Download Tools for static code analysis: A survey

3.7 Usability
43
Figure 3.9. CodeSonar-hub front page
the problem column various hints can be given to the user about what is happens
on a row that contributes to the warning (see the part about using CodeSonar to
scan pure-ftpd for a more detailed explanation on how to follow the path leading
to an issue).
If the auditor is not sure why/how the issue might give rise to an error or a security breach the links presented next to Categories leads to good and educational
descriptions of the issue.
Siproxd 0.7.0
CodeSonar does not have any restrictions on the code size of a program, and when
a scan of a more complex program than only a single file is to be performed not
much is different from the previous case. If a Makefile is used, all that has to be
done is to perform a make clean command (since CodeSonar “watches” a build
of the program subject to a scan as a way of learning about different dependencies
etc. it is of great importance that a complete build is performed) and after that
call CodeSonar in the same way as in the case with single_file.c but with a call
to make instead of a compiler followed by a file.
The remaining part of the work, such as inspecting the issues, is all the same
as described in the previous part.
Pure-ftpd 1.0.21
Pureftpd 1.0.21 is the most complex program used in this part of the thesis but
it does not influence the procedure of performing a scan with CodeSonar at all