{"id":329571,"date":"2024-05-23T01:47:58","date_gmt":"2024-05-23T01:47:58","guid":{"rendered":"https:\/\/www.baeldung.com\/java-static-code-analysis-infer"},"modified":"2024-05-23T01:47:58","modified_gmt":"2024-05-23T01:47:58","slug":"static-code-analysis-using-infer","status":"publish","type":"post","link":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/2024\/05\/23\/static-code-analysis-using-infer\/","title":{"rendered":"Static Code Analysis Using Infer"},"content":{"rendered":"

<\/p>\n

\"Contact<\/p>\n

1. Introduction<\/h2>\n
<\/div>\n

In\u00a0<\/span>the realm of<\/span>\u00a0software development, ensuring code quality is very important, especially for complex and large codebases. Static code analysis tools like Infer<\/a> provide us with techniques to detect potential bugs and vulnerabilities in our codebase before they manifest into critical issues.<\/strong><\/span><\/p>\n

In this tutorial, we’ll explore the fundamentals of code analysis, explore Infer’s capabilities, and provide practical insights into incorporating it into our development workflow.<\/span><\/p>\n

2. Static Code Analysis<\/h2>\n
<\/div>\n

Static analysis is a debugging method that automatically examines source code without executing the program.<\/strong> This process facilitates the identification of potential defects, security vulnerabilities, and maintainability issues. Typically conducted by third-party tools like the well-known SonarQube<\/a>, static code analysis is straightforward when automated.<\/p>\n

Generally, it occurs in early development phases.<\/strong> Once the code\u00a0<\/span>is written<\/span>,\u00a0<\/span>a static code analyzer should be run<\/span>\u00a0to look over the code. It will check against defined coding rules from standards or custom predefined rules.\u00a0<\/span>Once the code\u00a0<\/span>is run<\/span>\u00a0through the static code analyzer, the analyzer will\u00a0<\/span>have identified whether or not<\/span>\u00a0the code complies with the set\u00a0<\/span>rules<\/span>.<\/span><\/p>\n

In a basic enterprise environment, it’s often part of the Continuous Integration (CI)<\/a> process. With each commit, a job is triggered to build the application, run tests, and analyze the code, ensuring compliance, safety, and security before deployment.<\/p>\n

3. Infer<\/h2>\n
<\/div>\n

Infer is a static code analysis tool for Java, C, C++, and Objective-C, written in OCaml<\/a>.<\/strong> It was first developed at Facebook and open-sourced in\u00a0<\/span>2015<\/span><\/a>. Since then, it has gained popularity beyond Facebook, being adopted by other large companies.<\/span><\/p>\n

For Java and Android code, it checks for issues like null pointer exceptions, resource leaks, and concurrency race conditions. In C, C++, and Objective-C, it detects problems such as null pointer issues, memory leaks, coding convention violations, and calls to unavailable APIs.<\/span><\/p>\n

To efficiently handle large codebases,\u00a0Infer utilizes techniques like separation logic and bi-abduction<\/a>.<\/strong>\u00a0Separation logic allows it to analyze small parts of the code storage independently, avoiding\u00a0<\/span>the need to process<\/span>\u00a0the entire memory space at once. Bi-abduction is a logical inference method that helps\u00a0<\/span>Infer discover<\/span>\u00a0properties about different parts of the code, allowing it to focus only on the modified sections during subsequent analyses.<\/span><\/p>\n

By combining<\/span>\u00a0these approaches<\/span>, this tool can<\/span>\u00a0find complex problems in modifications to an application built from millions of lines of\u00a0<\/span>code<\/span> in a short time.<\/span><\/p>\n

3.1. Infer Phases<\/h3>\n
<\/div>\n

Infer operates in two main phases regardless of the input language: the capture phase<\/a> and the analysis phase<\/a>.<\/p>\n

During the capture phase, Infer captures compilation commands to translate the files for analysis into its internal intermediate language.<\/strong> This translation is similar to compilation, so Infer takes information from the compilation process to perform its own translation. Also, this is the reason why we call Infer with a compilation command such as:<\/p>\n

infer run -- javac File.java<\/code><\/pre>\n
Therefore, the files get compiled as usual, and Infer also translates them to be analyzed in the second phase. Infer stores the intermediate files in the results directory, which is called infer-out\/by<\/em> default and is created in the folder where the infer command is invoked.<\/p>\n
Also, we can invoke only the capture phase using the capture<\/em> subcommand:<\/p>\n
infer capture -- javac File.java<\/code><\/pre>\n
In the analysis phase, files in infer-out\/<\/em> are analyzed individually by Infer. Each function and method is analyzed separately. If Infer encounters an error during the analysis of a method or function, it stops analysis for that specific entity but continues with others.<\/strong> Hence, a typical workflow involves running Infer on the code, addressing identified errors, and rerunning Infer to discover additional issues or confirm fixes.<\/p>\n
Detected errors are reported in the standard output and in a file named infer-out\/report.txt<\/em>. Infer filters and highlight bugs that are most likely to be authentic.<\/p>\n
We can invoke only the analysis phase using the analyze<\/em> subcommand:<\/p>\n
infer analyze<\/code><\/pre>\n
3.2. Infer Global and Differential Workflows<\/h3>\n
<\/div>\n
By default, Infer will delete the previous infer-out\/<\/em> directory if existing. This leads to a global workflow<\/a>, where the entire project is analyzed each time.<\/p>\n
Passing –reactive<\/em> or -r<\/em> to Infer prevents in from deleting infer-out\/<\/em> directory, leading to a differential workflow<\/a>. For example, mobile apps use incremental build systems, where code evolves as a sequence of code changes. For these changes, it would make sense to analyze only the current changes in the project, instead of analyzing the whole project each time. Therefore, we can take advantage of Infer’s reactive mode and switch to a differential workflow.<\/p>\n
3.3. Analyzing Projects<\/h3>\n
<\/div>\n
To analyze files with Infer we can use compilers such as javac<\/em> and clang<\/em>. Also, we can use gcc<\/em>, although Infer will use clang<\/em> internally. Moreover, we can use Infer with various build systems.<\/p>\n
One popular build system for Java is Maven<\/a>, and we can use together with Infer in the following way:<\/p>\n
infer run -- mvn <maven target><\/code><\/pre>\n
Also, we can use Infer together with Gradle<\/a>:<\/p>\n
infer run -- gradle <gradle task><\/code><\/pre>\n