Static Analysis for Scala

Vitaly Olegovich AFANASYEV; Alexey Evgenevich BORODIN; Andrey Andreevich BELEVANTSEV

doi:10.15514/ISPRAS-2024-36(3)-1

Static Analysis for Scala

Vitaly Olegovich AFANASYEV, Alexey Evgenevich BORODIN, Andrey Andreevich BELEVANTSEV

https://doi.org/10.15514/ISPRAS-2024-36(3)-1

Full Text:

PDF (Rus) |

Generate QR code

Abstract

The paper describes a static analyzer for finding defects in Scala programs. The proposed analysis scheme uses JVM bytecode produced during compilation. The generated bytecode is used as an input for inter-procedural static analyzer Svace. In contrast to the analysis of other languages supported by Svace, in this work we describe an approach that does not require compiler modifications and therefore simplifies language support. This approach can also be used in static analyzers that aim to support a large number of programming languages.

Keywords

static analysis, search for defects, vulnerabilities, Scala, JVM, bytecode, Svace

About the Authors

Vitaly Olegovich AFANASYEV

Ivannikov Institute for System Programming of the RAS National Research University Higher School of Economics
Russian Federation

ISP RAS researcher, graduate student at the Faculty of Computer Science, NRU HSE. Research interests: compiler technologies, static analysis, JVM languages.

Alexey Evgenevich BORODIN

Ivannikov Institute for System Programming of the RAS
Russian Federation

Cand. Sci. (Phys.-Math.), researcher. Research interests: static analysis for finding errors in source code.

Andrey Andreevich BELEVANTSEV

Ivannikov Institute for System Programming of the RAS Moscow State University
Russian Federation

Dr. Sci (Phys.-Math.), Leading Researcher at ISP RAS, Professor at MSU. Research interests: static analysis, program optimization, parallel programming.

References

1. Иванников В.П., Белеванцев А.А., Бородин А.Е., Игнатьев В.Н., Журихин Д.М., Аветисян А.И., Леонов М.И. Статический анализатор Svace для поиска дефектов в исходном коде программ. Труды Института системного программирования РАН. 2014;26(1):231-250. https://doi.org/10.15514/ISPRAS-2014-26(1)-7.

2. A. Belevantsev, A. Borodin, I. Dudina, V. Ignatiev, A. Izbyshev, S. Polyakov, D. Zhurikhin. Design and development of Svace static analyzers. In 2018 Ivannikov Memorial Workshop (IVMEM):3—9, 2018.

3. Scala docs. Jdk compatibility. Английский. URL: https://docs.scala-lang.org/overviews/jdk-compatibility/overview.html (дата обращения 07.03.2024).

4. Scala.js. Harness the scala and javascript ecosystems together. develop robust apps for browsers, node.js, and serverless. Английский. URL: https://www.scala-js.org/ (дата обращения 07.03.2024).

5. Scala native. Английский. URL: https://scala-native.org/en/stable/ (дата обращения 07.03.2024).

6. Tiobe. Английский. URL: https://www.tiobe.com/tiobe-index/ (дата обращения 07.03.2024).

7. Scala users. Why Scala instead of Java? Английский. URL: https://users.scala-lang.org/t/why-scala-instead-of- java/9457/14 (дата обращения 07.03.2024).

8. A. Belevancev, A. Izbyshev, D. Zhurikhin. Monitoring program builds for svace static analyzer. System administrator, (7-8):135—139, 2017.

9. Афанасьев В.О., Поляков С.А., Бородин А.Е., Белеванцев А.А. Kotlin с точки зрения разработчика статического анализатора. Труды Института системного программирования РАН. 2021;33(6):67-82. https://doi.org/10.15514/ISPRAS-2021-33(6)-5.

10. Sbt. A simple build tool. Английский. URL: https://www.scala-sbt.org/ (дата обращения 07.03.2024).

11. Sbt. Compiler interface. Английский. URL: https://www.scala- sbt.org/1.x/docs/Compiler-Interface.html (дата обращения 07.03.2024).

12. Gradle. Gradle daemon. Английский. URL: https://docs.gradle.org/current/userguide/gradle_daemon.html (дата обращения 07.03.2024).

13. Sbt. Sbt server. Английский. URL: https://www.scala-sbt.org/1.x/docs/sbt-server.html (дата обращения 07.03.2024).

14. Меркулов А.П., Поляков С.А., Белеванцев А.А. Анализ программ на языке Java в инструменте Svace. Труды Института системного программирования РАН. 2017;29(3):57-74. https://doi.org/10.15514/ISPRAS-2017-29(3)-5.

15. E. Bodden. The secret sauce in efficient and precise static analysis: the beauty of distributive, summary-based static analyses (and how to master them). В Companion Proceedings for the ISSTA/ECOOP 2018 Workshops, страницы 85—93, 2018.

16. D. Engler, D.Y. Chen, S. Hallem, A. Chou, B. Chelf. Bugs as deviant behavior: a general approach to inferring errors in systems code. ACM SIGOPS Operating Systems Review, 35(5):57—72, 2001.

17. Белеванцев А.А., Велесевич Е.А. Анализ сущностей программ на языках Си/Си++ и связей между ними для понимания программ. Труды Института системного программирования РАН. 2015;27(2):53-64. https://doi.org/10.15514/ISPRAS-2015-27(2)-4.

18. Афанасьев В.О., Бородин А.Е., Вихлянцев К.И., Белеванцев А.А. Статический анализ на основе обобщённого абстрактного синтаксического дерева. Труды Института системного программирования РАН, 2023, 35(6):103—120, https://doi.org/10.15514/ISPRAS-2023-35(6)-6.

19. Spotbugs. Find bugs in java programs. Английский. URL: https://https://spotbugs.github.io/ (дата обращения 18.03.2024).

20. N. Ayewah, W. Pugh, D. Hovemeyer, J. D. Morgenthaler, J. Penix. Using static analysis to find bugs. IEEE software, 25(5):22—29, 2008.

21. Spotbugs/sonar-findbugs. Does findbugs support scala code? Английский. URL: https://github.com/spotbugs/sonar-findbugs/issues/292 (дата обращения 20.03.2024).

22. Sonar rules. Scala static code analysis. Английский. URL: https://rules.sonarsource.com/scala/ (дата обращения 20.03.2024).

23. Sonarsource. Slang. Английский. URL: https: //github.com/SonarSource/slang/blob/master/README.md (дата обращения 20.03.2024).

24. Scalafix. Refactoring and linting tool for scala. Английский. URL: https://scalacenter.github.io/scalafix/ (дата обращения 20.03.2024).

25. Scapegoat. Scala compiler plugin for static code analysis. Английский. URL: https://github.com/scapegoat- scala/scapegoat/tree/master (дата обращения 20.03.2024).

26. Checkmarx. Sast scanner - supported languages and frameworks. Английский. URL: https://checkmarx.com/resource/documents/en/34965- 149060-sast-scanner---supported-languages-and- frameworks.html (дата обращения 20.03.2024).

27. Checkmarx. Query coding example. Английский. URL: https://checkmarx.atlassian.net/wiki/spaces/KC/pages/5406757/Query+Coding+Example (дата обращения 20.03.2024).

28. J. R. B. Higuera, J. B. Higuera, J. A. S. Montalvo, J. C. Villalba, J. J. N. Pe´rez. Benchmarking approach to compare web applications static analysis tools detecting owasp top ten security vulnerabilities. Computers, Materials & Continua, 64(3), 2020.

29. Owasp. Owasp benchmark. Английский. URL: https://owasp.org/www-project-benchmark/ (дата обращения 18.03.2024).

Review

For citations:

AFANASYEV V.O., BORODIN A.E., BELEVANTSEV A.A. Static Analysis for Scala. Proceedings of the Institute for System Programming of the RAS (Proceedings of ISP RAS). 2024;36(3):9-20. (In Russ.) https://doi.org/10.15514/ISPRAS-2024-36(3)-1

This work is licensed under a Creative Commons Attribution 4.0 License.

ISSN 2079-8156 (Print)
ISSN 2220-6426 (Online)

Username
Password
	Remember me
Not a user? Register with this site Forgot your password?

User

Proceedings of the Institute for System Programming of the RAS (Proceedings of ISP RAS)

Static Analysis for Scala

Full Text:

Abstract

Keywords

About the Authors

References

Review

For citations:

Cookies policy