Many different tools have to be used to check software quality. In particular, they include static and dynamic analysis tools. In this article, we will try to understand why one methodology, either static or dynamic analysis, may not be sufficient for comprehensive program analysis and why it is better to use these two approaches together. Static code analysis is the process of identifying errors and flaws in the source code of programs. It is not necessary to run the program for its execution, all analysis will be performed on the existing code base. The closest analogy that can be made with static code analysis is the so-called code review process, only automated (which is performed by a robot program). Note that the use of static code analysis is not limited to the detection of errors in the program. Some static analyzers allow you to check whether the source code conforms to the company’s accepted code design standard.
Dynamic code analysis is a way of analyzing a program directly during its execution. The analysis is performed with the help of a set of data that is provided as an input to the program under study. Therefore, the effectiveness of the analysis directly depends on the quality and quantity of input data for testing. It is from them that the completeness of the code coverage depends, which will be obtained as a result of testing. Dynamic testing is most important in those industries where the main criterion is the reliability of the program, response time or consumed resources. It can be, for example, a real-time system that manages a responsible area of production, or a database server. In such areas, any mistake made can be critical.
TABBY is a static code analysis tool for the Java language.
Checks source code for security issues by scanning the Go AST.
A tracing and debugging tool for PHP scripts.
Static security code scanner (SAST) for Node.js.
Static security code scanner for Python programs.
Very fast PHP tool to scan ADOdb code for SQL injections.
Static PHP code analyzer for finding potential vulnerabilities.
Hades – a system for detecting static vulnerabilities in code.
Bandit is a tool designed to quickly find common security issues in Python code.
A Golang tool that performs static analysis, code review, and generates a code quality report.
Is a CodeQL helper that extracts comments from code and can generate codeql qll library modules.
Static analysis of Python web applications based on theoretical foundations (control flow graphs, fixed point, data flow analysis)
GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA (single static assignment) form of Go source code.
Cobra is a source code security auditing tool that supports the discovery of security issues in the source code of a wide range of development languages.