7.5 KiB

Raw Blame History

static-analysis

Comprehensive static analysis for defect detection and code quality assessment.

Context

This task performs deep static analysis to identify bugs, anti-patterns, security vulnerabilities, and code quality issues without executing the code. It combines multiple analysis techniques to provide a comprehensive view of potential problems.

Task Execution

Phase 1: Multi-Layer Analysis

Layer 1: Syntax and Style Analysis

Syntax Errors: Malformed code that won't compile/run
Style Violations: Inconsistent formatting, naming conventions
Dead Code: Unreachable code, unused variables/functions
Code Duplication: Copy-paste code blocks

Layer 2: Semantic Analysis

Type Issues: Type mismatches, implicit conversions
Logic Errors: Always true/false conditions, impossible states
Resource Leaks: Unclosed files, unreleased memory
API Misuse: Incorrect parameter order, deprecated methods

Layer 3: Flow Analysis

Control Flow: Infinite loops, unreachable code, missing returns
Data Flow: Uninitialized variables, unused assignments
Exception Flow: Unhandled exceptions, empty catch blocks
Null Flow: Potential null dereferences

Layer 4: Security Analysis

Injection Vulnerabilities: SQL, XSS, command injection
Authentication Issues: Hardcoded credentials, weak crypto
Data Exposure: Sensitive data in logs, unencrypted storage
Access Control: Missing authorization, privilege escalation

Phase 2: Pattern Detection

Anti-Patterns to Detect

Code Smells:

- God Classes/Functions (too much responsibility)
- Long Parameter Lists (>3-4 parameters)
- Feature Envy (excessive external data access)
- Data Clumps (repeated parameter groups)
- Primitive Obsession (overuse of primitives)
- Switch Statements (missing polymorphism)
- Lazy Class (too little responsibility)
- Speculative Generality (unused abstraction)
- Message Chains (deep coupling)
- Middle Man (unnecessary delegation)

Performance Issues:

- N+1 Queries (database inefficiency)
- Synchronous I/O in async context
- Inefficient Algorithms (O(n²) when O(n) possible)
- Memory Leaks (retained references)
- Excessive Object Creation (GC pressure)
- String Concatenation in Loops
- Missing Indexes (database)
- Blocking Operations (thread starvation)

Concurrency Issues:

- Race Conditions (unsynchronized access)
- Deadlocks (circular wait)
- Thread Leaks (unclosed threads)
- Missing Volatile (visibility issues)
- Double-Checked Locking (broken pattern)
- Lock Contention (performance bottleneck)

Phase 3: Complexity Analysis

Metrics Calculation

Cyclomatic Complexity: Number of linearly independent paths
Cognitive Complexity: How difficult code is to understand
Halstead Metrics: Program vocabulary and difficulty
Maintainability Index: Composite maintainability score
Technical Debt: Estimated time to fix all issues
Test Coverage: Lines/branches/functions covered

Thresholds

Cyclomatic Complexity:
- Good: < 10
- Acceptable: 10-20
- Complex: 20-50
- Untestable: > 50

Cognitive Complexity:
- Simple: < 5
- Moderate: 5-10
- Complex: 10-15
- Very Complex: > 15

Phase 4: Dependency Analysis

Identify Issues

Circular Dependencies: A→B→C→A cycles
Version Conflicts: Incompatible dependency versions
Security Vulnerabilities: Known CVEs in dependencies
License Conflicts: Incompatible license combinations
Outdated Packages: Dependencies needing updates
Unused Dependencies: Declared but not used

Phase 5: Architecture Analysis

Structural Issues

Layer Violations: Cross-layer dependencies
Module Coupling: High interdependence
Missing Abstractions: Direct implementation dependencies
Inconsistent Patterns: Mixed architectural styles
God Objects: Central points of failure

Automated Tools Integration

Simulate output from common static analysis tools:

ESLint/TSLint (JavaScript/TypeScript) Pylint/Flake8 (Python) SonarQube (Multi-language) PMD/SpotBugs (Java) RuboCop (Ruby) SwiftLint (Swift)

Output Format

# Static Analysis Report

## Executive Summary

**Files Analyzed:** [count]
**Total Issues:** [count]
**Critical:** [count] | **High:** [count] | **Medium:** [count] | **Low:** [count]
**Technical Debt:** [hours/days estimated]
**Code Coverage:** [percentage]

## Critical Issues (Immediate Action Required)

### Issue 1: [Security Vulnerability]

**File:** [path:line]
**Category:** Security
**Rule:** [CWE-ID or rule name]

```[language]
// Vulnerable code
[code snippet]
```

Risk: [Description of security risk] Fix:

// Secure code
[fixed code]

Issue 2: [Logic Error]

[Similar format]

High Priority Issues

Category: Performance

File	Line	Issue	Impact	Fix Effort
[file]	[line]	N+1 Query	High latency	2 hours
[file]	[line]	O(n²) algorithm	CPU spike	4 hours

Category: Reliability

[Similar table format]

Code Quality Metrics

Complexity Analysis

File	Cyclomatic	Cognitive	Maintainability	Action
[file]	45 (High)	28 (High)	35 (Low)	Refactor
[file]	32 (Med)	18 (Med)	55 (Med)	Review

Duplication Analysis

Total Duplication: [percentage] Largest Duplicate: [lines] lines in [files]

Top Duplicated Blocks:

[File A:lines] ↔ [File B:lines] - [line count] lines
[File C:lines] ↔ [File D:lines] - [line count] lines

Anti-Pattern Detection

God Classes

[ClassName] - [methods] methods, [lines] lines
- Responsibilities: [list]
- Suggested Split: [recommendations]

Long Methods

[methodName] - [lines] lines, complexity: [score]
- Extract Methods: [suggestions]

Security Scan Results

Vulnerabilities by Category

Injection: [count]
Authentication: [count]
Data Exposure: [count]
Access Control: [count]

Detailed Findings

[List each with severity, location, and fix]

Dependency Analysis

Security Vulnerabilities

Package	Version	CVE	Severity	Fixed Version
[pkg]	[ver]	[CVE-ID]	Critical	[ver]

Outdated Dependencies

Package	Current	Latest	Breaking Changes
[pkg]	[ver]	[ver]	[Yes/No]

Recommendations

Immediate Actions (This Sprint)

Fix all critical security vulnerabilities
Resolve high-severity logic errors
Update vulnerable dependencies

Short-term (Next Sprint)

Refactor high-complexity functions
Remove code duplication
Add missing error handling

Long-term (Technical Debt)

Architectural improvements
Comprehensive refactoring
Test coverage improvement

Trend Analysis

Compared to Last Scan:

Issues: [+/-X]
Complexity: [+/-Y]
Coverage: [+/-Z%]
Technical Debt: [+/-N hours]


## Completion Criteria
- [ ] All analysis layers completed
- [ ] Issues categorized by severity
- [ ] Metrics calculated
- [ ] Anti-patterns identified
- [ ] Security vulnerabilities found
- [ ] Dependencies analyzed
- [ ] Recommendations prioritized
- [ ] Fixes suggested for critical issues

7.5 KiB Raw Blame History