2021

Sorald: Automatic Patch Suggestions for SonarQube Static Analysis Violations

Etemadi, Khashayar, Harrand, Nicolas, Larsen, Simon et al.

Understand

Previous work has shown that early resolution of issues detected by static code analyzers can prevent major costs later on.

However, developers often ignore such issues for two main reasons.
First, many issues should be interpreted to determine if they correspond to actual flaws in the program.
Second, static analyzers often do not present the issues in a way that is actionable.

Built on

M. L. Van De Vanter, “Preserving the documentary structure of source code in language-based transformation tools,” in Proceedings First IEEE International Workshop on Source Code Analysis and Manipulation , 2001, pp. 131–141
2001
Earlier work this paper cites.
J. Kort and R. Lammel, “Parse-tree annotations meet re-engineering concerns,” in Proceedings Third IEEE International Workshop on Source Code Analysis and Manipulation , 2003, pp. 161–170
2003
Earlier work this paper cites.
D. Hovemeyer and W. Pugh, “Finding bugs is easy,” Acm sigplan notices , vol. 39, no. 12, pp. 92–106, 2004
2004
Earlier work this paper cites.
C. Artho and A. Biere, “Combined static and dynamic analysis,” Electronic Notes in Theoretical Computer Science , vol. 131, pp. 3–14, 2005
2005
Earlier work this paper cites.
R. P. Buse and W. R. Weimer, “A metric for software readability,” in Proceedings of the 2008 International Symposium on Software Testing and Analysis , ser. ISSTA ’08. New York, NY, USA: Association for Computing Machinery, 2008, p. 121–130
2008
Earlier work this paper cites.
M. Zhivich and R. K. Cunningham, “The real cost of software errors,” IEEE Security & Privacy , vol. 7, no. 2, pp. 87–90, 2009
2009
Earlier work this paper cites.
R. Kitlei, L. Lövei, T. Nagy, Z. Horv’ath, and T. Kozsik, “Layout preserving parser for refactoring in erlang,” in Acta Electrotechnica et Informatica , vol. 9, 2009, p. 54–63
2009
Earlier work this paper cites.
N. Ayewah and W. Pugh, “The google findbugs fixit,” in Proceedings of the 19th international symposium on Software testing and analysis , 2010, pp. 241–252
2010
Earlier work this paper cites.
M. Fähndrich and F. Logozzo, “Static contract checking with abstract interpretation,” in International conference on formal verification of object-oriented software . Springer, 2010, pp. 10–30
2010
Earlier work this paper cites.
M. de Jonge and E. Visser, “An algorithm for layout preservation in refactoring transformations,” in Software Language Engineering , A. Sloane and U. Aßmann, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2012, pp. 40–59
2012
Earlier work this paper cites.
E. Aftandilian, R. Sauciuc, S. Priya, and S. Krishnan, “Building useful program analysis tools using an extensible java compiler,” in 12th IEEE International Working Conference on Source Code Analysis and Manipulation, SCAM 2012, Riva del Garda, Italy, September 23-24, 2012 . IEEE Computer Society, 2012, pp. 14–23
2012
Earlier work this paper cites.
F. Logozzo and T. Ball, “Modular and verified automatic program repair,” ACM SIGPLAN Notices , vol. 47, no. 10, pp. 133–146, 2012
2012
Earlier work this paper cites.
B. Johnson, Y. Song, E. Murphy-Hill, and R. Bowdidge, “Why don’t software developers use static analysis tools to find bugs?” in 2013 35th International Conference on Software Engineering (ICSE) . IEEE, 2013, pp. 672–681
2013
Earlier work this paper cites.
G. Gousios, M. Pinzger, and A. v. Deursen, “An exploratory study of the pull-based software development model,” in Proceedings of the 36th International Conference on Software Engineering , ser. ICSE 2014. New York, NY, USA: Association for Computing Machinery, 2014, p. 345–355
2014
Earlier work this paper cites.
J. Falleri, F. Morandat, X. Blanc, M. Martinez, and M. Monperrus, “Fine-grained and accurate source code differencing,” in ACM/IEEE International Conference on Automated Software Engineering, ASE ’14, Vasteras, Sweden - September 15 - 19, 2014 , I. Crnkovic, M. Chechik, and P. Grünbacher, Eds. ACM, 2014, pp. 313–324
2014
Earlier work this paper cites.
N. A. Ernst, S. Bellomo, I. Ozkaya, R. L. Nord, and I. Gorton, “Measure it? manage it? ignore it? software practitioners and technical debt,” in Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering , 2015, pp. 50–60
2015
Earlier work this paper cites.
R. Pawlak, M. Monperrus, N. Petitprez, C. Noguera, and L. Seinturier, “Spoon: A library for implementing analyses and transformations of java source code,” Software: Practice and Experience , vol. 46, pp. 1155–1179, 2015
2015
Earlier work this paper cites.
C. Calcagno, D. Distefano, J. Dubreil, D. Gabi, P. Hooimeijer, M. Luca, P. W. O’Hearn, I. Papakonstantinou, J. Purbrick, and D. Rodriguez, “Moving fast with software verification,” in NASA Formal Methods - 7th International Symposium, NFM 2015, Pasadena, CA, USA, April 27-29, 2015, Proceedings , ser. Lecture Notes in Computer Science, K. Havelund, G. J. Holzmann, and R. Joshi, Eds., vol. 9058. Springer, 2015, pp. 3–11
2015
Earlier work this paper cites.

Similar

M. Beller, R. Bholanath, S. McIntosh, and A. Zaidman, “Analyzing the state of static analysis: A large-scale evaluation in open source software,” in 2016 IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering (SANER) , vol. 1. IEEE, 2016, pp. 470–481
2016
Cited alongside, same era.
F. Zampetti, S. Scalabrino, R. Oliveto, G. Canfora, and M. Di Penta, “How open source projects use static code analysis tools in continuous integration pipelines,” in 2017 IEEE/ACM 14th International Conference on Mining Software Repositories (MSR) . IEEE, 2017, pp. 334–344
2017
Cited alongside, same era.
A. Habib and M. Pradel, “How many of all bugs do we find? a study of static bug detectors,” in 2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 2018, pp. 317–328
2018
Cited alongside, same era.
K. Liu, D. Kim, T. F. Bissyandé, S. Yoo, and Y. Le Traon, “Mining fix patterns for findbugs violations,” IEEE Transactions on Software Engineering , 2018
2018
Cited alongside, same era.
C. Sadowski, E. Aftandilian, A. Eagle, L. Miller-Cushon, and C. Jaspan, “Lessons from building static analysis tools at google,” Communications of the ACM , vol. 61, no. 4, pp. 58–66, 2018
2018
Cited alongside, same era.
C. Vassallo, F. Palomba, A. Bacchelli, and H. C. Gall, “Continuous code quality: are we (really) doing that?” in Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering , 2018, pp. 790–795
2018
Cited alongside, same era.
S. Urli, Z. Yu, L. Seinturier, and M. Monperrus, “How to design a program repair bot? insights from the repairnator project,” in 2018 IEEE/ACM 40th International Conference on Software Engineering: Software Engineering in Practice Track (ICSE-SEIP) . IEEE, 2018, pp. 95–104
2018
Cited alongside, same era.
B. Loriot, F. Madeiral, and M. Monperrus, “Styler: Learning formatting conventions to repair checkstyle errors,” arXiv preprint arXiv:1904.01754 , 2019
Original
2019
Cited alongside, same era.
N. Saarimaki, M. T. Baldassarre, V. Lenarduzzi, and S. Romano, “On the accuracy of sonarqube technical debt remediation time,” in 2019 45th Euromicro Conference on Software Engineering and Advanced Applications (SEAA) . IEEE, 2019, pp. 317–324
2019
Cited alongside, same era.
R. van Tonder and C. Le Goues, “Towards s/engineer/bot: Principles for program repair bots,” in 2019 IEEE/ACM 1st International Workshop on Bots in Software Engineering (BotSE) . IEEE, 2019, pp. 43–47
2019
Cited alongside, same era.
J. Bader, A. Scott, M. Pradel, and S. Chandra, “Getafix: learning to fix bugs automatically,” Proc. ACM Program. Lang. , vol. 3, no. OOPSLA, pp. 159:1–159:27, 2019
2019
Cited alongside, same era.
R. Bavishi, H. Yoshida, and M. R. Prasad, “Phoenix: Automated data-driven synthesis of repairs for static analysis violations,” in Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering , ser. ESEC/FSE 2019. New York, NY, USA: ACM, 2019, pp. 613–624
2019
Cited alongside, same era.

Then

M. Wyrich and J. Bogner, “Towards an autonomous bot for automatic source code refactoring,” in 2019 IEEE/ACM 1st International Workshop on Bots in Software Engineering (BotSE) . IEEE, 2019, pp. 24–28
2019
Later among the works it cites.
V. Alizadeh, M. A. Ouali, M. Kessentini, and M. Chater, “Refbot: intelligent software refactoring bot,” in 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 2019, pp. 823–834
2019
Later among the works it cites.
C. Vassallo, S. Panichella, F. Palomba, S. Proksch, H. C. Gall, and A. Zaidman, “How developers engage with static analysis tools in different contexts,” Empirical Software Engineering , vol. 25, no. 2, pp. 1419–1457, 2020
2020
Later among the works it cites.
A. Carvalho, W. Luz, D. Marcílio, R. Bonifácio, G. Pinto, and E. D. Canedo, “C-3pr: A bot for fixing static analysis violations via pull requests,” in 2020 IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER) . IEEE, 2020, pp. 161–171
2020
Later among the works it cites.
D. Marcilio, C. A. Furia, R. Bonifácio, and G. Pinto, “Spongebugs: Automatically generating fix suggestions in response to static code analysis warnings,” J. Syst. Softw. , vol. 168, p. 110671, 2020
2020
Later among the works it cites.
H. Adzemovic, “A template-based approach to automatic program repair of sonarqube static warnings,” 2020
2020
Later among the works it cites.
V. Lenarduzzi, N. Saarimäki, and D. Taibi, “Some sonarqube issues have a significant but small effect on faults and changes. A large-scale empirical study,” J. Syst. Softw. , vol. 170, p. 110750, 2020
2020
Later among the works it cites.
M. T. Baldassarre, V. Lenarduzzi, S. Romano, and N. Saarimäki, “On the diffuseness of technical debt items and accuracy of remediation time when using sonarqube,” Inf. Softw. Technol. , vol. 128, p. 106377, 2020
2020
Later among the works it cites.
L. Lavazza, D. Tosi, and S. Morasca, “An empirical study on the persistence of spotbugs issues in open-source software evolution,” in International Conference on the Quality of Information and Communications Technology . Springer, 2020, pp. 144–151
2020
Later among the works it cites.
A. Trautsch, S. Herbold, and J. Grabowski, “A longitudinal study of static analysis warning evolution and the effects of pmd on software quality in apache open source projects,” Empirical Software Engineering , vol. 25, no. 6, pp. 5137–5192, 2020
2020
Later among the works it cites.
L. N. Q. Do, J. Wright, and K. Ali, “Why do software developers use static analysis tools? a user-centered study of developer needs and motivations,” IEEE Transactions on Software Engineering , 2020
2020
Later among the works it cites.
T. Muske and A. Serebrenik, “Techniques for efficient automated elimination of false positives,” in 2020 IEEE 20th International Working Conference on Source Code Analysis and Manipulation (SCAM) . IEEE, 2020, pp. 259–263
2020
Later among the works it cites.
X. Yang, Z. Yu, J. Wang, and T. Menzies, “Understanding static code warnings: An incremental ai approach,” Expert Systems with Applications , p. 114134, 2020
2020
Later among the works it cites.
H. Yoshida, R. Bavishi, K. Hotta, Y. Nemoto, M. R. Prasad, and S. Kikuchi, “Phoenix: a tool for automated data-driven synthesis of repairs for static analysis violations,” in ICSE ’20: 42nd International Conference on Software Engineering, Companion Volume, Seoul, South Korea, 27 June - 19 July, 2020 , G. Rothermel and D. Bae, Eds. ACM, 2020, pp. 53–56
2020
Later among the works it cites.
H. Luong Phu, “Contributions to the usability of sorald for repairing static analysis violations,” 2021
2021
Closest in time.
H. Ye, M. Martinez, and M. Monperrus, “Automated patch assessment for program repair at scale,” Empirical Software Engineering , vol. 26, no. 2, pp. 1–38, 2021
2021
Closest in time.
B. Berabi, J. He, V. Raychev, and M. Vechev, “Tfix: Learning to fix coding errors with a text-to-text transformer,” in International Conference on Machine Learning . PMLR, 2021, pp. 780–791
2021
Closest in time.
D. Serban, B. Golsteijn, R. Holdorp, and A. Serebrenik, “Saw-bot: Proposing fixes for static analysis warnings with github suggestions,” in 2021 IEEE/ACM Third International Workshop on Bots in Software Engineering (BotSE) . IEEE, 2021, pp. 26–30
2021
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…