Customized static source code analysis

• US 10,223,106 B1
• Filed: 11/17/2017
• Issued: 03/05/2019
• Est. Priority Date: 09/06/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Caspi, Omer
• Primary Examiner(s): Nahar, Quamrun
• Application Number:
  US15/815,879
• Publication Number:
  US 20190073216A1
• Time in Patent Office: 473 Days
• Field of Search: None
• CPC Class Codes: G06F 8/73 Program documentation
• CPC Class Codes: G06F 8/75 Structural analysis for program understanding

Abstract

Technical solutions are described for customized static source code analysis. An example method includes parsing a source code, the parsing comprising identifying an application programming interface (API) call. The method further includes identifying an analysis configuration file corresponding to the API call. Further, the method includes determining, based on the analysis configuration file, a description of the API call and an identification of a target resource invoked by the API call. Further, the method includes generating a static source code analysis report that includes the description of the API call and the identification of the target resource corresponding to the API call.

Claims

1. A computer-implemented method for customized static source code analysis comprising:

parsing a source code, the parsing comprising identifying a first application programming interface (API) call, and a second API call;

identifying a first analysis configuration file corresponding to the first API call, and a second analysis configuration file corresponding to the second API call;

determining, based on the first analysis configuration file, a description of the first API call and an identification of a first target resource invoked by the first API call;

determining, based on the second analysis configuration file, a second description of the second API call and an identification of a second target resource invoked by the second API call; and

generating a static source code analysis report that includes the description of the first API call and the identification of the first target resource corresponding to the first API call, and the description of the second API call and the identification of the second target resource corresponding to the second API call.

2. The computer-implemented method of claim 1, wherein the first analysis configuration file comprises mapping data to resolve the first target resource based on a type of the first API call.

3. The computer-implemented method of claim 2, wherein the type of the API call is one from a group of types of API calls consisting of control flow API, external data access API, internal data API, and messaging API.

4. The computer-implemented method of claim 2, wherein the mapping data comprises a program name in response to the target resource being a service.

5. The computer-implemented method of claim 2, wherein the mapping data comprises a table identifier in response to the target resource being a data-item from a database.

6. The computer-implemented method of claim 2, wherein the mapping data comprises a remote machine identifier in response to the API call being a messaging API that invokes a remote resource.

7. The computer-implemented method of claim 1, wherein determining the first target resource further comprises:

in response to a mapping data from the first analysis configuration file including a user-exit reference;

executing a script corresponding to the user-exit reference; and

determining the target resource from a result of the script.

8. The computer-implemented method of claim 1, wherein the first analysis configuration file is corresponding to a first user, the static source code analysis report is a first static source code analysis report, and wherein the method further comprising:

parsing the source code, the parsing comprising identifying said first API call;

identifying a third analysis configuration file corresponding to said first API call; and

determining, based on the third analysis configuration file, a second description of said first API call and a second identification of said first target resource invoked by said first API call; and

generating a second static source code analysis report that includes the second description of said first API call and the second identification of said first target resource.