Top Qs
Timeline
Chat
Perspective

List of tools for static code analysis

From Wikipedia, the free encyclopedia

Remove ads

This is a list of notable tools for static program analysis (program analysis is a synonym for code analysis).

Static code analysis tools

Summarize
Perspective
More information Tool, Latest release ...
Remove ads

Languages

Ada

C, C++

C#

IEC 61131-3

  • CODESYS Static Analysis  integrated add-on for CODESYS (application code realized e.g. in ST, FBD, LD)

Java

More information Tool, Latest release ...

JavaScript

  • ESLint  JavaScript syntax checker and formatter.
  • Google's Closure Compiler  JavaScript optimizer that rewrites code to be faster and smaller, and checks use of native JavaScript functions.
  • CodeScene  Behavioral analysis of code.
  • JSHint  A community driven fork of JSLint.
  • JSLint  JavaScript syntax checker and validator.
  • Klocwork
  • Semgrep  A static analysis tool that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available.
  • Understand

Objective-C, Objective-C++

  • Clang  The free Clang project includes a static analyzer. As of version 3.2, this analyzer is included in Xcode.[14]
  • Infer  Developed by an engineering team at Facebook with open-source contributors. Targets null pointers, leaks, API usage and other lint checks. Available as open source on github.
  • Understand

Opa

  • Opa includes its own static analyzer. As the language is intended for web application development, the strongly statically typed compiler checks the validity of high-level types for web data, and prevents by default many vulnerabilities such as XSS attacks and database code injections.

Packaging

  • Lintian  Checks Debian software packages for common inconsistencies and errors.
  • Rpmlint  Checks for common problems in rpm packages.

Perl

PL/SQL

PowerBuilder, PowerScript

Python

  • PyCharm  Cross-platform Python IDE with code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project.
  • PyDev  Eclipse-based Python IDE with code analysis available on-the-fly in the editor or at save time.
  • Pylint  Static code analyzer. Quite stringent; includes many stylistic warnings as well.
  • Klocwork
  • Semgrep  Static code analyzer that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available.
  • Understand

Transact-SQL

  • Visual Expert  A SQLServer code analysis tool[16] that reports on programming issues and helps understand and maintain complex code (Impact Analysis, source code documentation, call trees, CRUD matrix, etc.).
Remove ads

Tools with duplicate code detection

Formal methods tools

Summarize
Perspective

Tools that use sound, i.e. over-approximating a rigorous model, formal methods approach to static analysis (e.g., using static program assertions). Sound methods contain no false negatives for bug-free programs, at least with regards to the idealized mathematical model they are based on (there is no "unconditional" soundness). Note that there is no guarantee they will report all bugs for buggy programs, they will report at least one.

Remove ads

See also

Remove ads

References

Loading content...
Loading related searches...

Wikiwand - on

Seamless Wikipedia browsing. On steroids.

Remove ads