Home Articles Talks Consulting Szitar.hu Magyar változat

12 Sept 2023

Static and Dynamic Source Code Analysis

Static and dynamic source code analysis in software development: Which one, when and why?

2023.09.12

Software development is a complex and challenging process in which developers have to take many aspects into account for the sake of quality, efficiency and security. Two important techniques that can help improve code quality and identify defects early are static and dynamic source code analysis. In this article, we take a closer look at both types of source code analysis and use examples to illustrate when and why each is worth using.

1. Static Source Code Analysis

Static source code analysis is a technique in which code is analysed without actually being executed. The essence of it is that the code is thoroughly examined with the help of specialised software or a tool, and possible bugs, problems and issues affecting code quality are detected. During static analysis, we can examine the following aspects:

Syntax errors

One of its most important roles is identifying syntax errors, which essentially mean invalid code and can prevent the program from running. For example:

python
for i in range(10)
	print(i)

In this Python code, the colon is missing at the end of the loop header, which is a syntax error.

Logic errors

Static analysis can also identify logic errors that do not necessarily lead to error messages but can cause incorrect behaviour. For example:

int x = 5;

if (x > 10) {

printf("x is greater than 10");

} else {

printf("x is less than or equal to 10");

}

In this C code, the logic error is that the relational operator is worded incorrectly in the messages, since x is not greater than 10, yet the message says “x is greater than 10”.

Code style and formatting

Static analysis can help identify violations of code style and formatting rules. For example:

public void MyMethod(){

int x=5;

if(x>0)

{

System.out.println("x is positive");

}

}

In this Java code, the code style and formatting do not follow the usual conventions: for example, the method name should start with a lowercase letter, there should be spaces between the variables, and the curly braces are formatted incorrectly.

2. Dynamic Source Code Analysis

Dynamic source code analysis is a different approach in which the code is actually executed and its behaviour is monitored at runtime. Dynamic analysis makes it possible to examine the following:

Variable values and behaviour

During dynamic analysis, we can monitor the values of variables and the behaviour of the program at runtime. For example:

def divide(x, y):

result = x / y

return result

result = divide(10, 2)

In this Python code, dynamic analysis can help identify whether the variable values and operations work correctly, for example whether the “result” variable holds the correct result.

Performance and resource usage

Dynamic analysis makes it possible to monitor the program’s performance and its use of resources (memory, CPU, etc.). For example:

int main() {

int* arr = new int[1000000];

// ...

delete[] arr;

return 0;

}

In this C++ code, dynamic analysis can help identify a memory leak, as the “delete[]” operation is missing and the allocated memory is not freed.

Debugging and exceptions

Dynamic analysis makes it possible to monitor errors and exceptions, which helps with debugging and improving the stability of the program. For example:

public static void main(String[] args) {

int[] arr = {1, 2, 3};

System.out.println(arr[3]);

}

In this Java code, dynamic analysis reports that an index out of bounds error occurred when we try to display the fourth element of the arr array.

3. Static and dynamic analysis: When and why do we use them?

Both static and dynamic source code analysis have their own place and role in software development. As a general guideline, we use them as follows:

  • Static Analysis: Usually used in the early stages of the development process to identify syntax errors, violations of code style and formatting rules, and possible logic errors. It helps improve code quality and identify defects early.
  • Dynamic Analysis: Dynamic analysis is used more for monitoring runtime behaviour and performance. We use it to check the security and stability of the code, and to identify performance problems and memory leaks.

An example of when it is worth using both analysis methods:

Suppose we are developing a web application that reads its data from a database. Static analysis can help identify syntax errors and potential SQL injection risks in the code. At the same time, during dynamic analysis we monitor the code at runtime to make sure that it works correctly and uses memory efficiently.

4. Summary

Static and dynamic source code analysis are two different but complementary techniques for improving software quality and identifying defects early. One focuses on the code during development, while the other monitors the program’s behaviour at runtime. Both methods are worth using, depending on the project and the nature of the defects, in order to create software of the highest possible quality and security.

SonarSource Partner