Using static analysis tools for automating code inspections can be beneficial for software engineers. Such tools can make finding bugs, or software defects, faster and cheaper than manual inspections. Despite the benefits of using static analysis tools to find bugs, research suggests that these tools are underused. In this paper, we investigate why developers are not widely using static analysis tools and how current tools could potentially be improved. We conducted interviews with 20 developers and found that although all of our participants felt that use is beneficial, false positives and the way in which the warnings are presented, among other things, are barriers to use. We discuss several implications of these results, such as the need for an interactive mechanism to help developers fix defects.

/pdf/why-don-t-software-developers-use-static-analysis-tools-to-3f8x2rdcna.pdf

Why don't software developers use static analysis tools to find bugs?

Though refactoring tools have been available for more than a decade, research has shown that programmers underutilize such tools. However, little is known about why programmers do not take advantage of these tools. We have conducted a field study on programmers in their natural settings working on their code. As a result, we collected a set of interaction data from about 1268 hours of programming using our minimally intrusive data collectors. Our quantitative data show that programmers prefer lightweight methods of invoking refactorings, usually perform small changes using the refactoring tool, proceed with an automated refactoring even when it may change the behavior of the program, and rarely preview the automated refactorings. We also interviewed nine of our participants to provide deeper insight about the patterns that we observed in the behavioral data. We found that programmers use predictable automated refactorings even if they have rare bugs or change the behavior of the program. This paper reports some of the factors that affect the use of automated refactorings such as invocation method, awareness, naming, trust, and predictability and the major mismatches between programmers' expectations and automated refactorings. The results of this work contribute to producing more effective tools for refactoring complex software.

Use, disuse, and misuse of automated refactorings

Web services are becoming business-critical components that must provide a non-vulnerable interface to the client applications. However, previous research and practice show that many web services are deployed with critical vulnerabilities. SQL Injection vulnerabilities are particularly relevant, as web services frequently access a relational database using SQL commands. Penetration testing and static code analysis are two well-know techniques often used for the detection of security vulnerabilities. In this work we compare how effective these two techniques are on the detection of SQL Injection vulnerabilities in web services code. To understand the strengths and limitations of these techniques, we used several commercial and open source tools to detect vulnerabilities in a set of vulnerable services. Results suggest that, in general, static code analyzers are able to detect more SQL Injection vulnerabilities than penetration testing tools. Another key observation is that tools implementing the same detection approach frequently detect different vulnerabilities. Finally, many tools provide a low coverage and a high false positives rate, making them a bad option for programmers.

Comparing the Effectiveness of Penetration Testing and Static Code Analysis on the Detection of SQL Injection Vulnerabilities in Web Services

This paper proposes a new automatic approach for the detection of SQL Injection and XPath Injection vulnerabilities, two of the most common and most critical types of vulnerabilities in web services. Although there are tools that allow testing web applications against security vulnerabilities, previous research shows that the effectiveness of those tools in web services environments is very poor. In our approach a representative workload is used to exercise the web service and a large set of SQL/XPath Injection attacks are applied to disclose vulnerabilities. Vulnerabilities are detected by comparing the structure of the SQL/XPath commands issued in the presence of attacks to the ones previously learned when running the workload in the absence of attacks. Experimental evaluation shows that our approach performs much better than known tools (including commercial ones), achieving extremely high detection coverage while maintaining the false positives rate very low.

Effective Detection of SQL/XPath Injection Vulnerabilities in Web Services

Because of the strong coupling of classes and the proliferation of unneeded class members induced by inheritance, the suggestion to use composition and delegation instead has become common place. The presentation of a corresponding refactoring in the literature may lead one to believe that such a transformation is a straightforward undertaking. However, closer analysis reveals that this refactoring is neither always possible, nor does it necessarily achieve its desired effect. We have therefore identified the necessary preconditions and realizable postconditions of the refactoring, and built a tool that can perform it completely automatically. By applying this tool to all subclasses of several open-source projects, we have collected evidence of the applicability of the refactoring and of its capability to deliver on its promises. The refactoring builds on constraint graphs originally developed for type inference to check the preconditions and to compute the necessary delegation as well as the subtype relationships that must be maintained.

/pdf/systematically-refactoring-inheritance-to-delegation-in-java-2m5nz4hfxq.pdf

Systematically refactoring inheritance to delegation in java

在目前的Java IDE市场已经形成三足鼎力：Eclipse、IntelliJ IDEA和NetBeans，对于国内很多开发人员来说，Eclipse众所周知，NetBeans次之，IntelliJ IDEA确很少被人了解。IDEA不被人了解的主要原因是其开发公司不大，而且中文文档比较少，宣传也很少。

陈立兵

Papers

IntelliJ IDEA——开发人员利器