List of tools for static code analysis

This is a list of tools for static code analysis.

Language

Multi-language
Tool Latest release Free software Duplicate
code		 Supported languages Notes
Apache Yetus 2020-12-17 (0.13.0) Yes; ASL 2 C, C++, Java, Perl, Python, Ruby, Shell, XML A collection of build and release tools. Included is the 'precommit' module that is used to execute full and partial/patch CI builds that provides static analysis of code via other tools as part of a configurable report. Built-in support may be extended with plug-ins.
Axivion Bauhaus Suite No; Proprietary Yes Ada, C, C++, C#, Java A static code analysis tool suite that performs various analyses such as architecture checking, interface analyses, MISRA checking, and clone detection.
Code Dx No; Proprietary Yes C, C++, C#, Java, JavaScript, JSP, PHP, Python, Rails, Ruby, Scala, VB.NET, XML [1] Software application vulnerability correlation and management system that uses multiple SAST and DAST tools, as well as the results of manual code reviews. Can calculate cyclomatic complexity.
CodeScene 2021-01-01 No; Proprietary Yes C, C++, C#, Java, Groovy, JavaScript, TypeScript, Objective-C, Scala, Python, Swift, Go, Visual Basic .Net, PHP, Ruby Behavioral code analysis based on revision control data. Can analyse any codebase, and supports X-Ray (or method-level analysis).
ConQAT (retired) 2015-02-01 Yes; ASL 2 C#, C++, Java, JavaScript, ABAP, Ada Continuous quality assessment toolkit that allows flexible configuration of quality analyses (architecture conformance, clone detection, quality metrics, etc.) and dashboards.
Coverity 2021-01-23 (2020.09)[2] No; Proprietary C, C++, C#, Objective-C, Java, Javascript, node.JS, Ruby, PHP, Python A static analysis tool. Free to use for open-source projects.
GrammaTech CodeSonar 2020-06-01 (5.3) No; Proprietary C, C++, Objective-C, Java Defect detection (buffer overruns, memory leaks, etc.), concurrency and security checks, architecture visualization and software metrics.
HCL Security AppScan Source 2020-12-01 (10.0.3) No; Proprietary C, C++, .NET, Java, JSP, JavaScript, ColdFusion, ASP, PHP, Perl, Visual Basic 6, PL/SQL, Python, T-SQL, COBOL Analyzes source code to identify security vulnerabilities while integrating security testing with software development processes and systems.
Facebook Infer 2020-10-12 (1.0.0) Yes; MIT C, C++, Java, Objective-C Targets null pointer problems, leaks, concurrency issues and API usage for Facebook's mobile apps. Available as open source on GitHub.
Imagix 4D 2020-10-01 (10.1.0) No; Proprietary C, C++, Java Windows and Linux versions.
Kiuwan 2020-07-22 No; Proprietary C, C++, C#, Objective-C, Java, JSP, JavaScript, PHP, ABAP, COBOL, JCL, PL/SQL, T-SQL, SQL, Visual Basic, VB.NET, Android Software Analytics end-to-end platform for static code analysis and automated code review. It covers defect detection, application security & IT Risk Management, with enhanced life cycle and application governance features. Support for over 20 languages.
Klocwork 2020-12-01 (2020.4) No; Proprietary C, C++, C#, Java. Provides security vulnerability, standards compliance (MISRA, ISO 26262 and others), defect detection and build-over-build trend analysis
LDRA Testbed No; Proprietary C, C++, Ada83, Ada95, Assembler (Intel, Freescale, Texas Instruments) A software analysis and testing tool suite.
MALPAS No; Proprietary Ada, C, Pascal, Assembler (Intel, PowerPC and Motorola) A software static analysis toolset for a variety of languages. Used primarily for safety critical applications in Nuclear and Aerospace industries.
Moose 2021-01-21 (7.0.3) Yes; MIT C, C++, Java, Smalltalk, .NET, Moose started as a software analysis platform with many tools to manipulate, assess or visualize software. It can evolve to a more generic data analysis platform.
PMD's Copy/Paste Detector (CPD) 2021-01-30 (6.31.0) Yes; BSD-like Yes C, C++, Java, JSP, ColdFusion, PHP, JavaScript duplicate code detection (e.g.) [3] code.
Polyspace No; Proprietary C, C++, and Ada Uses abstract interpretation to detect and prove the absence of certain run time errors in source code.
Pretty Diff 2019-04-21 (101.0.0) Yes; CC0 No Markup, script and style languages (like XML, Javascript, CSS) A language-specific code comparison tool that features language-specific analysis reporting in addition to language-specific minification and beautification algorithms.
PVS-Studio 2020-12-17 (7.11) No; Proprietary No C, C++, C++/CLI, C++/CX (Component Extensions), C#, Java A software analysis tool.
RIPS 2020-02-17 (3.4) No; Proprietary PHP, Java, Node.js A static code analysis solution with many integration options for the automated detection of complex security vulnerabilities.
Semgrep 2021-01-26 Yes; LGPL v2.1 No Go, Java, Javascript, JSON, Python, Ruby, language-agnostic mode A static analysis tool that helps expressing code standards and surfacing bugs early. It also has experimental support for eleven other languages. A CI service and a rule library is also available.
Sider 2021-02-02 No; Proprietary Ruby, Python, PHP, JavaScript, CoffeeScript, Go Static code analysis based automated code review tool working on GitHub and GitLab. Checks style, quality, dependencies, security and bugs. It integrates a number of open source static analysis tools.
SofCheck Inspector / Codepeer 2020-08-24 (21.x) No; Proprietary Yes Ada,Java Static detection of logic errors, race conditions, and redundant code. automatically extracts pre-postconditions from code.
SonarQube 2021-01-27 (8.6.1) Yes; LGPL v3.0 ABAP, Apex, C, C#, C++, CSS, COBOL, Flex, Go, HTML, Java, JavaScript, Kotlin, Objective-C, PHP, PLI, PL/SQL, Python, Ruby, Scala, Swift, TSQL, TypeScript, VB.NET, Visual Basic 6, XML A continuous inspection engine that finds vulnerabilities, bugs and code smells. Also tracks code complexity, unit test coverage and duplication.
SourceMeter 2016-12-16 (8.2) No; Proprietary Yes Java, C, C++, RPG IV (AS/400), Python A platform-independent, command-line static source code analyzer. Integrates with PMD and SpotBugs.
Sotoarc-Sotograph 2018-12-03 (5.0) No; Proprietary C, C++, C#, Java, ABAP Architecture and quality in-depth analysis and monitoring.
Squore 2020-11-27 (20.1) No; Proprietary Ada, C, C++, C#, Fortran, Java, Javascript, Objective-C, PHP, Python, PL/SQL, Swift, T-SQL, Typescript, VB.NET, XAML A multi-purpose and multi-language monitoring tool for software projects. It integrates with other scanners.
Understand 2020-09-21 (6.0) No; Proprietary Ada, Cobol, Ansi C, K&R C, Ansi C++, C#, FORTRAN, Java, Jovial, Pascal, PL/M, Python, VHDL, Objective C/C++, HTML, PHP, JavaScript, XML A multi-platform tool for code analysis and comprehension of large code bases.
Yasca (retired) 2010-11-01 (2.21) Yes C, C++, Java, JavaScript, ASP, PHP, HTML-CSS, ColdFusion, COBOL Yet Another Source Code Analyzer, a plugin-based framework to scan arbitrary file types, with plugins. It integrates with other scanners, including FindBugs, PMD, and Pixy.

.NET
Tool Latest release Free software Duplicate
code		 Notes
.NET Compiler Platform
(Codename Roslyn)		 Open-source compiler framework for C# and Visual Basic .NET developed by Microsoft .NET. Provides an API for analyzing and manipulating syntax.
CodeIt.Right Combines static code analysis and automatic refactoring to best practices which allows automatic correction of code errors and violations; supports C# and VB.NET.
CodeRush A plugin for Visual Studio which alerts users to violations of best practices.
FxCop Free static analysis for Microsoft .NET programs that compiles to CIL. Standalone and integrated in some Microsoft Visual Studio editions; by Microsoft.
NDepend Simplifies managing a complex .NET code base by analyzing and visualizing code dependencies, by defining design rules, by doing impact analysis, and by comparing different versions of the code. Integrates into Visual Studio.
StyleCop Analyzes C# source code to enforce a set of style and consistency rules. It can be run from inside of Microsoft Visual Studio or integrated into an MSBuild project.

Ada
Tool Latest release Free software Duplicate
code		 Notes
AdaControl A tool to control occurrences of various entities or programming patterns in Ada code, used for checking coding standards, enforcement of safety related rules, and support for various manual inspections. Features automatic fixing of violations.
CodePeer An advanced static analysis tool that detects potential run-time logic errors in Ada programs.
Fluctuat Abstract interpreter for the validation of numerical properties of programs.
LDRA Testbed A software analysis and testing tool suite for Ada83/95.
Polyspace Uses abstract interpretation to detect and prove the absence of certain run time errors in source code.
SofCheck Inspector

(Bought by AdaCore)

 Static detection of logic errors, race conditions, and redundant code for Ada; automatically extracts pre-postconditions from code.
SPARK Toolset Verification tools for SPARK 2014 – a subset of Ada 2012 that leverages Ada's support for contracts. Designed to offer soundness, depth, modularity and efficiency of verification.

C, C++
Tool Latest release Free software Duplicate
code		 Notes
Astrée No; Proprietary finds all potential runtime errors and data races by abstract interpretation, can prove their absence, and can prove functional assertions; tailored towards safety-critical C code (e.g. avionics and automotive). Includes MISRA checker.
BLAST (retired) 2015-10-30 (2.7.3) Yes; ASL 2 An open-source software model checker for C programs based on lazy abstraction (follow-on project is CPAchecker.[4]).
Clang 2021-01-14 (11.0.1) Yes; ASL 2 with LLVM Exceptions (v9.0.0<) An open-source compiler that includes a static analyzer.
Coccinelle 2019-09-25 (1.0.8) Yes; GPLv2 An open-source source code pattern matching and transformation.
Coverity 2019-12-14 (2020.12)[5] No; Proprietary A static analysis tool for C/C++.
CPAchecker Yes; ASL 2 A tool for execution path checking of C.
Cppcheck 2020-12-05 (2.3) Yes; GPL No Open-source tool that checks for several types of errors, including use of STL. MISRA support is being added.
Cppdepend 2021-01-01 (2021.1) No; Proprietary Simplifies managing a complex C/C++ code base by analyzing and visualizing code dependencies, by defining design rules, by doing impact analysis, and comparing different versions of the code.
cpplint Yes; ASL 2 An open-source tool that checks for compliance with Google's style guide for C++ coding.
ECLAIR No; Proprietary A platform for the automatic analysis, verification, testing and transformation of C and C++ programs.
Eclipse Yes An open-source IDE that includes a static code analyzer.
Fluctuat No; Proprietary Abstract interpreter for the validation of numerical properties of programs.
Frama-C Yes An open-source extensible analysis framework for C with several analyzers and a specification language common to all of them. Includes analyses based on abstract interpretation, deductive verification and runtime monitoring.
Helix QAC 2020.1 Formerly PRQA QA·C and QA·C++, deep static analysis of C/C++ for quality assurance and guideline/coding standard enforcement with MISRA support.
Infer 2020-10-12 (1.0.0) Yes; MIT Developed by an engineering team at Facebook with open-source contributors. Targets null pointer and other memory problems. Available as open-source on github.
Lint 1978-07-26 Yes; Permissive BSD-like[6] No The original, from 1978, static code analyzer for C.
LDRA Testbed 2019-07-30 (v9.8.1) A software analysis and testing tool suite for C/C++, that performs static analysis, standards enforcement (eg MISRA C/C++), dynamic analysis, unit testing and requirements traceability.
Parasoft C/C++test 10.4.2 No; Proprietary A C/C++ tool that does static analysis, unit testing, code review, and runtime error detection; plugins available for Visual Studio and Eclipse-based IDEs.
PC-Lint No A software analysis tool for C with partial support for C++2011.
Polyspace No Uses abstract interpretation to detect and prove the absence of run time errors, Dead Code in source code as well as used to check all MISRA (2004, 2012) rules (directives, non directives).
SLAM project a project of Microsoft Research for checking that software satisfies critical behavioral properties of the interfaces it uses.
Sparse Yes An open-source tool designed to find faults in the Linux kernel.
SonarQube 8.1 No Yes An open-source tool which offers C/C++ support via a commercial license. Able to calculate cyclomatic complexity.
Splint 3.1.2 Yes An open-source tool statically checking C programs for security vulnerabilities and coding mistakes.
Visual Studio No An IDE that provides static code analysis for C/C++ both in the editor environment and from the compiler command line.

Fortran
  • Fortran-Lint[7] (Information Processing Techniques, Inc)

IEC 61131-3
  • CODESYS Static Analysis - integrated add-on for CODESYS (application code realized e.g. in ST, FBD, LD)

Java
Tool Latest release Free software Duplicate
code		 Notes
Checkstyle 2020-01-26 Yes; LGPL No Besides some static code analysis, it can be used to show violations of a configured coding standard. Duplicate code detection was removed[8] from Checkstyle.
Coverity 2017-01-19 No; Proprietary Coverity is a static analysis and Static Application Security Testing (SAST) platform that finds critical defects and security weaknesses in code as it’s written before they become vulnerabilities, crashes, or maintenance headaches.
Eclipse 2017-06-28 Yes; EPL No Cross-platform IDE with own set of several hundred code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project. Plugins for Checkstyle, FindBugs, and PMD.
FindBugs 2015-03-06 Yes; LGPL Based on Jakarta BCEL from the University of Maryland. SpotBugs is the spiritual successor of FindBugs, carrying on from the point where it left off with support of its community.
Infer 2017-10-19 Yes; BSD with additio-
nal patent clause		 Developed by an engineering team at Facebook with open-source contributors. Targets null pointer exceptions, leaks, and thread safety issues.
IntelliJ IDEA 2017-11-30 Yes; ASL 2 Yes A leading Java IDE with built-in code inspection and analysis. Plugins for Checkstyle, FindBugs, and PMD.
JArchitect 2017-06-11 No; Proprietary Simplifies managing a complex code base by analyzing and visualizing code dependencies, defining design rules, doing impact analysis, and by comparing different versions of the code.
Jtest 2019-05-21 No; Proprietary Yes Testing and static code analysis product by Parasoft.
LDRA Testbed No; Proprietary Analysis and testing tool suite.
PMD 2020-10-24 Yes; BSD, ASL 2, LGPL Yes A static ruleset based source code analyzer that identifies potential problems.
RIPS 2019-01-07 No; Proprietary Language-specific source code analysis solution with many integration options for accurate detection of complex security and quality issues.
Semgrep 2021-01-26 Yes; LGPL v2.1 No A static analysis tool that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available.
SemmleCode No; Proprietary Object oriented code queries for static program analysis.
Soot 2020-10-28 Yes; LGPL A language manipulation and optimization framework consisting of intermediate languages.
Squale 2011-05-26 Yes; LGPL A platform to manage software quality.
SourceMeter 2016-02-01 No; Proprietary Yes A platform-independent, command-line static source code analyzer.
ThreadSafe 2014-03-28 No; Proprietary A static analysis tool focused on finding concurrency bugs.

JavaScript
  • ESLint – JavaScript syntax checker and formatter.
  • Google's Closure Compiler – JavaScript optimizer that rewrites code to be faster and smaller, and checks use of native JavaScript functions.
  • JSHint – A community driven fork of JSLint.
  • JSLint – JavaScript syntax checker and validator.
  • Semgrep – A static analysis tool that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available.

Objective-C, Objective-C++
  • Clang – The free Clang project includes a static analyzer. As of version 3.2, this analyzer is included in Xcode.[9]
  • Infer – Developed by an engineering team at Facebook with open-source contributors. Targets null pointers, leaks, API usage and other lint checks. Available as open source on github.

Opa
  • Opa includes its own static analyzer. As the language is intended for web application development, the strongly statically typed compiler checks the validity of high-level types for web data, and prevents by default many vulnerabilities such as XSS attacks and database code injections.

Packaging
  • Lintian – Checks Debian software packages for common inconsistencies and errors.
  • Rpmlint – Checks for common problems in rpm packages.

Perl

PL/SQL

Python
  • PyCharm – Cross-platform Python IDE with code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project.
  • PyDev – Eclipse-based Python IDE with code analysis available on-the-fly in the editor or at save time.
  • Pylint – Static code analyzer. Quite stringent; includes many stylistic warnings as well.
  • Semgrep – Static code analyzer that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available.

Transact-SQL

Formal methods tools

Tools that use sound, i.e. over-approximating a rigorous model, formal methods approach to static analysis (e.g., using static program assertions). Sound methods contain no false negatives for bug-free programs, at least with regards to the idealized mathematical model they are based on (there is no "unconditional" soundness). Note that there is no guarantee they will report all bugs for buggy programs, they will report at least one.

See also

References
  1. "Supported Application Security Testing Tools and Languages". codedx.com. Retrieved Apr 25, 2017.
  2. "Coverity Scan website". Retrieved 2021-02-02.
  3. "PMD - Browse /pmd/5.0.0 at SourceForge.net". Retrieved Dec 9, 2012.
  4. "CPAchecker". 2015-02-08.
  5. "SIG Customer Community". community.synopsys.com. Retrieved 2021-02-02.
  6. "UNIX is free!". lemis.com. 2002-01-24.
  7. Lint for FortranDenis W. Haskin (May 2, 1988). "Shaking down your FORTRAN programs". Digital Review. pp. 41–47. similar to DEC's Source Code Analyzer, .. comes into play much earlier .. before users compile their programs
  8. https://github.com/checkstyle/checkstyle/issues/523
  9. "Static Analysis in Xcode". Apple. Retrieved 2009-09-03.
  10. "Visual Expert for Oracle - PL/SQL Code Analyzer". www.visual-expert.com. 2017-08-24.
  11. "Visual Expert for SQL Server - Transact SQL Code Analyzer". www.visual-expert.com. 2017-08-24.
  12. Cousot, Patrick (2007). "The Role of Abstract Interpretation in Formal Methods". Fifth IEEE International Conference on Software Engineering and Formal Methods (SEFM 2007). IEEE International Conference on Software Engineering and Formal Methods. pp. 135–140. doi:10.1109/SEFM.2007.42. ISBN 978-0-7695-2884-7.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.