Jump to content

List of tools for static code analysis

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by 194.156.172.204 (talk) at 09:26, 16 March 2010 (→‎C/C++). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

This is a list of significant tools for static code analysis.


Historical products

  • Lint — the original static code analyzer of C code.

Open-source or Noncommercial products

Multi-language

  • RATS — Rough Auditing Tool for Security, which can scan C, C++, Perl, PHP and Python source code.
  • YASCA — Yet Another Source Code Analyzer, a plugin-based framework for scanning arbitrary file types, with plugins for scanning C/C++, Java, JavaScript, ASP, PHP, HTML/CSS, ColdFusion, COBOL, and other file types. It integrates with other scanners, including FindBugs, JLint, PMD, and Pixy.

.NET (C#, VB.NET and all .NET compatible languages)

  • FxCop — Free static analysis for Microsoft .NET programs that compile to CIL. Standalone and integrated in some Microsoft Visual Studio editions. From Microsoft.
  • StyleCop — Analyzes C# source code to enforce a set of style and consistency rules. It can be run from inside of Microsoft Visual Studio or integrated into an MSBuild project. Free download from Microsoft.
  • Gendarme - GPL equivalent to FxCop that runs on Mono. Extensible rule-based tool to find problems in .NET applications and libraries, particularly those that contain code in ECMA CIL format.

Java

  • Checkstyle — besides some static code analysis, it can be used to show violations of a configured coding standard
  • FindBugs — an open-source static bytecode analyzer for Java (based on Jakarta BCEL) from the University of Maryland.
  • PMD — a static ruleset based Java source code analyzer that identifies potential problems.
  • Hammurapi — (Free for non-commercial use only) versatile code review solution.
  • Soot — a language manipulation and optimization framework consisting of intermediate languages for Java
  • Squale — a platform to manage software quality (also available for other languages, using commercial analysis tools though)

JavaScript

C

  • BLAST (Berkeley Lazy Abstraction Software verification Tool) — a software model checker for C programs based on lazy abstraction.
  • Clang — A compiler that includes a static analyzer.
  • Frama-C — A static analysis framework for C.
  • Sparse — A tool designed to find faults in the Linux kernel.
  • Splint — An open source evolved version of Lint (C language).

Objective-C

  • Clang — the free Clang project includes a static analyzer. As of version 3.2, this analyzer is included in Xcode.[1]

Perl

  • Perl::Critic — module and program to help find deviations from commonly accepted best practices

ActionScript

  • Apparat — a language manipulation and optimization framework consisting of intermediate representations for ActionScript.

Commercial products

Multi-language

  • Axivion Bauhaus Suite — a tool for C, C++, C#, Java and Ada code that comprises various analyses such as architecture checking, interface analyses, and clone detection.
  • CAST Application Intelligence Platform — Detailed, audience-specific dashboards to measure quality and productivity. 30+ languages, SAP, Oracle, PeopleSoft, .NET, Java, C/C++, Struts, and all major databases.
  • Coverity Prevent — identifies security vulnerabilities and code defects in C, C++, C# and Java code.
  • DMS Software Reengineering Toolkit — supports custom analysis of C, C++, C#, Java, COBOL, PHP and many other languages. Also COTS tools for clone analysis, dead code analysis, and style checking.
  • Compuware DevEnterprise — analysis of COBOL, PL/I, JCL, CICS, DB2, IMS and others.
  • Fortify — helps developers identify software security vulnerabilities in C/C++, .NET, Java, JSP, ASP.NET, ColdFusion, "Classic" ASP, PHP, VB6, VBScript, JavaScript, PL/SQL, T-SQL, python and COBOL as well as configuration files.
  • GrammaTech CodeSonar — Analyzes C,C++. Ada-Assured -Analyzes Ada
  • Klocwork Insight and Klocwork Developer for Java — provides security vulnerability and defect detection as well as architectural and build-over-build trend analysis for C, C++, C# and Java
  • Lattix, Inc. LDM — Architecture and dependency analysis tool for Ada, C/C++, Java, .NET software systems.
  • LDRA Testbed — A software analysis and testing tool suite for C, C++, Ada83, Ada95 and Assembler (Intel, Freescale, Texas Instruments).
  • Micro Focus (formerly Relativity Technologies) Modernization Workbench - Parsers included for COBOL (multiple variants including IBM, Unisys, MF, ICL, Tandem), PL/I, Natural (inc. ADABAS), Java, Visual Basic, RPG, C & C++ and other legacy languages; Extensible SDK to support 3rd party parsers. Supports automated Metrics (including Function Points), Business Rule Mining, Componentisation and SOA Analysis. Rich ad hoc diagramming, AST search & reporting)
  • Ounce Labs — automated source code analysis that enables organizations to identify and eliminate software security vulnerabilities in languages including Java, JSP, C/C++, C#, ASP.NET, and VB.Net.
  • Parasoft — Security, reliability, performance, and maintainability analysis of Java, JSP, C, C++, .NET (C#, ASP.NET, VB.Net, etc.), WSDL, XML, HTML, CSS, JavaScript, VBScript/ASP, and configuration files.
  • SEEC - Supports major legacy languages - documentation, analysis rule mining, interactive analysis, metrics & componentisation
  • SofCheck Inspector — provides static detection of logic errors, race conditions, and redundant code for Java and Ada. Provides automated extraction of pre/postconditions from code itself.
  • Sotoarc/Sotograph — Architecture and quality in-depth analysis and monitoring for Java, C#, C and C++
  • Structure101 — For understanding, analyzing, measuring and controlling the quality of your Software Architecture as it evolves over time. Available for Java, Ada and ActionScript, with support for C/C++ via Coverity and Programming Research.
  • Understand — analyzes C,C++, Java, Ada, Fortran, Jovial, Delphi — reverse engineering of source, code navigation, and metrics tool.
  • Veracode - finds security flaws in application binaries and bytecode without requiring source. Supported languages include C, C++, .NET (C#, C++/CLI, VB.NET, ASP.NET), Java, JSP, and ColdFusion.
  • Visual Studio Team System — analyzes C++,C# source codes. only available in team suite and development edition.

.NET

Products covering multiple .NET languages.

  • ReSharper — Add-on for Visual Studio 2003/2005 from the creators of IntelliJ IDEA, which also provides static code analysis for C#.
  • NDepend — Simplifies managing a complex .NET code base by analyzing and visualizing code dependencies, by defining design rules, by doing impact analysis, and by comparing different versions of the code. Integrates into Visual Studio.
  • CodeIt.Right — combines Static Code Analysis and automatic Refactoring to best practices which allows automatically correct code errors and violations. Supports both C# and VB.NET.

Ada

  • AdaCore CodePeer — Automated code review and bug finder for Ada programs that uses control-flow, data-flow, and other advanced static analysis techniques.

C/C++

  • Green Hills Software DoubleCheck — static analysis for C and C++ code.
  • LDRA Testbed — A software analysis and testing tool suite for C & C++.
  • PC-Lint — A software analysis tool for C & C++.
  • QA-C (and QA-C++) — deep static analysis of C for quality assurance and guideline enforcement.
  • Red Lizard's Goanna — Static analysis for C/C++ in Eclipse and Visual Studio.
  • Cppcheck — Open source static analysis tool for C and C++.

Java

  • IntelliJ IDEA — IDE for Java that also provides static code analysis.
  • SonarJ — monitors the conformance of code to intended architecture, also computes a wide range of software metrics.

Uncategorized

  • SemmleCode — object oriented code queries for static program analysis.

Formal methods tools

Tools that use a formal methods approach to static analysis (e.g., using static program assertions):

See also

References

  1. ^ "Static Analysis in Xcode". Apple. Retrieved 2009-09-03.
Retrieved from "https://en.wikipedia.org/w/index.php?title=List_of_tools_for_static_code_analysis&oldid=350172545"