title: ÐÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ðµ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð´Ð»Ñ Ð¿Ð¾Ð¸ÑÐºÐ° Ð¾ÑÐ¸Ð±Ð¾Ðº Ð² Ð¸ÑÑ Ð¾Ð´Ð½Ð¾Ð¼ ÐºÐ¾Ð´Ðµ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Usage of static analysis to search for errors in the source code of software
Creators: name: ÐÐµÑÐµÐ¹ÑÑÐº, ÐÐ°ÑÑÑ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2023
Subjects: ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·
Ð¿Ð¾Ð¸ÑÐº ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½ÑÐ¹ ÐºÐ¾Ð´
Ð¿ÐµÑÐµÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ðµ Ð±ÑÑÐµÑÐ°
static analysis
vulnerability serch
secure code
buffer overflow

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð´ÐµÑÐµÐºÑÐ¾Ð² Ð² Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð¼ ÐºÐ¾Ð´Ðµ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ° Ð² ÑÐ¾Ð¾ÑÐ²ÐµÑÑÑÐ²Ð¸Ð¸ Ñ Ð¸Ð½ÑÐµÐ³ÑÐ°ÑÐ¸ÐµÐ¹ Ð² CI/CD. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ Ð¼ÐµÑÐ¾Ð´Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°, Ð¿ÑÐ¸Ð¼ÐµÐ½ÑÐµÐ¼ÑÐµ Ð² Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐµ Svace Ð¸ Ð¿ÑÐ¸Ð½ÑÐ¸Ð¿Ñ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð² ÑÐµÑÐ½Ð¾Ð»Ð¾Ð³Ð¸Ð¸ CI/CD. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÐ¾Ð²ÐµÑÑÐ¸ Ð°Ð½Ð°Ð»Ð¸ÑÐ¸ÑÐµÑÐºÐ¾Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð¾Ð² Ðº Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð´Ð»Ñ Ð¿Ð¾Ð¸ÑÐºÐ° Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÑ Ð´ÐµÑÐµÐºÑÐ¾Ð²; 2. ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¾ÑÐ¸Ð±ÐºÐ¸ Ð¸ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐ¸, ÐºÐ¾ÑÐ¾ÑÑÐµ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð½Ð°Ð¹Ð´ÐµÐ½Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ¾Ð¼. 3. ÐÑÐ¾Ð²ÐµÑÑÐ¸ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð³Ð¾ÑÐ¾Ð²ÑÑ ÑÐµÑÐµÐ½Ð¸Ð¹. 4. ÐÐ·ÑÑÐ¸ÑÑ Ð¿ÑÐ¸Ð½ÑÐ¸Ð¿ ÑÐ°Ð±Ð¾ÑÑ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ° Svace. 5. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ ÑÐ¸ÑÑÐµÐ¼Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð´ÐµÑÐµÐºÑÐ¾Ð² Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð° ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ð¼Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ°Ð¼Ð¸, Ð¸Ð½ÑÐµÐ³ÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ Ð² CI/CD. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð° Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÐ° Ð¸ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ° Svace. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ñ ÑÐ°Ð±Ð¾ÑÑ CI/CD. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð±ÑÐ»Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð° ÑÐ¸ÑÑÐµÐ¼Ð° Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð´ÐµÑÐµÐºÑÐ¾Ð² Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð° ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ð¼Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ°Ð¼Ð¸, Ð¸Ð½ÑÐµÐ³ÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð½Ð°Ñ Ð² CI/CD. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² Ð¾Ð±ÑÐ°Ð·Ð¾Ð²Ð°ÑÐµÐ»ÑÐ½ÑÑ ÑÑÑÐµÐ¶Ð´ÐµÐ½Ð¸ÑÑ Ð´Ð»Ñ Ð¿ÑÐ¾Ð²ÐµÑÐ¾Ðº ÑÐ°Ð±Ð¾Ñ ÑÑÑÐ´ÐµÐ½ÑÐ¾Ð². ÐÐºÑÐ¸Ð²Ð½Ð¾ Ð¿ÑÐ¸Ð¼ÐµÐ½ÑÑÑÑÑ Ð² Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸ÑÑ Ð´Ð»Ñ ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÐºÐ°ÑÐµÑÑÐ²Ð° Ð¸ÑÑÐ¾Ð´Ð½ÑÑ ÐºÐ¾Ð´Ð¾Ð².
description: The purpose of the work is to identify defects in the source code of the soft-ware using a static analyzer in accordance with the integration into CI/CD. The subject of the study is the methods of static analysis used in the Svace ana-lyzer and principles of automation in CI/CD technologies. The research set the fol-lowing goals: 1. To conduct an analytical study of existing approaches to static analysis to search for software defects; 2. Analyze existing errors and vulnerabilities that can be found by the ana-lyzer. 3. Analyze existing ready-made solutions. 4. To study the principle of operation of the Svace static analyzer. 5. Develop a system for detecting source code defects with static analyzers integrated in CI/CD. During the work the architecture and implementation of the Svace analyzer were investigated. The mechanisms of CI/CD operation were analyzed. As a result, a system for detecting source code defects by static analyzers inte-grated into CI/CD was developed. The results obtained can be used in educational institutions for checking stu-dents work. Actively used in organizations to control the quality of source codes.