JP5188421B2 - Source code analysis method and source code analysis support system - Google Patents

Description

  The present invention relates to a source code analysis method and a source code analysis support system that implements the method.

  Conventionally, in static analysis across multiple source codes, instead of analyzing all the source code necessary for static analysis, the server does not perform all of the source code that is already managed on the server in advance. A source code analysis system that performs static analysis as processing and performs static analysis on the basis of the result of this pre-processing in a server at the time of actual analysis is known (for example, see Patent Document 1).

  In the conventional source code analysis system, if an error is detected as a result of static analysis of the source code, a warning is output. With this warning, the developer corrects the source code in which the error occurred. However, some errors do not necessarily have to be corrected. This is because even if a certain coding is described in an unfavorable format, a situation arises in which it is necessary to describe so from the characteristics of the project. However, conventionally, it has been determined whether or not a detected error needs to be corrected based on the skill and discretion of each developer. For this reason, the quality of the source code depends on the developer, and the quality varies depending on the developer. As a technology to solve this problem, the warnings output by the source code analysis system are automatically assigned a priority to which error should be corrected. A technique for facilitating determination of whether correction is necessary and reducing the workload of a developer is known (see, for example, Patent Document 2).

JP 2008-225519 A JP 2008-21244 A

  However, the above prior art has the following problems.

First, in the technique described in Patent Document 1, when source code is corrected for a source code registered in the server due to a failure in the test process, the source stored in the server Code and preprocessing results may not be consistent with the source code being modified. In this case, it is necessary to register the source code to be corrected once in the server and then perform analysis processing of other source code, which places a burden on the developer. In addition, the analysis result of the source code is changed from the pre-processing result executed on the server (if the source code is analyzed alone, the point to be pointed out is not included in the point of analysis when analyzed through the related program. If this occurs, the source code analysis must be re-executed.

  Further, in the technique described in Patent Document 2, the number of warnings output itself does not change, so the workload of a developer who determines whether or not a large number of warnings need to be corrected remains unchanged. Even if a warning is output as described above, depending on the characteristics of the project, there is no problem in coding rules, and there is an error that does not require correction. Therefore, from the viewpoint of reducing the load on the developer, it is desirable to control such an error not to be output as an analysis result, but Patent Document 2 does not mention this point.

  The present invention has been made in view of the above, and a source code analysis method capable of reducing a developer's work load and performing highly accurate source code analysis in a source code analysis work during software development. An object is to provide a source code analysis support system to be implemented.

In order to solve the above-described problem, the present invention provides a source code analysis method implemented by, for example, a computer, a process of receiving a source code via an input unit, a function and a function from the received source code Based on a process of extracting source code related information indicating a variable reference relationship and storing it in a storage unit, and the received source code and a pre-defined source code coding rule, the source code is converted into the coding rule. If the source code does not comply with the coding rule as a result of the analysis of whether or not it conforms, the analysis result, the file name described in the source code and the corresponding coding rule information are Processing to store in the storage unit, source code related information from the storage unit and the Based on the analysis result, when the analysis result needs to be changed, and when the analysis result needs to be changed, the analysis result stored in the storage unit is changed based on the result of the determination process. Processing to output the analysis result to the output unit based on output control information that defines the necessity of output of the analysis result for each non-compliant coding rule stored in the storage unit, and the output And changing the necessity of outputting the output control information for the coding rule of the analysis result according to the change .

ADVANTAGE OF THE INVENTION According to this invention, in the source code analysis work at the time of software development, while reducing the workload of a developer, the source code analysis method which can analyze a source code with high precision, and the source code analysis which implements this A support system can be provided.

The whole block diagram of a source code analysis support system. The flowchart which shows an example of the process sequence of a source code analysis assistance system. The flowchart which shows an example of the process sequence of a source code analysis process implemented by step S202 of FIG. The flowchart which shows an example of the process sequence of an analysis result connection process implemented by step S203 of FIG. The flowchart which shows an example of the process sequence of an analysis result output process implemented by step S204 of FIG. The figure which shows an example of the source code used as the input of a source code analysis support system. Similarly, the figure which shows an example of the source code used as the input of a source code analysis support system. Similarly, the figure which shows an example of the source code used as the input of a source code analysis support system. The figure which shows an example of the coding rule referred to source code analysis. The figure which shows an example of the information containing the call relationship between the functions in the input source code, and the reference relationship of the variable used within a function. The figure which shows an example of the analysis result information 107. The figure which shows an example of the analysis result information 107 after an update. The figure which shows an example of the output control information 109. FIG. The figure which shows an example of the result output by the result output means 104.

  Embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is an overall configuration diagram of a source code analysis support system.

  The source code analysis support system 100 is realized by a general computer, for example, and includes a CPU, a storage device that stores programs executed by the CPU and various data, an input device such as a keyboard / mouse, and an output device such as a display. The storage device of the source code analysis support system 100 stores a program including source code analysis means 101, source code information extraction means 102, analysis information connection means 103, and result output means 104. Further, in the storage device, a coding rule 106 in which a function or variable naming rule or a use prohibition instruction is defined for the source code 105 to be analyzed, analysis result information 107 generated by the source code analysis means 101, Source code related information 108 generated by the source code information extraction unit and output control information 109 generated by the result output unit 104 are stored.

  The source code analysis unit 101 calls and executes the source code information extraction unit 102 when executing the analysis process of the source code 105, and the call relationship between functions in the source code 105 and the reference relationship of variables used in the function. Source code related information 108 is generated. The source code analysis unit 101 generates the source code related information 108 and then stores a coding rule 106 for storing a function or variable naming rule for the source code, a use prohibition instruction, and the like, and the source code related information 108. Analyzes whether the source code 105 input via the input device complies with the coding rule 106. Here, in order to associate the source code related information 108 with the source code 105, the source code related information 108 includes information indicating a calling relationship between functions in the source code and a reference relationship of variables used in the function. .

  For example, when the use prohibition instruction defined in the coding rule 106 exists in the source code 105 input via the input device, this part is detected as a location that violates the coding rule 106. In addition, when the source code analysis unit 101 finds a variable that is not initialized in the source code 105, the source code analysis unit 101 refers to the source code related information 108 stored in the storage device, and references information about the variables that are not initialized. To see if it exists. As a result of checking, if there is update information for the same variable, the source code analysis unit 101 determines that the uninitialized variable found in the source code 105 has been initialized and does not detect it as a violation location. If there is no update information for the same variable as a result of the confirmation, the source code analysis unit 101 detects an uninitialized variable found in the source code 105 as an initialization omission variable. The source code analysis unit 101 generates analysis result information 107 indicating a source code analysis result after the analysis process of the source code 105 is completed, and stores it in the storage device. Further, the source code analyzing means 101 determines from the analysis result information 107 whether or not the source code 105 input via the input device has been analyzed in the past, and the result of the determination is analyzed in the past. In the case where it has been done, there is a means for outputting to the output device a screen for allowing the developer 110 to confirm whether or not to analyze the input source code 105.

  The source code information extraction unit 102 is a program that is called and executed by the source code analysis unit 101 when the source code 105 is analyzed. The call relationship between functions in the source code 105 and the reference relationship of variables used in the function. Is generated and stored in a storage device.

  For example, the source code information extraction unit 102 refers to the source code 105 and searches for a function call location. When a function call location is found, the source code information extraction unit 102 extracts information on a function name to be called, a variable used as an argument to the function, and a variable used as a return value. The source code information extraction unit 102 also searches for variables used in the source code 105 and extracts information on variable names, reference locations, and reference types (reference / update, etc.). The source code information extraction unit 102 stores the extracted information as source code related information 108.

  The analysis information linking means 103 determines whether or not the analysis result information 107 stored in the storage device should be updated from the source code related information 108 generated for the source code 105 input via the input device. If it is necessary to update, the analysis result information 107 stored in the storage device is updated. Here, in order to associate the source code related information 108 with the analysis result information 107, the analysis result information 107 includes information indicating functions, variable reference relationships, and use locations that do not comply with the coding rule 106.

  For example, the analysis information linking unit 103 generates the source code generated for the newly analyzed source code 105 with respect to the information stored as the initialization omission variable in the analysis result information 107 stored in the storage device. With reference to the related information 108, it is searched whether there is update information (initialized part) for the same variable. Here, when the update information is found, the analysis information connecting unit 103 determines that it is necessary to delete the variable initialization failure information stored in the analysis result information 107, and the variable initialization failure information Is deleted from the analysis result information 107 stored in the storage device.

  The result output means 104 determines whether or not to output the analysis result information 107 stored in the storage device to the output device based on the output control information, and when outputting, outputs the corresponding analysis result information 107 to the output device. Output. Further, when a change request for the output content of the analysis result is received from the developer 110 via the input device, the result output unit 104 updates the output control information 109 according to the change request. Here, in order to associate the output control information 109 with the analysis result information 107, the output control information 109 includes the location of the source code that does not comply with the coding rule 106 and the contents of the corresponding coding rule 106 (such as rule NO). Contains information.

  For example, when one or more pieces of information are stored in the analysis result information 107 stored in the storage device, the result output unit 104 refers to the output control information 109 before outputting to the output device, for example, If it is specified to output only one item, only one item of the specified analysis result information 107 is output to the output device. Further, when it is desired to change to output one or more items, the developer 110 can change the output contents using the input device. In this case, the result output unit 104 updates the output control information 109 according to the change content received via the input device.

  Next, the processing flow of the source code analysis support system according to the present embodiment will be described along the processing procedure shown in FIG.

  First, the source code analysis unit 101 determines whether or not the source code 105 input via the input device has been analyzed based on the analysis result information 107 stored in the storage device (step S200). ). When determining, the source code analysis unit 101 compares the date and time when the analysis process for the source code 105 is executed with the analysis date and time included in the analysis result information 107, and the analysis date and time included in the analysis result information 107 is executed. If it is older than the date and time, it is determined that the input source code 105 has already been analyzed, and the process proceeds to step 201. Also, the date and time when the analysis process for the source code 105 is executed and the analysis date and time included in the analysis result information 107 are compared. If the analysis date and time included in the analysis result information 107 are the same, the source code The analysis unit 101 determines that the input source code 105 is a source code that has not been analyzed in the past, and proceeds to step S202.

  If the result of determination in step 200 is that the analysis date and time included in the analysis result information 107 is older than the analysis processing execution date and time, then the source code analysis unit 101 determines whether or not to execute the input source code 105 analysis processing. Is output to the output device (step 201). If execution of analysis processing is selected by the developer 110 via the input device, the source code analysis means 101 moves to step 202, and if execution of analysis processing is not selected, analysis of the input source code 105 is performed. The process ends.

  In the source code analysis process shown in step 202, a process of analyzing the input source code 105 by the source code analysis unit 101 and the source code information extraction unit 102 is performed. It is processing. Detailed processing contents of the source code analysis processing shown in step 202 will be described with reference to FIG.

  First, the source code analysis unit 101 calls the source code information extraction unit 102. The source code information extraction unit 102 extracts source code related information 108 indicating a call relationship between functions and a reference relationship of variables used in the function from the source code 105 input via the input device, and stores the storage device. (Step 300).

  Next, the source code analysis unit 101 confirms whether the input source code 105 is compliant with the coding rule 106 based on the coding rule 106 and the source code related information 108 stored in the storage device in step 200. The result is stored in the storage device (step 301). When the source code analysis unit 101 finds a portion that does not conform to the coding rule 106 in the input source code 105, the content of the violation coding rule and the line that violates the coding rule in the source code After detecting the coding contents and storing them in the storage device as the analysis result information 107, the process proceeds to step 203 (FIG. 2). On the other hand, the source code analysis unit 101 proceeds to step 203 when there is no portion that does not conform to the coding rule 106 in the input source code 105.

  A specific example of source code analysis processing executed by the source code analysis unit 101 will be described below. Here, for example, when the source code shown in FIG. 6 is analyzed in accordance with the coding rules shown in FIG. 9, a prohibited instruction (in the example, indicates a GO TO instruction) is described in the 6800th line of the source code. Therefore, the source code analysis means 101 determines that the rule ID = A1001 defined in the coding rule shown in FIG. 9 is violated, and detects the 6800th line of the source code as a coding rule ID = A1001 violation location. The analysis result information 107 including the corresponding file name, the corresponding coding rule ID, and the analysis result is stored in the storage device. Moreover, although the variable = OUT-DATA is described in the 4800th line and the 10000th line of the source code, the initialization is not performed, and the rule ID = B2011 defined in the coding rule is violated. Therefore, the source code analysis unit 101 detects the variable = OUT-DATA as a coding rule ID = B2011 violation location, and stores the analysis result information 107 including the corresponding file name, the corresponding coding rule ID, and the analysis result in the storage device. . Further, the END-IF instruction is omitted for the IF instruction on the 4800th line of the source code, and it violates the rule ID = A1101 defined in the coding rule of FIG. The IF instruction on line 4800 of the source code is detected as a coding rule ID = A1101 violation location, and analysis result information 107 including the corresponding file name, corresponding coding rule ID, and analysis result is stored in the storage device.

  Further, for example, when the source code shown in FIG. 7 is analyzed, there is no part that violates the rule defined by the coding rule shown in FIG. 9, so the source code analysis unit 101 does not have a part that violates the coding rule. The source code analysis process shown in FIG. 7 is terminated.

  When the source code shown in FIG. 8 is analyzed, the WHEN OTHER clause is omitted for the EVALUATE instruction on the 9200th line of the source code, and the rule ID = A1102 defined in the coding rule shown in FIG. 9 is violated. Therefore, the source code analysis means 101 detects the EVALUATE instruction on the 9200th line of the source code as a coding rule ID = A1102 violation location, and the analysis result information 107 including the corresponding file name, the corresponding coding rule ID, and the analysis result. Is stored in a storage device. Moreover, although the variable = OUT-DATA is described in the 9200th line of the source code, the initialization is not performed, and the rule ID = B2011 defined in the coding rule shown in FIG. 9 is violated. Therefore, the source code analysis unit 101 detects the variable = OUT-DATA as a coding rule ID = B2011 violation location, and stores the analysis result information 107 including the corresponding file name, the corresponding coding rule ID, and the analysis result in the storage device. . An example of the analysis result information 107 stored in the storage device is shown in FIG.

  Returning to FIG. In the analysis information linking process shown in step 203, the analysis information linking means 103 is based on the source code related information 108 extracted by the source code information extraction means 102 from the source code newly input via the input device. Then, update processing of the analysis result information 107 stored in the storage device is performed. Hereinafter, the detailed processing content of the analysis information connection processing shown in step 203 will be described with reference to FIG.

  First, the analysis information connecting means 103 determines whether or not the analysis result information 107 needs to be changed based on the source code related information 108 and the analysis result information 107 stored in the storage device (step 400). That is, the analysis information connecting unit 103 stores the source code analysis unit 101 based on the source code related information 108 extracted by the source code information extraction unit 102 from the source code 105 newly input via the input device. The contents of the analysis result information 107 stored in the apparatus are scrutinized. When it is determined that the analysis result information 107 needs to be changed, the analysis information connecting unit 103 changes the analysis result information 107 (step 401). If it is not necessary to change the analysis result information 107 in step 400, the analysis information connecting unit 103 proceeds to step 204 (FIG. 2).

  A specific example of the source code analysis process executed by the analysis information connecting unit 103 will be described below. Here, description will be made using the source related information 108 shown in FIG. 10 and the analysis result information 107 shown in FIG.

  First, the analysis result information linking means 103 refers to the analysis result information 107 shown in FIG. 11 and, for example, the file name (TESTPG01) relating to the initialization failure of the variable OUT-DATA violating the rule ID = B2011 (FIG. 13). , TESTPG03). Next, the analysis result information linking means 103 refers to the source code related information 108 (FIG. 10), and classifies the variable (reference type of the variable) and the line number used (information regarding the used part). ) In the example shown in FIG. 10, the analysis result information linking unit 103 can confirm that the 8300th line of the program name = TESTPG02 is updated for the variable = OUT-DATA. As a result, the analysis result information linking means 103 detects that the variable = OUT-DATA is detected as an initialization omission when analyzed by a single program (TESTPG01, TESTPG03), but if analyzed through the entire related program, the variable = It can be confirmed that the OUT-DATA has been initialized. That is, the analysis result information linking unit 103 determines that the analysis result information 107 indicating that the initialization of the variable = OUT-DATA is omissible may be deleted, deletes it from the storage device, and proceeds to step 204 (FIG. 2). FIG. 12 shows the analysis result information 107 after deletion.

  Returning to FIG.

  In the result output process shown in step 204, the result output unit 104 uses the analysis result information 107 stored by the source code analysis unit 101 on the output device based on the output control information 109 generated by the result output unit 104. Perform the output process. When the developer 110 receives an output content change request for the output analysis result information 107 from the developer 110 via the input device, the result output unit 104 stores the request in the storage device according to the request content. A process for updating the output control information 109 is executed. Hereinafter, detailed processing contents of the result output processing shown in step 204 will be described with reference to FIG.

  First, the result output means 104 reads the analysis result information 107 from the storage device, determines whether output is necessary based on the output control information 109 stored in the storage device, and outputs the analysis result information when output is necessary. Output to the device (step 500). A specific example will be described. FIG. 13 shows an example of the output control information 109, and FIG. 12 shows an example of the analysis result information 107.

  The result output means 104 confirms information indicating whether or not the analysis result of the output control information 109 shown in FIG. In the example shown in FIG. 13, the result output means 104 confirms information in which TRUE is set (rule ID = A1101, A1102, and B2011 are applicable) and information in which FALSE is set (rule ID = A1001 is applicable). To do. Next, the result output unit 104 refers to the analysis result information 107 shown in FIG. 12 and searches for the rule IDs (A1101, A1102, B2011) in which TRUE is set as the necessity of output from the confirmation results. The matching information is output to the output device. In the case of the analysis result information 107 illustrated in FIG. 12, information corresponding to rule ID = A1101 and A1102 is output to the output device. An example of the output screen is shown in FIG. Returning to FIG.

  After the processing of step 500, the developer 110 considers the characteristics of the project and, for example, presses the “output” or “not output” button for the corresponding file shown in FIG. 14 using the input device. When the operation is performed, the result output means 10 receives the analysis result information change request via the input device (step 501), and proceeds to step 502. If there is no change request, the result output unit 10 ends the analysis result output process and the source code analysis process.

  Next, the result output unit 104 updates the corresponding output control information 109 stored in the storage device in accordance with the change request received in step 501 (step 502).

  A specific example of the update process of the output control information 109 will be described. For example, when the result output unit 104 receives a request to change the analysis result information for the rule ID = A1101 to output reject (FALSE), which is set to output required (TRUE), via the input device, the storage device Information corresponding to the rule ID = A1101 is searched from the output control information 109 stored in, and FALSE is set for the contents of the output presence / absence column of the matched information. As described above, according to the above embodiment, it is possible to shorten the processing time required for source code analysis. This is achieved by performing the analysis based on the analysis result information stored in the source code analysis unit and the source code related information stored in the source code information extraction unit, such as when executing source code related to a plurality of programs. This is because the work of acquiring and re-analyzing all related source codes is reduced.

  Further, according to the above embodiment, it is possible to perform source code analysis with high accuracy. That is, it is possible to suppress a large amount of warnings generated by source code analysis. This is because the information referred to at the time of source code analysis is always updated by the analysis information linking means for updating the contents of the source code related information stored in the source code information extraction means and the analysis result information stored in the source code analysis means・ Because it has been scrutinized.

  Further, according to the above-described embodiment, only the result information that matches the characteristics of the project can be output as the result information of the source code analysis output to the developer. That is, it is possible to reduce the load of the developer's necessity of modification on the output source code analysis result. This is because a screen for allowing the developer to input whether the analysis result information is output to the output device or not is output to the output device.

DESCRIPTION OF SYMBOLS 100 Source code analysis support system 101 Source code analysis means 102 Source code information extraction means 103 Analysis information connection means 104 Analysis result output means 105 Source code 106 Coding rule 107 Analysis result information 108 Source code related information 109 Output control information 110 Developer

Claims (2)

A source code analysis method implemented by a computer,
Processing to receive source code via the input unit;
Processing for extracting source code related information indicating a reference relationship between a function and a variable from the received source code and storing the information in a storage unit;
A process of analyzing whether the source code conforms to the coding rule based on the received source code and a predetermined coding rule of the source code;
As a result of the analysis, when the source code does not conform to the coding rule, the analysis result, a process of storing the file name described in the source code and the corresponding coding rule information in the storage unit;
Based on the source code related information and the analysis result from the storage unit, a process of determining whether the analysis result needs to be changed,
When the analysis result needs to be changed, based on the result of the determination process, a process of changing the analysis result stored in the storage unit;
A process of outputting the analysis result to the output unit based on output control information that defines the necessity of outputting the analysis result for each coding rule that is stored in the storage unit and does not comply with the coding rule ;
A process of accepting a change in the necessity of output of the output analysis result, and a process of changing the necessity of output of the output control information for the coding rule of the analysis result according to the change in the necessity of output;
The source code analysis method characterized by implementing. A computer having an input unit, an output unit, a control unit and a storage unit,
The controller is
Means for receiving source code via the input unit;
Means for extracting source code related information indicating a reference relationship between functions and variables from the received source code, and storing the extracted information in the storage unit;
Means for analyzing whether the source code conforms to the coding rule based on the received source code and a predetermined coding rule of the source code;
As a result of the analysis, if the source code does not conform to the coding rule, means for storing the analysis result, a file name described in the source code and corresponding coding rule information in the storage unit;
Means for determining whether or not to change the analysis result based on the source code related information and the analysis result from the storage unit;
Means for changing the analysis result stored in the storage unit based on the result of the determination process when the analysis result needs to be changed;
Means for outputting the analysis result to the output unit based on output control information defining whether the analysis result is output for each non-compliant coding rule stored in the storage unit;
Means for accepting a change in output necessity of the output analysis result, and changing the necessity of output of the output control information for the coding rule of the analysis result relating to the output necessity change;
A computer comprising:

Images