3 Layers of Static Code Analysis in PHP
Every developer should be running some form of static code analysis on their code regularly. A recent article I read about how this is done at Etsy makes for what I believe should be a minimum standard of code analysis for any team of developers work on a shared codebase. We shall assume you are committing your codebase to some form of version control on a regular basis.
The 3 layers can be summarised as:
In Stage 1 we perform basically a sanity check of the code. Are there any errors, missing semi-colon's or just plain stupid things being committed to our repository and code base. This is essentially a case of running php -l against all our files being checked in or changed to make sure we catch these before they are committed and let you fix them before they are picked up by the wider team.
This stage involves a more global analysis of the source code files, checking for thing such as:
The final layer of analysis, the security checks can be more thorough and use tools to scan our code for OWASP vulnerabilities, or as Etsy do - scan the repository with Antivirus and assess for dirty URLs.
Etsy claim they use ClamAV to check for any files or bad code which might make it's way into the repo, such as MSWord or PDF files that are suspicious. ClamAV also scans URL's and checks these against Google's Safe Browsing List to pick up on suspected Phishing or malware sites.
It is also possible to check here to ensure things like passwords aren't committed to repositories or specific naughty functions or processes are used. This can then trigger alerts for code reviews or ping back to the developer advising to fix ASAP.
The 3 layers can be summarised as:
- Sanity Checks
- Formal Checks
- Security Checks
Sanity and Syntax Checks
In Stage 1 we perform basically a sanity check of the code. Are there any errors, missing semi-colon's or just plain stupid things being committed to our repository and code base. This is essentially a case of running php -l against all our files being checked in or changed to make sure we catch these before they are committed and let you fix them before they are picked up by the wider team.
Formal Checks
This stage involves a more global analysis of the source code files, checking for thing such as:
- Too many or too few arguments in a function/method call
- Undeclared global or local variables
- Use of return value of a function that actually returns nothing
- Functions that have a required argument after an optional one
- Unknown functions, methods, or base classes
- Constants declared twice
This can be accomplished by using tools such as PHPCodeSniffer. This allows us to ensure the above are picked up, and also that our code is in compliance with our agreed coding standard. Any issues, the commit is bounced back with the opportunity to resolve before being integrated into the repository.
Security Checks
The final layer of analysis, the security checks can be more thorough and use tools to scan our code for OWASP vulnerabilities, or as Etsy do - scan the repository with Antivirus and assess for dirty URLs.
Etsy claim they use ClamAV to check for any files or bad code which might make it's way into the repo, such as MSWord or PDF files that are suspicious. ClamAV also scans URL's and checks these against Google's Safe Browsing List to pick up on suspected Phishing or malware sites.
It is also possible to check here to ensure things like passwords aren't committed to repositories or specific naughty functions or processes are used. This can then trigger alerts for code reviews or ping back to the developer advising to fix ASAP.
Comments
Post a Comment