JP6121828B2 - Static analysis apparatus, static analysis method, and computer program - Google Patents

Description

  The present invention relates to a static analysis apparatus, a static analysis method, and a computer program for performing static analysis on source code.

  In software development, a static analysis device that performs static analysis on a source code is known. Static analysis is performed in order to reduce the possibility of malfunctions such as malfunctions. The static analysis device predefines patterns that are likely to lead to defects, and there is a possibility of a description error or a description error that matches the definition from within the source code without actually executing the source code. Specify a high point and output a warning. The software developer repeatedly corrects those warnings that are determined to be necessary to improve the quality of the source code.

  Here, in the source code, operations similar to a plurality of locations are often described. Therefore, a software developer may copy source code in various units such as a function unit and a line unit. If there is an error in the description of the copy source, the same error is also described in the copy destination. In such a case, the static analyzer outputs a number of identical warnings.

  Further, the warning output by the static analysis device tends to increase as the size of the source code increases. In addition, these warnings include warnings that actually lead to malfunctions and warnings that do not lead to malfunctions. Therefore, it is difficult for software developers to check all warnings output from the static analysis device. For this reason, a technique for presenting which warning should be corrected is required.

  A related technique corresponding to such a request is described in Patent Document 1. The related technology of Patent Document 1 analyzes whether the target source code conforms to the coding rules of the source code defined in advance, and outputs information related to the non-compliant violation location as an analysis result. . At this time, this related technology sets whether or not output is required for each rule ID of the coding rule, and outputs a violation location corresponding to the rule ID set as output required.

  Another related technique is described in Patent Document 2. The related technology described in Patent Document 2 manages a history of changes in module units for source code from the initial storage time to the previous storage time. And this related technology outputs warnings in order from the defective part detected by the module having the larger total number of changes among the defective parts detected by performing static analysis on the new source code.

  Another related technique is described in Patent Document 3. The related technology described in Patent Document 3 is a warning table including a warning ID indicating a warning type and a record including a source code line including a warning point for a warning point obtained by performing static analysis of the source code. Is generated. This related technique sorts and outputs the warning table based on the warning ID and the identity of the source code line.

JP 2010-198522 A JP 2008-21244 A JP 2012-248050 A

  Each of the related technologies described above can output a huge number of warnings output during static analysis of source code with some priority, but still has the following problems.

  The related technology described in Patent Document 1 can select whether or not output is required for each rule ID, but in fact, even for warnings with the same rule ID, warnings that need to be handled and warnings that do not need to be handled There are many cases where it can be distinguished. For this reason, in this related technology, if the rule ID of a warning that does not need to be set is set to output failure, a warning that needs to be handled cannot be output. Thus, this related technology does not have sufficient accuracy for prioritizing warnings output during static analysis.

  In addition, the related technique described in Patent Document 2 gives higher priority to warnings pointed out in modules with a higher number of updates. However, in this related technique, the number of updates varies depending on how the unit of the module is taken, and the priority is also different. Therefore, it is necessary to set the module unit appropriately. In addition, in the related technology, when modules are set in units of functions, priorities are assigned to the units of functions. Here, consider a case where a function described in one function is copied for reuse in another function, and the same warning is output at the copy source and the copy destination. In such a case, this related technology prioritizes differently because the source and destination are contained in different modules, even though these warnings are the same warning due to the duplicated description. Probability is high. Thus, this related technology cannot prioritize the output warning with high accuracy.

  The related technique described in Patent Literature 3 displays the results of static analysis by rearranging the results based on the warning type and the identity of the source code lines. However, in this related technology, even the same warning based on the duplicated description may be treated as different warnings with only slightly different source code lines. In addition, since this related technology determines identity in line units of source code, and does not determine identity in other units such as module units, it may not be possible to determine that descriptions that can actually be considered identical are the same is there. As a result, this related technique cannot present the result of the static analysis with high priority.

  The present invention has been made in order to solve the above-described problems, and an object of the present invention is to provide a technique for accurately prioritizing and presenting the results of static analysis on a source code.

  The static analysis device according to the present invention performs warning analysis on the input source code, thereby warning position information indicating a position of a warning portion in the source code, warning identification information for identifying a warning type, and By extracting a static analysis unit that generates warning information including a part similar to each other (similar part) in the source code, the similar part similar to each other is extracted from each similar part. Each warning information by collating the warning information and the similar part information with a similar part extracting unit that generates similar part information including the similar identification information identified from the range information indicating the range of the similar part. On the other hand, an information linking unit for generating linked warning information to which similar identification information of similar parts including the position of the warning location indicated by the warning information is added, and the linked warning information. Te, and a priority determination unit which outputs the connection warning information in accordance with determining the priority determined priority using the priority decision criteria based on the warning identification information and the similarity identification information.

  Further, the static analysis method of the present invention performs warning analysis on the input source code, thereby warning position information indicating a position of a warning portion in the source code and warning identification for identifying a warning type. Warning information including information is generated, and similar parts (similar parts) are extracted from the source code, so that similar parts similar to each other are identified from other similar parts. By generating similar part information including similar identification information and range information indicating the range of the similar part, and collating the warning information and the similar part information, the warning information indicates each warning information. Generate linked warning information to which similar identification information of a similar part including the position of the warning part is added, and the warning identification information and the similar identification for the linked warning information It determines the priority by using the priority decision criteria based on the distribution, and outputs the connection alert information according to the determined priority.

  Further, the computer program of the present invention performs static analysis on the input source code to thereby provide warning position information indicating the position of the warning portion in the source code and warning identification information for identifying the type of warning. A static analysis step for generating warning information including: and extracting similar parts (similar parts) from each other in the source code so that similar parts similar to each other are similar to each other Each warning information is obtained by collating the warning information and the similar part information with a similar part extraction step for generating similar part information including similar identification information identified from the part and range information indicating the range of the similar part. Information for generating linked warning information to which similar identification information of similar parts including the position of the warning location indicated by the warning information is added A priority for determining the priority using the priority determination criteria based on the warning identification information and the similar identification information, and outputting the connection warning information according to the determined priority. And causing the computer device to execute a degree determination step.

  The present invention can provide a technique for presenting the results of static analysis on the source code with prioritization with high accuracy.

It is a functional block diagram of a static analysis device as a 1st embodiment of the present invention. It is a figure which shows an example of the hardware constitutions of the static analysis apparatus as the 1st Embodiment of this invention. It is a flowchart explaining operation | movement of the static analysis apparatus as the 1st Embodiment of this invention. It is a figure which shows an example of the warning information in the 1st Embodiment of this invention. It is a figure which shows an example of the similar part information in the 1st Embodiment of this invention. It is a figure which shows an example of the connection warning information in the 1st Embodiment of this invention. It is a figure which shows an example of the connection warning information prioritized in the 1st Embodiment of this invention. It is a functional block diagram of the static analysis apparatus as the 2nd Embodiment of this invention. It is a flowchart explaining operation | movement of the static analysis apparatus as the 2nd Embodiment of this invention. It is a figure which shows an example of the difference information in the 2nd Embodiment of this invention. It is a figure which shows an example of the connection warning information in the 2nd Embodiment of this invention. It is a figure which shows an example of the connection warning information prioritized in the 2nd Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(First embodiment)
FIG. 1 shows a functional block configuration of a static analysis apparatus 1 as a first embodiment of the present invention.

  In FIG. 1, the static analysis device 1 includes a static analysis unit 11, a similar part extraction unit 12, an information connection unit 13, and a priority determination unit 14.

  Here, as shown in FIG. 2, the static analysis device 1 includes a CPU (Central Processing Unit) 1001, a RAM (Random Access Memory) 1002, a ROM (Read Only Memory) 1003, and a storage device 1004 such as a hard disk. And a computer device including an input device 1005 and an output device 1006. In this case, the static analysis unit 11 includes an input device 1005 and a CPU 1001 that reads a computer program and various data stored in the ROM 1003 and the storage device 1004 into the RAM 1002 and executes them. The similar portion extraction unit 12 and the information connection unit 13 are configured by a CPU 1001 that reads a computer program and various data stored in the ROM 1003 and the storage device 1004 into the RAM 1002 and executes them. The priority determination unit 14 includes an output device 1006 and a CPU 1001 that reads a computer program and various data stored in the ROM 1003 and the storage device 1004 into the RAM 1002 and executes them. Note that the hardware configuration of the static analysis device 1 and each functional block thereof is not limited to the above-described configuration.

  The static analysis unit 11 performs a static analysis on the input source code and generates warning information as an analysis result. For example, the static analysis unit 11 can employ various known techniques for detecting patterns that are likely to lead to defects in the source code. The source code may be described in one or more groups of files. For example, the static analysis unit 11 may acquire the source code by acquiring, via the input device 1005, information specifying the storage location of the source code in the storage device 1004. The warning information includes at least warning position information and warning identification information. Here, the warning position information is information indicating the position of the warning part in the source code. For example, the warning position information may be information including a file name including a warning part and a line number of the warning part. The warning identification information is information for identifying the type of warning.

  The similar part extraction unit 12 extracts similar parts (similar parts) from each other in the source code. For example, the similar part extraction unit 12 extracts another part satisfying a predetermined similarity condition for an arbitrary range part in the source code. The arbitrary range may be a range from several lines to several tens of lines, for example. Predetermined similar conditions include, for example, the same part that remains different, such as identifiers and arguments, and the same part that remains different only in places that do not affect the operation of the program, such as comments and blank characters. It may be. In addition, the similar part extraction unit 12 may employ various known techniques for extracting similar parts from each other in the text data.

  Further, the similar part extraction unit 12 generates similar part information including similar identification information and range information for each extracted similar part. Here, the similarity identification information is information for identifying similar parts that are similar to each other from other similar parts that are similar to each other. That is, the similarity identification information is assigned a different value for each group of similar parts that are similar to each other. The range information represents the range of the corresponding part in the source code. For example, the range information may be information including a file name including the similar part, a start line number, and an end line number.

  The information linking unit 13 collates the warning information output by the static analysis unit 11 and the similar part information generated by the similar part extraction unit 12, thereby adding similar identification information to each warning information. Generate information. Specifically, if there is a similar part including the position of the warning location indicated by the warning information, the information connecting unit 13 may add the similar identification information to each warning information.

  The priority determination unit 14 gives priority to the connection warning information generated by the information connection unit 13 according to a priority determination criterion based on the warning identification information and the similar identification information. Then, the priority determination unit 14 outputs connection warning information to the output device 1006 according to the determined priority.

  For example, the priority determination unit 14 may count the number of warning information having the same combination of warning identification information and similar identification information, and give a higher priority in descending order of the number of counts. In this case, the priority determination unit 14 may give higher priority to the warning information having the same priority in the descending order of the count number of the same similar identification information. In that case, the priority determination unit 14 may give higher priority to the warning information having the same priority in the descending order of the count number of the same warning identification information. In addition, as long as the priority determination unit 14 is a criterion based on the warning identification information and the similar identification information, the priority determination unit 14 may prioritize according to another priority determination criterion.

  The operation of the static analysis apparatus 1 configured as described above will be described with reference to FIG.

  First, the static analysis unit 11 performs static analysis on the input source code, and generates warning information including warning position information and warning identification information (step S1).

  Next, the similar part extraction unit 12 extracts similar parts that are similar to each other in the source code, and generates similar part information including similar identification information and range information for each extracted similar part (step S2).

  Next, the information linking unit 13 generates linked warning information in which similar identification information of the similar partial information generated in step S2 is added to each warning information generated in step S1 (step S3). Specifically, as described above, the information connecting unit 13 may add similar identification information of a similar part including the position of the warning portion indicated by the warning information to each warning information.

  Next, the priority determination unit 14 gives priority to the connection warning information generated in step S3 according to a priority determination criterion based on the warning identification information and the similar identification information. And the priority determination part 14 outputs a connection warning information according to the determined priority (step S4).

  Thus, the static analysis apparatus 1 ends the operation.

  Next, the operation of the static analysis apparatus 1 will be shown as a specific example.

  Here, it is assumed that the static analysis unit 11 stores a description pattern that is likely to cause a failure, and detects a location that matches the pattern in the source code as a warning location that may cause a rule violation.

  First, in step S1, the static analysis unit 11 detects a warning location that matches a stored pattern in the input source code, and generates warning information. Here, it is assumed that the warning information shown in FIG. 4 has been generated. In FIG. 4, the warning information indicated by each line includes a file name and line number as warning position information and a warning ID as warning identification information, and further includes warning contents and corresponding line source code (description contents of the corresponding line). ). Thus, the warning information generated by the static analysis unit 11 may include other information as long as it includes at least warning position information and warning identification information. Hereinafter, this warning information is also referred to as a warning table.

  Next, in step S2, the similar part extraction unit 12 extracts similar parts that are similar to each other in the input source code. In this specific example, the similar part extracting unit 12 is different from the part in the range of several lines to several tens of lines, for example, other parts such as identifiers and arguments, comments, blank characters, etc. Other parts that differ only in the parts that do not affect the operation of the program are extracted as similar parts.

  And the similar part extraction part 12 produces | generates the similar part information which consists of the similar ID as similar identification information, and range information about each extracted similar part. Here, it is assumed that the similar partial information shown in FIG. 5 is generated. In FIG. 5, the similar partial information indicated by each line includes a file name, start line number, end line number, and similar ID as range information. In addition, the group of similar parts that are similar to each other is assigned the same similarity ID for identifying the group of similar parts that are similar to each other. Hereinafter, the similar part information is also referred to as a similar part table.

  Next, in step S3, the information linking unit 13 compares the warning table shown in FIG. 4 with the similar table shown in FIG. Generate.

  Specifically, the information linking unit 13 searches for similar partial information having range information including the warning position information for each warning information. And when such similar part information is searched, the information connection part 13 should just add the similarity ID of the searched similar part information to the row | line | column of a corresponding warning table.

  For example, the warning information on the first line of the warning table shown in FIG. This indicates that it is in “111” line of c ”. In addition, this ““ A0001. “111” line of “c” is a range of the similar part information of the first line of the similar table shown in FIG. c ”from the start line“ 110 ”to the end line“ 119 ”. Therefore, the information linking unit 13 adds “001” that is the similarity ID of the first row of the similar table to the first row of the warning table of FIG. Further, the warning information on the third line of the warning table shown in FIG. 4 indicates that the corresponding warning location is “file“ A0001. This indicates that it is in “line 238” of c ”. In addition, this ““ A0001. The similar part information in the range including the “238th line” of c ”is not included in the similar table shown in FIG. Therefore, the information linking unit 13 does not add a similar ID to the third row of the warning table in FIG. And the information connection part 13 processes similarly about the other line of the warning table of FIG. An example of the connection warning information to which the similar ID is added in this way is shown in FIG. Hereinafter, the connection warning information is also referred to as a connection warning table.

  Next, in step S4, the priority determination unit 14 gives priority to each row of the linked warning table in FIG. 6 using a priority determination criterion based on the warning ID and the similar ID.

  Here, the priority determination unit 14 first assigns higher priorities in descending order of the number of linked warning information having the same combination of warning ID and similar ID. Moreover, the priority determination part 14 gives a higher priority to the thing with the same count number of the same similar ID about the thing with the same count number of the combination of warning ID and similar ID. Furthermore, the priority determination part 14 gives a higher priority to the thing with the same count number of similar ID in order with many count numbers of the same warning ID.

  For example, in FIG. 6, the count numbers of the linked warning information whose warning ID is “ID505” and whose similar ID is “001” are three in the first, fourth, and seventh lines. In addition, the count numbers of the linked warning information whose warning ID is “ID607” and whose similar ID is “002” are two in the second and sixth lines. Each of the other linked warning information has no other combination with the same combination of similar ID and warning ID, so the count number is one. Therefore, the priority determination unit 14 first assigns priority 1 to the first, fourth, and seventh lines, and assigns priority 2 to the second, sixth, and sixth lines. Here, the smaller the priority value, the higher the priority.

  In the remaining third, fifth, and eighth lines, the number of counts of combinations of similar IDs and warning IDs is 1 and the same. Therefore, the priority determination unit 14 prioritizes the third, fifth, and eighth rows based on the number of similar ID counts. Here, among the similar IDs on the third, fifth, and eighth lines, the similar ID “001” on the fifth line has the largest count number of four on the first to eighth lines. Therefore, the priority determination unit 14 gives priority 3 to the fifth line.

  And since the similar ID is not added to the remaining 3rd and 8th lines, the count number of the similar ID is 0 and becomes the same. Therefore, the priority determination unit 14 prioritizes the third and eighth lines based on the count number of warning IDs. Here, out of the warning IDs in the 3rd and 8th lines, the warning ID “ID505” in the 8th line has the largest count number of 4 in the 1st to 8th lines. Therefore, the priority determination unit 14 gives priority 4 to the eighth line. Then, the priority determination unit 14 gives priority 5 to the remaining third row of warning information. The connection warning information whose priority is determined in this way is shown in FIG. In FIG. 7, the connection warning information is rearranged from the top in descending order of priority. And the priority determination part 14 may output connection warning information in the order shown in FIG. 7 according to the provided priority.

  Above, description of the specific operation | movement of the static analyzer 1 is complete | finished.

  Next, effects of the first exemplary embodiment of the present invention will be described.

  The static analysis apparatus according to the first embodiment of the present invention can present the results of static analysis for the source code with high priority.

  The reason is that the static analysis unit generates warning information including warning position information and warning identification information as a result of performing static analysis on the source code, and the similar part extraction unit is similar to each other in the source code. And generating similar part information including similar identification information and range information for each similar part, and the information linking unit adds similar identification information of the similar part including the position of the warning part to each warning information, This is because the priority determination unit prioritizes warning information using a priority determination criterion based on the warning identification information and the similar identification information, and outputs the priority information according to the priority.

  Thereby, this Embodiment can show each warning location obtained by static analysis to a user in the priority order according to the relation with other warning locations. For example, let us consider a case where a part including an incorrect description is duplicated in a plurality of places in the source code. In this case, even if there is a slight description change such as a variable name at the copy destination, the present embodiment uses the same warning identification information and the same similarity identification for each warning information for the plurality of erroneous descriptions. Information will be given. Therefore, in the present embodiment, the priority of such a group of warning points is increased and output. As a result, according to the present embodiment, it is possible to present a group of warnings for a duplicated erroneous description as things that should be confirmed with higher priority, and to reduce the burden on correction work of the software developer. In this way, by using this embodiment, the software developer can easily narrow down and correct warnings that are strongly related to other warning points, and is very efficient.

  In addition, according to the present embodiment, since prioritization is performed based on a similar part in an arbitrary range extracted in the source code, it is not necessary to set a unit for extracting as a similar part in the source code in advance. . Therefore, according to the present embodiment, the results of static analysis can be accurately prioritized and presented without requiring a software developer's pre-setting work.

(Second Embodiment)
Next, a second embodiment of the present invention will be described in detail with reference to the drawings. Note that, in each drawing referred to in the description of the present embodiment, the same reference numerals are given to the same configuration and steps that operate in the same manner as in the first embodiment of the present invention, and the detailed description in the present embodiment. Description is omitted.

  First, FIG. 8 shows a functional block configuration of a static analysis device 2 as a second embodiment of the present invention. In FIG. 8, the static analysis device 2 is different from the static analysis device 1 according to the first embodiment of the present invention in the information connection unit 23 and the priority determination unit 14 instead of the information connection unit 13. Instead, it includes a priority determination unit 24, and further includes a difference extraction unit 25.

  Here, the static analysis device 2 can be configured by a computer device including hardware elements similar to those of the static analysis device 1 according to the first embodiment of the present invention described with reference to FIG. In this case, the difference extraction unit 25 includes an input device 1005 and a CPU 1001 that reads a computer program and various data stored in the ROM 1003 and the storage device 1004 into the RAM 1002 and executes them. Note that the hardware configuration of the static analysis device 2 and each functional block thereof is not limited to the above-described configuration.

  The difference extraction unit 25 extracts a difference from the previous source code with respect to the target source code, and generates difference information indicating a range of the extracted difference. For example, the difference information may be information including a file name including a difference corresponding portion of the source code, a start line number, and an end line number. Further, for example, the difference extraction unit 25 may acquire the previous source code by acquiring the information specifying the storage location of the previous source code in the storage device 1004 via the input device 1005.

  The information linking unit 23 generates linked warning information in which similar identification information and difference presence / absence information described later are added to the warning information generated by the static analysis unit 11. First, the information connection part 23 adds similar identification information to each warning information similarly to the information connection part 13 in the 1st Embodiment of this invention. In addition, the information linking unit 23 collates the warning information generated by the static analysis unit 11 and the difference information generated by the difference extraction unit 25, so that each warning information is indicated by a warning indicated by the warning information. It is determined whether or not there is a difference range including the position of the location. And the information connection part 23 should just add the difference presence information showing "with difference" with respect to warning information with the range of the difference including the position of a warning location. Moreover, the information connection part 23 should just add the difference presence / absence information showing "no difference" with respect to warning information without the range of the difference including the position of a warning location.

  The priority determination unit 24 uses a priority determination criterion based on difference presence / absence information, in addition to the warning identification information and the similar identification information, for the priority determination unit 14 according to the first embodiment of the present invention. Is different. For example, when there is a difference in the group of linked warning information in which the combination of the warning identification information and the similar identification information matches, the priority determination unit 24 is a group in which all of the linked warning information does not have a difference. A higher priority may be set. This is because when all of such a group of linked warning information has a difference, it can be regarded as a new warning, and it is better to check with priority. In addition, when there is a difference and no difference in a group of linked warning information in which a combination of warning identification information and similar identification information matches, such a group of linked warning information may not need to be handled in the past. This is because it can be regarded as a confirmed warning.

  Moreover, the priority determination part 24 may update a priority using the priority determination criteria by which the setting was changed, if the information showing the setting change of a priority determination criterion is acquired. For example, the priority determination unit 24 may acquire information indicating a change in setting of the priority determination criterion via the input device 1005 after outputting the connection warning information using the priority determined once. For example, the information indicating the setting change of the priority determination criterion may be content for changing the setting as to whether or not the difference presence / absence information is considered. Further, for example, the information indicating the setting change of the priority determination criteria is the same number of counts of the same similar identification information and the same warning when the combination of the warning identification information and the similar identification information matches. The content may be changed to preferentially compare with the count number of the identification information.

  The operation of the static analysis apparatus 2 configured as described above will be described with reference to FIG.

  First, the static analysis device 2 operates in the same manner as the static analysis device 1 as the first embodiment of the present invention up to steps S1 to S2, so that warning information that is a result of the static analysis, Similar part information is generated.

  Next, the difference extraction unit 25 determines whether there is a previous source code (step S13).

  If there is no previous source code, the static analysis device 2 executes steps S3 to S4 shown in FIG. 3 and ends the process.

  On the other hand, if there is a previous source code, the difference extraction unit 25 extracts a difference from the previous source code for the target source code, and generates difference information indicating the range (step S14).

  Next, the information linking unit 23 generates linked warning information in which similar identification information and difference presence / absence information are added to each warning information generated in step S1 (step S15). Specifically, as described above, the information linking unit 23 adds similar identification information of a similar part including the position of the warning part to each warning information, and the range of the difference including the position of the warning part is What is necessary is just to add the difference existence information showing whether there exists.

  Next, the priority determination unit 24 sets a priority for each connection warning information generated in step S15 using a priority determination criterion based on warning identification information, similar identification information, and difference presence / absence information. decide. And the priority determination part 24 outputs connection warning information according to the determined priority (step S16).

  Next, the priority determination unit 24 determines whether or not information indicating setting change of the priority determination criterion is input (step S17).

  Here, if the information indicating the setting change is not input, the static analysis device 2 ends the operation.

  On the other hand, when information indicating a setting change is input, the priority determination unit 24 repeats the operation from step S16.

  Above, description of operation | movement of the static analyzer 2 is complete | finished.

  Next, the operation of the static analysis device 2 will be shown as a specific example.

  Here, similarly to the specific example in the first embodiment of the present invention, the warning table shown in FIG. 4 is generated by the static analysis unit 11 in step S1, and the similar part extraction unit 12 in step S2. Assume that the similar table shown in FIG. 5 is generated.

  Next, in step S13, it is assumed that the difference extraction unit 25 determines that there is a previous source code.

  Therefore, in step S14, the difference extraction unit 25 generates difference information for the source code before the target source code. Here, it is assumed that the difference information shown in FIG. 10 is generated. In this specific example, the difference information includes a file name including the difference range, a start line number, and an end line number. Hereinafter, the difference information is also referred to as a difference table.

  Next, in step S15, the information linking unit 23 adds the similarity ID and the difference presence / absence information to the warning information by collating the warning table in FIG. 4, the similar table in FIG. 5, and the difference table in FIG. Generated concatenation warning information.

  For example, the information linking unit 23 indicates that the warning information on the first line of the warning table shown in FIG. This indicates that it is in “111” line of c ”. In addition, this “file“ A0001. The “111” line of c ”is not included in the difference information shown in the difference table shown in FIG. Therefore, the information linking unit 23 adds difference presence / absence information indicating no difference to the first row of the warning table of FIG. The warning information on the fourth line of the warning table shown in FIG. This indicates that it is in “311” line of c ”. In addition, this “file“ A0001. “311” line of c ”is included in the difference information of the first line of the difference table shown in FIG. Therefore, the information linking unit 23 adds difference presence / absence information indicating that there is a difference to the fourth row of the warning table.

  An example of the connection warning information to which the difference presence / absence information and the similar ID are added in this way is shown in FIG. Hereinafter, the connection warning information is also referred to as a connection warning table.

  Next, in step S16, the priority determination unit 24 sets the priority for each row of the linked warning table shown in FIG. 11 using the priority determination criterion based on the warning ID, the similar ID, and the difference presence / absence information. Give.

  Here, the priority determination unit 24 first sets a group of linked warning information having the same combination of warning ID and similar ID, all having a difference as the highest priority.

  Specifically, in the linked warning table of FIG. 11, groups of linked warning information having the same combination of warning ID and similar ID are group 1 consisting of the first, fourth and seventh lines, and the second and sixth lines. There are a group 2 consisting of the third row, a group 3 consisting of the third row, a group 4 consisting of the fifth row, and a group 5 consisting of the eighth row. Of these, the group 4 with the difference is the group 4 consisting of the fifth row. Therefore, the priority determination unit 24 assigns priority 1 to the fifth line.

  Also, none of the remaining groups has a difference. Therefore, the priority determination unit 24 assigns priorities to the remaining connection warning information according to the same criteria as the priority determination unit 14 in the specific example of the first embodiment of the present invention. The connection warning information whose priority is determined in this way is shown in FIG. In FIG. 12, the connection warning information is rearranged from the top in descending order of priority. And the priority determination part 24 may output connection warning information in the order shown in FIG. 12 according to the provided priority.

  Thus, the priority determination unit 24 (a) Configuration of difference presence / absence information in a group having the same warning ID and similar ID, (b) Count number having the same warning ID and similar ID, and (c) Similar ID. The same count number and (d) warning IDs are used as priority determination criteria in the order of the same count number.

  Further, here, in step S17, it is assumed that information for changing the setting so as to compare the priority determination criteria without considering the difference presence / absence information is input via the input device 1005.

  Therefore, the priority determination unit 24 executes Step S16 again using the priority determination criteria in the order of (b), (c), and (d) described above. Thereby, the priority determination part 24 determines and outputs a priority like FIG. 7 shown in the specific example of the 1st Embodiment of this invention.

  Above, description of the specific operation | movement of the static analyzer 2 is complete | finished.

  Next, the effect of the second exemplary embodiment of the present invention will be described.

  The static analysis apparatus according to the second embodiment of the present invention can present the results of the static analysis for the source code with higher accuracy priorities.

  The reason is that the static analysis unit generates warning information, the similar part extraction unit generates similar part information, and the difference extraction unit determines the range of differences from the previous source code for the target source code. Difference information is generated by extracting information, and the information linking unit adds difference identification information to each warning information, and also indicates whether there is a difference range including the warning position information. The priority determination unit prioritizes warning information using priority determination criteria based on warning identification information, similar identification information, and difference presence / absence information, and outputs the priority according to the priority. is there.

  Thereby, this Embodiment considers difference presence / absence information, when giving the priority according to relation with another warning location about each warning location obtained by the static analysis. For example, when all of the linked warning information groups having the same warning identification information and similar identification information have a difference, these warnings are likely to be new warnings and are considered to have high priority. On the other hand, if there is a difference and no difference in such a group, these warnings are likely to be warnings that have been pointed out previously and confirmed to be unnecessary, and are considered low priority. It is done. In this way, the present embodiment gives priority to warnings that are strongly related to other warning points by considering the difference presence / absence information. A newly generated warning that has not been pointed out before can be presented to the user in preference to the related warning.

  In each of the embodiments of the present invention described above, each functional block of the static analysis device has been described mainly with an example realized by a CPU that executes a computer program stored in a storage device or ROM. Part, all, or a combination of each functional block may be realized by dedicated hardware.

  In each embodiment of the present invention described above, the functional blocks of the static analysis device may be realized by being distributed to a plurality of devices.

  In each embodiment of the present invention described above, the operation of the static analysis device described with reference to each flowchart is stored in a storage device (storage medium) of the computer device as a computer program of the present invention. The CPU may read and execute the computer program. In such a case, the present invention is constituted by the code of the computer program or a storage medium.

  Moreover, each embodiment mentioned above can be implemented in combination as appropriate.

  The present invention is not limited to the above-described embodiments, and can be implemented in various modes.

DESCRIPTION OF SYMBOLS 1, 2 Static analysis apparatus 11 Static analysis part 12 Similar part extraction part 13, 23 Information connection part 14, 24 Priority determination part 25 Difference extraction part 1001 CPU
1002 RAM
1003 ROM
1004 Storage device 1005 Input device 1006 Output device

Claims (9)

Static information that generates warning information including warning position information indicating a position of a warning portion in the source code and warning identification information for identifying a warning type by performing static analysis on the input source code An analysis unit;
Similar identification information for identifying similar parts that are similar to each other from other similar parts by extracting similar parts (similar parts) in the source code and the range of the similar parts A similar part extraction unit that generates similar part information including range information representing
An information linking unit that generates linked warning information in which similar identification information of a similar part including a position of a warning part indicated by the warning information is added to each warning information by collating the warning information and the similar part information When,
A priority determination unit that determines priority for the connection warning information using a priority determination criterion based on the warning identification information and the similarity identification information, and outputs the connection warning information according to the determined priority; ,
Static analysis device with The source code further includes a difference extraction unit that extracts a difference with respect to the previous source code and generates difference information indicating a range of the extracted difference,
The information linking unit collates the warning information and the difference information, thereby indicating whether or not there is a difference range including the position of the warning portion indicated by the warning information for each warning information. Is generated in addition to the similar identification information, and the connection warning information is generated,
The said priority determination part determines the said priority using the said priority determination criteria based on the said difference presence / absence information in addition to the said warning identification information and the said similar identification information. Static analysis device.   The priority determination unit, when acquiring information indicating a setting change of the priority determination criterion, updates the priority using the priority determination criterion changed in setting. 2. The static analysis apparatus according to 2. By performing static analysis on the input source code, warning information including warning position information indicating the position of the warning portion in the source code and warning identification information for identifying the type of warning is generated,
Similar identification information for identifying similar parts that are similar to each other from other similar parts by extracting similar parts (similar parts) in the source code and the range of the similar parts And similar partial information including range information representing
By collating the warning information and the similar part information, for each warning information, generate linked warning information in which similar identification information of a similar part including the position of the warning part indicated by the warning information is added,
A static analysis method for determining a priority for the connection warning information using a priority determination criterion based on the warning identification information and the similar identification information, and outputting the connection warning information according to the determined priority . For the source code, extract the difference with respect to the previous source code, generate difference information indicating the range of the extracted difference,
By comparing the warning information and the difference information, difference presence / absence information indicating whether or not there is a range of differences including the position of the warning portion indicated by the warning information for each warning information is obtained by using the similarity identification information. In addition to the above, the added link warning information is generated,
The static analysis method according to claim 4, wherein the priority is determined using the priority determination criterion based on the difference presence / absence information in addition to the warning identification information and the similarity identification information.   The static analysis according to claim 4 or 5, wherein when the information indicating the setting change of the priority determination criterion is acquired, the priority is updated by using the priority determination criterion whose setting has been changed. Method. Static information that generates warning information including warning position information indicating a position of a warning portion in the source code and warning identification information for identifying a warning type by performing static analysis on the input source code An analysis step;
Similar identification information for identifying similar parts that are similar to each other from other similar parts by extracting similar parts (similar parts) in the source code and the range of the similar parts A similar part extraction step for generating similar part information including range information representing
An information linking step for generating linked warning information in which similar identification information of a similar part including the position of the warning location indicated by the warning information is added to each warning information by collating the warning information and the similar part information When,
A priority determining step of determining a priority for the connection warning information using a priority determination criterion based on the warning identification information and the similar identification information, and outputting the connection warning information according to the determined priority; ,
Is a computer program that causes a computer device to execute. For the source code, extract a difference with respect to the previous source code, and further cause the computer device to execute a difference extraction step for generating difference information indicating a range of the extracted difference,
In the information linking step, by comparing the warning information and the difference information, difference presence / absence information indicating whether or not there is a difference range including the position of the warning portion indicated by the warning information for each warning information Is generated in addition to the similar identification information, and the connection warning information is generated,
8. The priority determination step according to claim 7, wherein the priority is determined using the priority determination criterion based on the difference presence / absence information in addition to the warning identification information and the similarity identification information. Computer program.   8. The computer apparatus according to claim 7, wherein the computer apparatus is configured to execute the priority determination step by using the priority determination criterion whose setting has been changed in response to acquisition of information indicating a setting change of the priority determination criterion. Item 9. The computer program according to Item 8.

Images