Source code violation matching and attribution

Patent metadata

Field	Value
Publication number	US-9507591-B2
Application number	US-201614988491-A
Country	US
Kind code	B2
Filing date	Jan 5, 2016
Priority date	Apr 24, 2014
Publication date	Nov 29, 2016
Grant date	Nov 29, 2016

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for matching and attributing code violations. One of the methods includes receiving a snapshot S of a code base of source code and a different snapshot T of the code base. Data representing first violations in the snapshot S and second violations in the snapshot T is received. Pairs of matching violations are determined using performing two or more matching processes, including performing a first matching process, the first matching process determining first pairs of matching violations according to a first matching algorithm and performing a second matching process, the second matching process determining second pairs of matching violations according to a second matching algorithm from violations not matched by the first matching process. The first pairs of matching violations and the second pairs of matching violations are included in the determined pairs of matching violations.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving a snapshot S of a code base of source code and a different snapshot T of the code base, each snapshot comprising source code files, each source code file having a path;
receiving data representing first violations in the snapshot S and second violations in the snapshot T, each violation having a respective location in its snapshot, each violation having a respective type; and
determining pairs of matching violations, each pair of matching violations including a first violation and a corresponding second violation that have the same type;
wherein determining the pairs of matching violations comprises performing two or more matching processes, including:
performing a first matching process, the first matching process determining first pairs of matching violations according to a first matching algorithm;
performing a second matching process, the second matching process determining second pairs of matching violations according to a second matching algorithm from violations not matched by the first matching process; and
including the first pairs of matching violations and the second pairs of matching violations in the determined pairs of matching violations.

2. The method of claim 1 , wherein the second matching process is a snippet matching process, wherein the snippet matching process comprises:
determining pairs of matching violations, each pair of matching violations including one violation in the snapshot S and one violation in the snapshot T, including:
determining a first violation in the snapshot S that has a first violation snippet that matches a second violation snippet of a second violation in the snapshot T;
determining that the first violation in the snapshot S has a type that matches a type of the second violation in the snapshot T;
determining that a path of the first violation matches a path of the second violation; and
designating the first violation and the second violation as a pair of matching violations.

3. The method of claim 2 , wherein the first matching process is a line matching process, wherein the line matching process comprises:
identifying one or more pairs of matching source code files, each pair including a first file of a snapshot S and a second file of the snapshot T;
for each first file and second file of each pair of matching source code files, performing a diffing method to partition the first file and the second file into corresponding line range pairs, each line range pair being a pair of a first line range from the first file and a second line range from the second file; and
designating as a pair of matching violations, each pair of violations made up of a first violation in the snapshot S and a second violations in the snapshot T, wherein the first and second violations satisfy matching conditions, the matching conditions including that:
the first and second violations have the same type; and
a position of the first violation within a first line range differs from a position of the second violation within a corresponding second line range by no more than a threshold amount.

4. The method of claim 3 , wherein determining the pairs of matching violations further comprises:
performing a third matching process, the third matching process determining third pairs of matching violations according to a third matching algorithm from violations not matched by the first matching process or the second matching process; and
including the third pairs of matching violations in the determined pairs of matching violations.

5. The method of claim 4 , wherein the third matching process is a hash matching process, wherein the hash matching process comprises:
determining pairs of matching violations, each pair of matching violations including one violation in the snapshot S and one violation in the snapshot T having a same type, including:
determining a first set of one or more hash values for a first violation in the snapshot S and a second set of one or more hash values for a second violation in the snapshot T;
determining that at least one of the hash values of a first violation in the first set matches a corresponding hash value of a second violation in the second set and that the first violation has a type that matches a type of the second violation; and
designating the first violation and the second violation as a pair of matching violations.

6. The method of claim 1 , further comprising determining unmatched violations of the snapshot S, the unmatched violations of the snapshot S being violations not having a respective matching violation of the snapshot T in the pairs of matching violations, the unmatched violations of the snapshot S representing violations corrected between the snapshot S and the snapshot T.

7. The method of claim 6 , wherein determining the unmatched violations of the snapshot S comprises determining a set difference between the violations of the snapshot S and matching violations in the pairs of matching violations.

8. The method of claim 1 , further comprising:
identifying, by one or more computers, as unmatched child violations those child violations that do not have a matching parent violation in the snapshot S; and
attributing to the snapshot T a violation introduction for each unmatched child violation.

9. The method of claim 1 , further comprising:
identifying as unmatched parent violations those violations that occur in all of one or more snapshots S and that do not occur in the snapshot T; and
attributing to the snapshot T a violation correction for each unmatched parent violation.

10. A computer-implemented method comprising:
receiving a snapshot S of a code base of source code and a different snapshot T of the code base, each snapshot comprising source code files, each source code file having a path;
receiving data representing first violations in the snapshot S and second violations in the snapshot T, each violation having a respective location in its snapshot, each violation having a respective type; and
identifying one or more pairs of matching source code files, each pair including a first file of the snapshot S and a second file of the snapshot T;
for each first file and second file of each pair of matching source code files, performing a diffing method to partition the first file and the second file into corresponding line range pairs, each line range pair being a pair of a first line range from the first file and a second line range from the second file;
designating as a pair of matching violations, each pair of violations made up of a first violation in the snapshot S and a second violations in the snapshot T, wherein the first and second violations satisfy matching conditions, the matching conditions including that:
the first and second violations have the same type; and
a position of the first violation within a first line range differs from a position of the second violation within a corresponding second line range by no more than a threshold amount.

11. The method of claim 10 , wherein:
the threshold amount is zero characters whenever the source code in the first line range is identical to the source code in the corresponding second line range.

12. The method of claim 10 , wherein:
the threshold amount is greater than zero lines whenever the source code in the first line range is not identical to the source code in the corresponding second line range.

13. The method of claim 12 , wherein:
the threshold amount is three lines.

14. The method of claim 12 , wherein identifying one or more pairs of matching source code files comprises identifying

Assignees

• Semmle Ltd

Inventors

• Henriksen Anders Starcke
• Baars Arthur
• Avgustinov Pavel
• Tibble Julian
• Schaefer Max
• De Moor Oege

Classifications

• G06Q10/06398

  Performance of employee with respect to a job function · CPC title

• G06F11/3616 Primary

  using software metrics · CPC title

• G06F16/148

  File search processing · CPC title

• G06F8/75

  Structural analysis for program understanding · CPC title

• G06F8/77

  Software metrics · CPC title