Static Code Analysis in Android
By: Kayvan Kaseb
Tags: Android, Static Code Analysis, Android Apps, Android Development, Android App Development

Static Code Analysis in Android

Nowadays, software bugs cost developers and software companies a great deal of time and money. As a matter of fact, some researches and studies prove this claim in all around the world. Therefore, some accredited companies use Static Code Analysis tools in addition to Test and Code Review processes particularly in designing and implementing an Android app due to the importance of quality in this major. Fundamentally, the goal of these tools are finding potential vulnerabilities such as bugs and security flaws in a source code. This essay aims to discuss Static Code Analysis in Android, and consider Lint as an important tool for this issue in Android development as well.

What is the definition of Static Code Analysis?

Basically, Static Code Analysis is the analysis of computer software, which is performed without actually executing programs, in contrast with dynamic analysis that is analysis performed on programs while they are executing. It involves the detection of vulnerabilities and functional errors in deployed or soon-to-be deployed software. Furthermore, Static Code Analysis is performed before the beginning of software testing phase.

In short, this method of analysis addresses weaknesses in source code, which might lead to security flaws and bugs. Besides, this could be achieved through manual code reviews; however, using automated tools is much more effective. Recently, many software companies are requiring projects to pass Static Code Analysis, in addition to doing code reviews and unit testing in the build process. Therefore, learning about Static Code Analysis is a key factor in having an Android application with high quality codes.

Advantages of using Static Code Analysis in Android apps

As we know, it takes time for developers to do manual code reviews. Automated tools are much faster indeed because it points out exactly where the bugs are in the code.

Helping detect potential bugs and errors that even unit or manual testing might have missed.

Defining project-specific rules, for instance: it helps you define a new project structure. Thus, they are configurable and customizable for your specific needs in your Android apps.

Helping you enhance your knowledge in Android programming.

Tracing and scanning all files and codes that you might not have ever read accurately. They scan every line of code to identify potential problems. So, this helps you achieve the highest possible quality of codes.

Introducing Static Code Analysis tools in Android

Basically, there are a number of tools and platforms for Static Code Analysis. However, this article aims to introduce some of them, which are used in Android programming as follows:

Programming Mistake Detector (PMD)

PMD is a open-source code analysis tool. It finds common programming flaws such as unused variables, empty catch blocks, unnecessary object creation, and so on. PMD includes built-in rules, and supports the ability to write custom rules as well. It supports a number of languages particularly Java. Also, it includes CPD, the copy-paste-detector. In a word, CPD finds duplicated code in some languages like Java. The complete features of PMD tool are mentioned as below:

Possible bugs: Empty try, catch, finally, and switch blocks.

Dead code: Unused local variables, parameters and private methods.

Empty if and While statements

Over-complicated expressions: Unnecessary if statements for loops that could be while loops.

Sub-optimal code: Wasteful String and StringBuffer usage.

Classes with high cyclomatic Complexity measurements.

Duplicate code: Copy-paste code can mean copied-pasted bugs, and decreases maintainability.

FindBugs

FindBugs is an open source Static Code Analysis tool that analyses Java byte-code, and it detects a wide range of bugs and problems.

Some of them are indicated as below:

Empty finalizer should be deleted. Class defines equals(), but not hashCode(). Confusing method names. Impossible downcast. Synchronize and null check on the same field. TestCase has no tests. Field should be package protected. Repeated conditional tests. Useless object created.

For more bugs and problems that are addressed by FindBugs, you should check this document that is called standard bug patterns.

Checkstyle

Checkstyle as an open source tool can check many aspects of your source code. It can find class design and method design problems. Furthermore, it has the capability to check code layouts and formatting issues.

Checkstyle is highly customizable, and it can be used to support some popular coding standards such as Sun Code Conventions and Google Java Style. In other words, you can mention some rules in an XML file to enforce a standard for your project in implementing. In fact, Checkstyle enforces those rules by analyzing your source code, and compares them with accredited standards or conventions.

Lint

The Lint tool checks your Android project source files for potential bugs and optimization improvements for correctness, security, performance, usability, accessibility, and internationalization. Besides, you can configure lint checking for different levels of your project. For instance: entire project and project module.

The whole process of lint can be classified in three steps:

Creating lint.xml file Selecting the source code for performing analysis by Lint (.java/.kt/XML file) Checking for bugs and suggesting some improvements

You can customize the Lint checks in the lint.xml file. It means you can indicate the rules that you want to include, and ignore the checks that you do not want to include in this file. For instance, if you want to check the unused variables and also do not want to check for naming conventions, you can accomplish these tasks in lint.xml file (you should make this new file in the root directory of your Android project).

To configure Lint, you have to include the lintOption block in your module-level build.gradle file:

android { lintOptions { abortOnError false

quiet true

lintConfig file("$project.rootDir/tools/rules-lint.xml")

htmlOutput file("$project.buildDir/outputs/lint/lint.html")

warningsAsErrors true

xmlReport false

}

}

lintConfig: the path to lint rule sets file where you can check issues.

htmlOutput: the path where html report will be generated.

abortOnError: If errors find, Lint should exit the process.

quiet: whether to turn off analysis progress reporting

Your lint.xml file can include issues for Lint to ignore or modify. The below example is mentioned that Lint must ignore Icon Colors Check for whole project and ignore the path that is mentioned in the below code:

<lint>



<issue id="IconColors" severity="ignore" /> <issue id="Overdraw"> <ignore path=".../navigation.xml" /> </issue> </lint>

A more complete example can be defined like this:

<?xml version="1.0" encoding="UTF-8"?> <lint> <!-- Disable the given check in this project -->

<issue

id="IconMissingDensityFolder" severity="ignore" /> <!-- Ignore the ObsoleteLayoutParam issue in the specified files -->

<issue id="ObsoleteLayoutParam">

<ignore path="res/layout/activation.xml" />

<ignore path="res/layout-xlarge/activation.xml" />

</issue>

<!-- Ignore the UselessLeaf issue in the specified file -->

<issue id="UselessLeaf">

<ignore path="res/layout/main.xml" />

</issue>

<!-- Change the severity of hardcoded strings to "error" -->

<issue id="HardcodedText" severity="error" /> </lint>

In addition to this way, you can be able to customize the Lint checks manually in this path in Android Studio: Files > Settings > Editor > Inspections

A significant note can be added to this section about helping Lint for understanding the source code. In other words, you can use some annotations in your code for finding bugs more efficiently by Lint.

In conclusion

Recently, some accredited companies use Static Code Analysis tools in addition to Test and Code Review processes specially in designing and implementing an Android app because of the importance of quality in this major. In this article the importance of this issue and also some tools for Static Code Analysis in Android were considered. Basically, the aim is to find potential vulnerabilities such as bugs and security flaws in a source code in Android development.