Code Analysis is the process of analyzing the code of the application to discover, review, validate or verify certain properties of the application. This is useful during the process of development and for testing the application before it is put in production mode, especially for checking the security related aspects.
Code Analysis is the process of analyzing the code of the application to discover, review, validate or verify certain properties of the application. This is useful during the process of development and for testing the application before it is put in production mode, especially for checking the security related aspects. Code analysis can be classified from several perspectives, including:
1. What can be analyzed: source code or binary code (byte code) of the application can be analyzed. Both of these categories have their pros and cons.
2. How or When should code be analyzed: Code can be analyzed statically (without executing it) or dynamically (while the application is executed). Static analysis, being conservative, is prone to false positive, but it is exhaustive. On the other hand, dynamic analysis, being very accurate, may miss certain behaviors which are not manifested in any of the execution monitored (because dynamic analysis only analyzes code that is executed - i.e. when certain conditions are met)
3. Purpose of the analysis: Flaws can be found, like NULL pointer dereferencing or passing an ASCII string instead of a Unicode string. Furthermore, aspects of the code can be found, like building various graphs of dependencies or deducing the conditions under which recursion will occur.
