available for C#?

I would very much like to integrate [pylint][1] into the build process for
my python projects, but I have run into one show-stopper:  One of the
error types that I find extremely useful--:`E1101: *%s %r has no %r
member*`--constantly reports errors when using common django fields,
for example:

    E1101:125:get_user_tags: Class &#39;Tag&#39; has no &#39;objects&#39; member

which is caused by this code:

    def get_user_tags(username):
       &quot;&quot;&quot;
       Gets all the tags that username has used.
    
       Returns a query set.
       &quot;&quot;&quot;
       return Tag.objects.filter(  ## This line triggers the error.
           tagownership__users__username__exact=username).distinct()
    
    # Here is the Tag class, models.Model is provided by Django:
    class Tag(models.Model):
       &quot;&quot;&quot;
       Model for user-defined strings that help categorize Events on
       on a per-user basis.
       &quot;&quot;&quot;
       name = models.CharField(max_length=500, null=False, unique=True)
    
       def __unicode__(self):
           return self.name

How can I tune Pylint to properly take fields such as objects into account?  (I&#39;ve also looked into the Django source, and I have been unable to find the implementation of `objects`, so I suspect it is not &quot;just&quot; a class field.  On the other hand, I&#39;m fairly new to python, so I may very well have overlooked something.)


**Edit:** The only way I&#39;ve found to tell pylint to not warn about these warnings is by blocking all errors of the type (E1101) which is not an acceptable solution, since that is (in my opinion) an extremely useful error.  If there is another way, without augmenting the pylint source, please point me to specifics :)

See [here][2] for a summary of the problems I&#39;ve had with `pychecker` and `pyflakes` -- they&#39;ve proven to be far to unstable for general use.  (In pychecker&#39;s case, the crashes originated in the pychecker code -- not source it was loading/invoking.)

   [1]: http://www.logilab.org/857
   [2]: http://creswick.github.io/blog/2008/09/05/wrestling-python/

Using Pylint with Django

I&#39;m used to having my compiler complain when I do something stupid like a typo on a variable name but JavaScript has a habit of letting this pass.

Are there any static analysis tools for JavaScript?

Are there any JavaScript static analysis tools?

What code analysis tools do you use on your Java projects?

I am interested in all kinds

- static code analysis tools (FindBugs, PMD, and any others)
- code coverage tools (Cobertura, Emma, and any others)
- any other instrumentation-based tools 
- anything else, if I&#39;m missing something

If applicable, also state what build tools you use and how well these tools integrate with both your IDEs and build tools. 

If a tool is only available a specific way (as an IDE plugin, or, say, a build tool plugin) that information is also worth noting.

What code analysis tools do you use for your Java projects?

We are working on a web project from scratch and are looking at the following static code analysis tools.

 - Conventions (Checkstyle)
 - Bad practices (PMD) 
 - Potential bugs (FindBugs)

The project is built on Maven. Instead of using multiple tools for the purpose, I was looking at a single flexible solution and came across SonarQube.

Is it true that we can achieve the results from Checkstyle, PMD and Findbugs with SonarQube? 

Is SonarQube Replacement for Checkstyle, PMD, FindBugs?

There was a [question comparing PMD and CheckStyle][1]. However, I can&#39;t find a nice breakdown on the differences/similarities between PMD and FindBugs. I believe a key difference is that PMD works on source code, while FindBugs works on compiled bytecode files. But in terms of capabilities, should it be an either/or choice or do they complement each other?


  [1]: https://stackoverflow.com/questions/184563/checkstyle-vs-pmd

What are the differences between PMD and FindBugs?

I have a large source repository split across multiple projects. I would like to produce a report about the health of the source code, identifying problem areas that need to be addressed.

Specifically, I&#39;d like to call out routines with a high cyclomatic complexity, identify repetition, and perhaps run some lint-like static analysis to spot suspicious (and thus likely erroneous) constructs.

How might I go about constructing such a report?

How can I analyze Python code to identify problematic areas?

Is there a static analysis tool for PHP source files?

The binary itself can check for syntax errors, but I&#39;m looking for something that does more, like:

 - unused variable assignments
 - arrays that are assigned into without being initialized first
 - and possibly code style warnings
 - ...




How can I perform static code analysis in PHP?

I&#39;m trying to generate calling graph with which to find out all the possible execution paths that are hitting a particular function (so that I don&#39;t have to figure out all the paths manually, as there are many paths that lead to this function). For instance:

    path 1: A -&gt; B -&gt; C -&gt; D  
    path 2: A -&gt; B -&gt; X -&gt; Y -&gt; D  
    path 3: A -&gt; G -&gt; M -&gt; N -&gt; O -&gt; P -&gt; S -&gt; D  
    ...  
    path n: ...

I have tried Codeviz and Doxygen, somehow both results show nothing but callees of target function, D. In my case, D is a member function of a class whose object will be wrapped within a smart pointer. Clients will always obtain the smart pointer object through a factory in order to invoke D.

Does anyone know how to achieve this?

How to Generate a calling graph for C++ code

When making changes to YAML-defined Azure DevOps Pipelines, it can be quite tedious to push changes to a branch just to see the build fail with a parsing error (valid YAML, but invalid pipeline definition) and then try to trial-and-error fix the problem.

It would be nice if the feedback loop could be made shorter, by analyzing and validating the pipeline definition locally; basically a linter with knowledge about the various resources etc that can be defined in an Azure pipline. However, I haven&#39;t been able to find any tool that does this.

Is there such a tool somewhere?

Is there a tool to validate an Azure DevOps Pipeline locally?

We are introducing static analysis tools into the build system for our Java product. We are using Maven2 so [Checkstyle][1] and [PMD][2] integration come for free. However it looks like there is a large overlap in functionality between these two tools, in terms of enforcing basic style rules.

Is there a benefit from utilizing both of these? I don&#39;t want to maintain 2 tools if one will work. If we choose one, which one should we use and why?

We are also planning on using FindBugs. Are there other static analysis tools we should look at?

**Update:** Consensus seems to be that PMD is preferred over CheckStyle. I don&#39;t see a solid reason to use both, and I don&#39;t want to maintain 2 sets of rule files, so we will probably aim for PMD exclusively. We&#39;ll also be bringing in FindBugs, and perhaps, eventually, Macker to enforce architectural rules.


  [1]: http://checkstyle.sourceforge.net/
  [2]: http://pmd.sourceforge.net/

Checkstyle vs. PMD

[PEP8][1] suggests that:

&gt; Imports should be grouped in the following order:
&gt; 
&gt; 1. standard library imports 
&gt; 2. related third party imports 
&gt; 3. local application/library specific imports
&gt;
&gt; You should put a blank line between each group of imports.

Is there a way to check if the standard is violated anywhere in the package using static code analysis tools, like `pylint`, `pyflakes`, `pychecker`, `pep8`?

----------

Example of violation:

    from my_package import my_module
    from django.db import models
    import os

Correct way to import:

    import os

    from django.db import models

    from my_package import my_module

  [1]: http://www.python.org/dev/peps/pep-0008/#id16

Import order coding standard

How would you go about dead code detection in C/C++ code? I have a pretty large code base to work with and at least 10-15% is dead code. Is there any Unix based tool to identify this areas? Some pieces of code still use a lot of preprocessor, can automated process handle that?

Dead code detection in legacy C/C++ project

I saw a StackOverflow question regarding static analysis in Scala, but that  one was answered in 2009. As you know, the Scala tools are changing very rapidly. 

I was therefore wondering if someone familiar with the current state of static analysis tools in Scala could tell me if there&#39;s, say, a Findbugs equivalent for Scala. I found that Findbugs issues many unnecessary warnings for Scala, probably having to do with the way the &quot;object&quot; singleton compiles to bytecode, due to traits, etc. I heard that Scalastyle is not only a Scala version of Java&#39;s CheckStyle, that it also includes bits of Findbugs and PMD. But if it doesn&#39;t implement all of Findbugs and/or PMD, then are there other tools that supplement it? Or, is Scalastyle good not only for style checking, but is it good for improving code quality?

Also, what about Scala&#39;s integration with, say, Sonar? Is the Scala Sonar plugin (which works with Scalastyle) reliable?

 

What&#39;s the current state of static analysis tools for Scala?

According to [scala-wartremover][1] static analysis tool I have to put &quot;final&quot; in front of every case classes I create: error message says &quot;case classes must be final&quot;.

According to [scapegoat][2] (another static analysis tool for Scala) instead I shouldn&#39;t (error message: &quot;Redundant final modifier on case class&quot;)

Who is right, and why?

  [1]: https://github.com/puffnfresh/wartremover
  [2]: https://github.com/sksamuel/scapegoat

Should I use the final modifier when declaring case classes?

I&#39;d like to see all the places in my code (C++) which disregard return value of a function. How can I do it - with gcc or static code analysis tool?

Bad code example:

    int f(int z) {
        return z + (z*2) + z/3 + z*z + 23;
    }
    
    
    int main()
    {
      int i = 7;
      f(i); ///// &lt;&lt;----- here I disregard the return value
    
      return 1;
    }

Please note that:

* it should work even if the function and its use are in different files
* **free** static check tool

All Static Analysis Solutions on Gang of Coders

Total of 22 Static Analysis Solutions