Publication
SONARCH - A STATIC SPRING CODE ANALYSIS PLUGIN FOR SONARQUBE
| Summary: | Nowadays, society is most dependent on applications and interfaces built by developers through code. With this evolution, there is a growing demand for code production as well as quality. However, how can one develop code in a fast and extensible way with the minimum number of bugs, code smells, and vulnerabilities possible? One of the developed solutions for this problem was static analysis tools, built for developers by developers to detect such problems just by analyzing a project without running it, which comes as a huge advantage. One of the most used tools in the market that Opensoft has resorted to for years to guarantee the quality of code for this kind of testing is SonarQube. However, in spite of being an extremely complete tool, SonarQube does not present rules sufficiently sophisticated when it comes to the spring framework. On that premise, our problem focuses on developing a new quality profile in SonarQube for Java that contains a set of rules to check for possible errors in spring code. In consideration of the foregoing, the proposed solution was to build a plug-in geared towards SonarQube 9.9, which is the long-term support version at the moment, that evaluates all the previously researched rules for Spring code. The evaluation of the project is a complex process that contains several JUnit tests, at least one for each rule implemented. Furthermore, in order to be more thorough in this evaluation, we ran our plug-in in some real projects and detected that, on average, this plug-in can bring an increase in code quality of about 30% for the company. This allows Opensoft developers to obtain a more precise technical debt value until the code is free of bugs, vulnerabilities, and code smells. This will have a major impact on all Spring framework projects in terms of the quality of the code produced, which will prove to be very advantageous for Opensoft regarding client appreciation. |
|---|---|
| Main Authors: | Mendes, Rodrigo Lopes Malato Correia |
| Subject: | Developers SonarQube Plug-In Spring framework Java Quality of code |
| Year: | 2023 |
| Country: | Portugal |
| Document type: | master thesis |
| Access type: | open access |
| Associated institution: | Universidade Nova de Lisboa |
| Language: | English |
| Origin: | Repositório Institucional da UNL |
| Summary: | Nowadays, society is most dependent on applications and interfaces built by developers through code. With this evolution, there is a growing demand for code production as well as quality. However, how can one develop code in a fast and extensible way with the minimum number of bugs, code smells, and vulnerabilities possible? One of the developed solutions for this problem was static analysis tools, built for developers by developers to detect such problems just by analyzing a project without running it, which comes as a huge advantage. One of the most used tools in the market that Opensoft has resorted to for years to guarantee the quality of code for this kind of testing is SonarQube. However, in spite of being an extremely complete tool, SonarQube does not present rules sufficiently sophisticated when it comes to the spring framework. On that premise, our problem focuses on developing a new quality profile in SonarQube for Java that contains a set of rules to check for possible errors in spring code. In consideration of the foregoing, the proposed solution was to build a plug-in geared towards SonarQube 9.9, which is the long-term support version at the moment, that evaluates all the previously researched rules for Spring code. The evaluation of the project is a complex process that contains several JUnit tests, at least one for each rule implemented. Furthermore, in order to be more thorough in this evaluation, we ran our plug-in in some real projects and detected that, on average, this plug-in can bring an increase in code quality of about 30% for the company. This allows Opensoft developers to obtain a more precise technical debt value until the code is free of bugs, vulnerabilities, and code smells. This will have a major impact on all Spring framework projects in terms of the quality of the code produced, which will prove to be very advantageous for Opensoft regarding client appreciation. |
|---|
Funded activities
No funded projects found.