Better Software - July/August 2008 - (Page 37) stands for Software Testing Analysis & Review. It is an acronym for the types of activities that we in the software quality field perform. However, in many organizations, the analysis activity is often overlooked, and that’s too bad because analysis is a powerful tool in the quality arsenal. Static code analysis is computer software analysis that is performed without actually executing that software. (Analysis performed on executing software is known as dynamic analysis.) In most cases, static analysis is performed on the source code. In recent years, the importance of computer security has created an expanded demand for automated tools that can analyze source code for security vulnerabilities and coding defects that could be exploited. Many security vulnerabilities are caused by questionable coding practices—for instance, using an input variable as a loop index without first checking that its value is within a valid range. Contemporary static analysis tools are able to analyze source code with a much lower false-positive rate (claiming code is defective when it is not) than previous lintstyle detector tools. Because they examine only small portions of the source code at a time, lint-detector tools typically have falsepositive rates of 50 percent or higher. The leading contemporary automated static analyzer (ASA) tools claim—and our experience to date has shown—false positive rates under 20 percent. These tools achieve this by parsing the source code in a way similar to compilers, creating a syntax tree and database of the entire program’s code, which is then analyzed against rules or models. The ASA tools then create a report of suspected defects in the code. www.StickyMinds.com JULY/AUGUST 2008 BETTER SOFTWARE M any of this magazine’s readers are familiar with the STAREAST and STARWEST conferences. Here is a trivia question for you—what does STAR stand for? Give up? It 37 http://www.StickyMinds.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.