Software testing code analysis tutorials and videos

Software Composition Analysis: A Key Element of Software Testing and Quality Assurance

Software Testing Magazine — Tue, 16 Jul 2024 15:42:27 +0000

In the ever-evolving landscape of software development, ensuring the security, reliability, and quality of software products is paramount. One critical aspect of this process is Software Composition Analysis (SCA), which plays a vital role in software testing and quality assurance. SCA helps organizations identify and manage the risks associated with the use of open-source components, libraries, and dependencies in their software applications. This article explores the importance, methodologies, and benefits of SCA in the context of software testing and quality assurance. Understanding Software Composition Analysis (SCA) Software Composition Analysis involves scanning and analyzing the components and dependencies used in a software application to identify known vulnerabilities, licensing issues, and potential risks. Modern software development relies heavily on open-source components, which can significantly accelerate the development process. However, these components may come with inherent risks, such as security vulnerabilities, outdated versions, and incompatible licenses. SCA aims to mitigate these risks by providing comprehensive insights into the software’s composition. By leveraging advanced SCA tools, developers can gain visibility into the software’s makeup, allowing them to make informed decisions about the components they use. The Role of SCA in Software Testing Identifying Security Vulnerabilities One of the primary functions of SCA is to identify security vulnerabilities in the open-source components used within an application. Many open-source libraries and frameworks have publicly disclosed vulnerabilities that can be exploited by malicious actors. By integrating SCA into the software testing process, developers can detect and address these vulnerabilities early in the development lifecycle, reducing the risk [...]

The post Software Composition Analysis: A Key Element of Software Testing and Quality Assurance first appeared on Software Testing Magazine.

Open Source JavaScript Code Analysis

Software Testing Magazine — Mon, 15 Apr 2024 16:00:47 +0000

The quality of the JavaScript code is often verified with the traditional activities of unit and functional testing. There are however tools that allow checking code before or during its execution to assess its quality and its adherence to coding standards using a process called code analysis. This article presents a list of open source tools to perform static and dynamic code analysis on JavaScript programs. If static code analysis can be performed individually on each piece of JavaScript code, modern software development organizations will integrate these tools in their continuous integration or delivery process. This automated approach prevents code that is bad or doesn’t respect the coding standards to reach the production stage. Dynamic code analysis the software when it is performed by executing programs on a real or virtual processor. The two main know open source tools used for JavaScript code analysis are JSLint and JSHint, the second being a fork of the first one. Developed by the famous Douglas Crockford, JSLint can be considered as the main inspiration of the JavaScript open source code analysis tools family. There are however many different tools that try to achieve the same goal and you might find something more suited to your own needs in the list below, especially if you work in specific JavaScript frameworks and contexts like Node.js, Angular, React, Vue, Express or TypeScript. Updates April 2024 * added CallGraph, Tencent CodeAnalyis, Joern, Jsinspect * updated Crawljax (website), Flow (website) * removed Codemodel-Rifle (archived), SourceCodeSniffer (404) March 2023 [...]

The post Open Source JavaScript Code Analysis first appeared on Software Testing Magazine.

Code Red: The Business Impact of Code Quality

Software Testing Magazine — Mon, 26 Jun 2023 16:17:55 +0000

Code quality is an abstract concept that fails to get traction at the business level. Consequently, software companies keep trading code quality for new features. The resulting technical debt is estimated to waste up to 42% of developers’ time, causing stress and uncertainty, as well as making our job less enjoyable than it should be. Without clear and quantifiable benefits, it’s hard to build a business case for code quality. In this talk, Adam Tornhill takes on the challenge by tuning the code analysis microscope towards a business outcome. We do that by combining novel code quality metrics with analyses of how the engineering organization works with the code. We then take those metrics a step further by connecting them to values like time-to-market, customer satisfaction, and road-map risks. This makes it possible to a) prioritize the parts of your system that benefit the most from improvements, b) communicate quality trade-offs in terms of actual costs, and c) identify high-risk parts of the application so that we can focus our efforts on the areas that need them the most. All recommendations are supported by data and brand new real-world research. This is a perspective on software development that will change how you view code. Video producer: https://yowcon.com/

The post Code Red: The Business Impact of Code Quality first appeared on Software Testing Magazine.

Code Analysis Tools for C++

Software Testing Magazine — Mon, 28 Nov 2022 16:44:06 +0000

This presentation explores the current capabilities of existing C++ static analyzers and discuss some of the enforcements listed in the C++ Core Guidelines from a toolability aspect. It also looks into the recent “Simplify C++” trend in the language’s evolution. Finally, it explores how technology-specific analysis (like MISRA and AUTOSAR) is being adopted. Martin Fowler once wrote that high-quality software is actually cheaper to produce than low-quality software. We agree with that sentiment, and we warmly welcomed the C++ Core Guidelines when they were introduced in 2015. Research and surveys conducted in the C++ Community consistently demonstrate the popularity of the Clang family of tools, as well as the growing demand for static analysis to be added to code editors. Video producer: https://ndctechtown.com/

The post Code Analysis Tools for C++ first appeared on Software Testing Magazine.

Shifting QA Left: Emerging Trends in Code Quality and Security Automation

Software Testing Magazine — Wed, 15 Jun 2022 15:07:26 +0000

This talk discusses various advances in program analysis technology that enable a larger class of bugs to be detected earlier in software development projects (and even to be automatically fixed in some cases). It focuses particularly on recent developments that enable tight integration of program analysis tools into DevOps processes. These new techniques have been pioneered by academia and operationalized at scale (billions of lines of code / thousands of commits per day) by large tech companies such as Google and Facebook. The talk concludes with the best practices for software development organizations interesting in incorporating modern program analysis into their workflow. Video producer: https://itrevolution.com/

The post Shifting QA Left: Emerging Trends in Code Quality and Security Automation first appeared on Software Testing Magazine.

Disrupting QA: Trends in Code Quality Automation

Software Testing Magazine — Mon, 13 Jan 2020 14:59:08 +0000

This presentation reviews recent developments in code analysis as well as the history of static analysis in commercial software and its evolution in the academic world. It provides an overview of the current commercial landscape, and conclude with best practices for organizations looking to bring static analysis into their software development environment and software testing practices. Historically, static code analysis has been widely used to identify defined sets of security issues via overnight runs across entire code bases. A recent trend has been the evolution of static analysis methods and tools to: 1. become much more scalable and 2. leverage machine learning to substantially improve code quality. These improvements allow a much tighter integration of these software quality assurances practices into modern agile development processes. At the same time, the scope of these code analysis tools has broadened from purely security-relevant bugs to performance and reliability issues like memory leaks and data races. Google and Facebook have pioneered a new model of static analysis deployment that involves improving developer productivity via broad deployment of extremely scalable static analysis (billions of lines of code / thousands of commits per day). Video producer: https://gotocph.com/

The post Disrupting QA: Trends in Code Quality Automation first appeared on Software Testing Magazine.

Test Suites and Program Analysis

Software Testing Magazine — Mon, 15 Aug 2016 15:11:21 +0000

Specializing static analysis techniques for test suites has yielded interesting results. We’ve previously learned that most tests are simple straight-line code, namely a sequence of setup statements followed by a payload consisting of asserts. We show how static analysis can identify useless setup statements, enabling developers to simplify and speed up their test cases. Video producer: https://developers.google.com/google-test-automation-conference/

The post Test Suites and Program Analysis first appeared on Software Testing Magazine.

Static Analysis for C++

Software Testing Magazine — Mon, 30 May 2016 15:11:02 +0000

Static analysis tools have the potential to significantly improve programmer productivity as well as the safety, reliability and efficiency of the code they write. Modern static analysis has moved well beyond the mental model people often have based on “lint”: just finding simple typos. Static analysis can find subtle, complex bugs early, identify opportunities to improve performance, encourage consistent style and appropriate usage of libraries and APIs. This talk looks at the different purposes static analysis tools can be used to meet all these different goals. It will present specific examples from our experience working with sophisticated analysis tools on large, commercial codebases. The talk will also present a specific implementation of a modern static analysis toolkit for C++. This toolkit is being used in a number of different contexts: to provide tool-based enforcement of new coding guidelines and rules, to migrate people to modern C++ coding idioms and to find important security and reliability defects. Video producer: http://cppcon.org/

The post Static Analysis for C++ first appeared on Software Testing Magazine.