3 ms·

Could you name them? Especially those that find more stuff than the others along with how you rate them on false positives? I try to collect data to pass on to

Could you name them? Especially those that find more stuff than the others along with how you rate them on false positives? I try to collect data to pass on to folks interested in trying static analysis.

Zarel 8y ago
https://lgtm.com/ https://lgtm.com/ LGTM recently came by my project offering to integrate with GitHub. It's found a decent number of bugs other linters and my test suite didn't find, and it didn't require any setup at all; you just open your project on their website. Their staff also reacted really quickly when I asked them questions or reported bugs. For the most part, their only false positives are things like unreachable code, which I sometimes used to leave in for future-proofing, but I eventually did things their way, because it does make sense that it could be confusing to a third party. The only alert I've ever suppressed was a string search for "example.com", which could have matched "example.com.untrusted-attacker.com". It was just code for displaying a reminder, not anything security-critical, so I didn't think it was worth fixing.
noir_lord 8y ago
Sure though the line between linter, type checker and static analysis is blurry (so I'll use the "suggest improvements without execution") because of the languages I work in. For PHP :- PHP Inspections (EA Extended) (commercial variant, free one is good as well) - Hands down my favourite for PHP because it integrates so well with my IDE, I wouldn't write PHP without it - very few false positives, when it flags something if I don't immediately understand I go look at why it's flagging it, I've learnt stuff I didn't know after nearly a decade of using PHP. Phan - Very good and getting better all the time. PHP_CodeSniffer (more useful for making sure you stick to a particular standard say PSR2 - IDE's can do this but code sniffer can be part of you pipeline/commit handling) PHPStan - Very powerful but if you didn't start with this or are bringing it on an existing codebase..well it'll find a lot, on max it will flag what seems like everything but it's configurable and its most technically correct. For TypeScript - TSLint w/ tslint-microsoft-contrib. For C# - ReSharper For bash - ShellCheck I also tend to use an IDE that has a decent degree of real time analysis for the languages I use which is nearly always Intellij (with it's PHP, Python plugins) or one of it's spinoffs (eg. Rider on Linux) - I'm a jetbrains fanboy basically, I adore their tools.

Zarel 8y ago

https://lgtm.com/ https://lgtm.com/ LGTM recently came by my project offering to integrate with GitHub. It's found a decent number of bugs other linters and my test suite didn't find, and it didn't require any setup at all; you just open your project on their website. Their staff also reacted really quickly when I asked them questions or reported bugs. For the most part, their only false positives are things like unreachable code, which I sometimes used to leave in for future-proofing, but I eventually did things their way, because it does make sense that it could be confusing to a third party. The only alert I've ever suppressed was a string search for "example.com", which could have matched "example.com.untrusted-attacker.com". It was just code for displaying a reminder, not anything security-critical, so I didn't think it was worth fixing.

noir_lord 8y ago

Sure though the line between linter, type checker and static analysis is blurry (so I'll use the "suggest improvements without execution") because of the languages I work in. For PHP :- PHP Inspections (EA Extended) (commercial variant, free one is good as well) - Hands down my favourite for PHP because it integrates so well with my IDE, I wouldn't write PHP without it - very few false positives, when it flags something if I don't immediately understand I go look at why it's flagging it, I've learnt stuff I didn't know after nearly a decade of using PHP. Phan - Very good and getting better all the time. PHP_CodeSniffer (more useful for making sure you stick to a particular standard say PSR2 - IDE's can do this but code sniffer can be part of you pipeline/commit handling) PHPStan - Very powerful but if you didn't start with this or are bringing it on an existing codebase..well it'll find a lot, on max it will flag what seems like everything but it's configurable and its most technically correct. For TypeScript - TSLint w/ tslint-microsoft-contrib. For C# - ReSharper For bash - ShellCheck I also tend to use an IDE that has a decent degree of real time analysis for the languages I use which is nearly always Intellij (with it's PHP, Python plugins) or one of it's spinoffs (eg. Rider on Linux) - I'm a jetbrains fanboy basically, I adore their tools.