One of ISTQBs analysis methods is based on static analysis. These are used for non-running code and can identify error conditions. That’s special as most (dynamic) methods can only indicate external failures, which must be linked to error conditions first. The following test criteria can be addressed:
- Structural Test Criteria
Static analysis tools help assess the structure of the code, including its readability, maintainability, and adherence to coding standards. They address criteria like statement coverage, branch coverage, and path coverage.
They help identify:- Code complexity (e.g., cyclomatic complexity)
- Unreachable code and dead code (unused functions, variables, etc.)
- Duplicated code that can lead to maintenance issues
- Control flow anomalies, such as improper use of loops or conditions
- Data Flow Test Criteria
Static analysis can identify issues related to data flow, such as uninitialized variables, variable shadowing, and improper data dependencies between different parts of the code. They address how data is passed and manipulated within the software.
These tools can detect:- Data flow anomalies, like variables being used before they are assigned values.
- Unused variables that may cause confusion or potential errors.
- Control Flow Test Criteria
Static analysis tools evaluate the control flow within the code. They can spot areas where control flow could be unclear or overly complicated, making it difficult to understand or predict the software’s behavior. They address branch coverage and path coverage by ensuring code has clearly defined and tested control paths.
This includes:- Dead code or unreachable code blocks.
- Improper control structures (e.g., infinite loops, deeply nested loops or conditionals).
- Boundary Condition Test Criteria
Static analysis can highlight boundary conditions, which are common places for defects, by spotting places in the code where:- Off-by-one errors or incorrect range checks occur (e.g., for arrays or loops).
- Potential issues with array bounds or other boundary-based errors that can lead to runtime failures.
- Error Handling Test Criteria
Static analysis tools can detect improper error handling, such as:- Uncaught exceptions or improper exception handling mechanisms.
- Missing or incomplete validation of inputs.
- Lack of error messages in certain failure scenarios.
- Security Test Criteria
Static analysis tools are widely used to detect security vulnerabilities early in the software development life cycle. They can address a variety of security-related test criteria, such as:- Buffer overflows, SQL injection vulnerabilities, and other common security flaws.
- Sensitive data exposure (e.g., unencrypted sensitive information).
- Improper access control and privilege escalation risks.
- Code Quality Test Criteria
Static analysis tools also focus on the quality of the code in terms of style, readability, and maintainability, which indirectly impacts testing and debugging efforts:- Naming conventions: Ensuring consistent and meaningful naming of variables, functions, and classes.
- Commenting and documentation: Ensuring proper documentation practices.
- Code formatting: Ensuring readability through consistent formatting practices.
- Naming conventions: Ensuring consistent and meaningful naming of variables, functions, and classes.
- Regression Test Criteria
Static analysis helps identify code changes that could impact the existing functionality of the software. By detecting code changes that affect critical parts of the system, it helps prioritize regression testing areas.- Identifying affected code regions: Ensuring that any modifications made to the code do not inadvertently introduce bugs into previously tested and stable parts of the software.
- Refactoring and bug fixes: Ensuring that fixes or refactors don’t introduce new defects.
- Compliance Test Criteria
For industries where software must comply with strict standards (e.g., automotive, medical, finance), static analysis can help ensure that code adheres to compliance guidelines:- Coding standards (e.g., MISRA for safety-critical software)
- Industry-specific standards (e.g., ISO, IEC, CMMI)
- Maintainability Test Criteria
By identifying issues like code duplication, high complexity, and poor readability, static analysis contributes to improving software maintainability. This includes:- Cyclomatic complexity: Tools can calculate and report complexity, helping identify areas that are too complicated to maintain and that may need refactoring.
- Modularity: Ensuring that the code is organized into reusable, modular components that are easier to understand and modify.
Given toolings can be utilized as early as during component and integration tests and even during software modelling (software design):
- SonarQube
Supports multiple languages and helps in detecting bugs, code smells, security vulnerabilities, and more. - Checkstyle
Mainly for Java, it helps maintain coding standards by detecting deviations in code formatting and structure. - FindBugs (now part of SpotBugs)
Primarily for Java, this tool detects bugs, potential issues, and unsafe code practices. - PMD
A static code analyzer that works with Java and other languages like JavaScript, Apex, and others. It finds issues related to code style, unused variables, and more. - Lint
Commonly used for C, C++, and JavaScript, this tool checks for a variety of bugs, code inefficiencies, and potential problems. - CodeClimate
A tool offering both static analysis and code quality reports for various programming languages, including Ruby, JavaScript, and Python. - Cppcheck
A static analysis tool for C/C++ code that detects errors, potential issues, and provides helpful suggestions. - Fortify Static Code Analyzer
A robust static analysis tool focused on security vulnerabilities, supporting many programming languages. - Coverity
Known for analyzing code for defects and vulnerabilities, Coverity supports a wide range of languages and integrates into continuous integration systems. - Klocwork
A static analysis tool with a focus on security, reliability, and compliance across a range of programming languages. - Codacy
A static code analysis tool that offers automated reviews of code for issues related to quality, style, and security. - JSHint
A tool for detecting errors in JavaScript code and enforcing coding conventions.