Top 10 static code analysis tool DevOps Courses - http://www.scmgalaxy.com/courses/ Twitter - https://twitter.com/scmgalaxy Facebook - https://www.facebook.com/scmgalaxy/ Google+ - https://plus.google.com/113308486952865913652 Web - http://www.scmgalaxy.com/ YouTube - https://www.youtube.com/scmgalaxy Facebook - https://www.facebook.com/scmgalaxy

1. Top 10 Static Code
Analysis Tool
APPLICATION’S SECURITY ASSURANCE
1

2. Software security is a very important concern for todays Software market and
for that you need to do code analysis in the development lifecycle. Now we
can not imagine ourselves to sit back and do manual reading each line of
codes and find issues and bugs. Those days of manual review in the software
development lifecycle to find the flaws in the codesareovernow.
Now the mindsets has changed and developing quality & secure code from
the beginning is on rise. This is the time of automation and developers &
programmers are now shifting towards the adoption of tools which auto
detects the flaws as soon aspossible in the software development lifecycle.
2

3. As the process shifting towards the automation, static code
analysis (SCA) has become an important part of creating quality
code. Now the question here is, What is Static Code Analysis?
Static Code Analysis is a technique which quickly and
automatically scan the code line by line to find security flaws
and issues that might be missed in the development process
before the software or application is released. It functions by
reviewing the code without actuallyexecuting the code.
3

4. Thereare threemajor benefitsofStatic analysistools
1. Automation — Automation can save your time and energy which ultimately
means you can invest your time and energy in some other aspects of development
lifecycle, which will helpyoutorelease yoursoftwarefaster.
2. Security — Security is also one of the major concern and by adopting Static
analysis you can cut the doubt of security vulnerabilities in your application, which
will ensurethatyouaredelivering asecure andreliable software.
3.Implementation —Staticanalysis can beimplementedas earlyinthe software
development lifecycle (SDLC) as you have code to scan, it will give more time to fix
the issues discovered by the tool. The best thing of static analysis is that it can
detecttheexact line ofcodethat’sbeen foundtobe problematic.
4

5. Thereare so many Static codeanalysis tools are available toease our work
but to choose good tools among them is really a challenging task. I have
done some research and providing you the list of top 10 static code
analysis tools:-
1. VisualCodeGrepper
Visualcodegreeper is an open source automated code security review tool
which works with C++, C#, VB, PHP, Java and PL/SQL to track the
insecurities and different issues in the code. This tool rapidly review and
depicts in detail the issues it discovers, offering a simple to use interface. It
allows custom configurations of queries and it's updated regularly since
its creation (2012).
5

6. 4.YASCA
"Yet Another Source Code Analyzer (YASCA)" is an open source static code analysis tool
which supports HTML, Java, JavaScript, .NET, COBOL, PHP, ColdFusion, ASP, C/C++ and
some other languages. It is an easy to extend and a flexible tool which can integrate with
variety of other tools which includes CppCheck, Pixy, RATS, PHPLint, JavaScript Lint, JLint,
FindBugs andvariousothers.
5.Cppcheck
Cppcheck is an open source static code analysis tool for C/C++. Cppcheck basically
identifies the sorts of bugs that the compilers regularly don't recognize. The objective is to
identify just genuine mistakes in the code. It provides both interface command line mode
and graphical user interface (GUI) mode and has possibilities for environment integration.
Someof them areEclipse, Hudson,Jenkins,VisualStudio.
6

7. 6.Clang
Clang is also one of the best static code analysis tool for C, C++ and objective-C. This
analyzer can be run either as standalone tool or within Xcode. It is an open source tool and
a part of the clang project. It utilizes the clank library, hence forming a reusable component
andcanbeutilizedbymultipleclients.
7.RIPS
RIPS is a static code analyzer tool to detect different types for security vulnerabilities in PHP
codes. RIPS also provide integrated code audit framework for manual analysis. It is an open
sourcetooltooandcan becontrolledvia webinterface.
7

8. 8.Flawfinder
Flawfinder is also one of the best static analysis tool for C/C++. This tool is easy to
use and well designed. It reports possible security vulnerabilities sorted by risk level.
Itis anopensourcetoolwritteninpythonanduse commandline interface.
9.DevBug
DevBug is an online PHP static code analyzer which is very easy to use and written
on Javascript. It was intended to make essential PHP Static Code Analysis accessible
on the web, to raise security mindfulness and to incorporate SCA into the
development procedure. This analyzertoolis alsoavailableinopensource.
8

9. 10.SonarQube
SonarQube is one of the best and well known open source web based static code
analysis tool, it can scan projects written in many different programming languages
including ABAP, Android (Java), C, C++, CSS, Objective-C, COBOL, C#, Flex, Forms,
Groovy, Java, JavaScript, Natural, PHP, PL/SQL, Swift, Visual Basic 6, Web, XML,
Python and also allows a number of plug ins. What makes SonarQube really stand
outis that It providesmetricsabout yourcodewhichwilltohelpyou totaketheright
decision and translates these non-descript values to real business values such as risk
andtechnical debt.
9

10. So, above we mentioned top selective static code analysis tools which
can be helpful, but if you think this lists should contain some other tools
than feel freeto sharein comment box.
To make most out of these tools you need to have better understanding
and knowledge of these tools and DevOps culture. scmGalaxy provides
training and certification for DevOpsand it’s related tools.
Formore details contact us
info@scmGalaxy.com
Orvisit our website
www.scmGalaxy.com
10

11. Thank You!
11
twitter.com/scmGalaxy