Semmle Limited

Alexander Spoon

Julian Tibble

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for performing data flow analysis using collapsed contexts. One of the methods includes obtaining data representing a plurality of software elements, wherein one or more software elements are initially designated as elements having the particular property; iteratively designating other software elements to which data of the one or more elements having the particular property flows, including: whenever the program includes multiple calls to a function, analyzing the function in a collapsed context to determine whether any argument flows to a return value of the function, and whenever any data in an argument that has the particular property according to the collapsed context flows to a return value of the function, adding each call to the function throughout the program having one argument having the particular property; and providing the set of software elements having the particular property.

Data flow analysis with collapsed contexts

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for using an imports scanner to maintain a compilation cache. One of the methods includes receiving an original set of source code files to be compiled for a compilation target. Each file in in the original set having an entry point is added to a reduced set of source code files. Each unscanned file in the reduced set of source code files is scanned for import statements until no unscanned files in the reduced set of source code remain. Each file identified by an import statement is added to the reduced set of source code files. If the reduced set of files is not represented by an entry in a compilation cache, the compilation target is generated using only the reduced set of source code files instead of the original set of source code files.

Compilation cache with imports scanner

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating natural keys for software annotations. One of the methods includes receiving a source code representation of a collection of source code, the source code having an annotation attached to a particular source code element in the source code. An index is generated for the annotation, the index representing a position of the annotation in an order of all annotations attached to the particular source code element. A natural key is generated for the annotation including combining a key of the particular source code element and the index for the annotation. A data entry is generated for the annotation, the data entry having the natural key for the annotation.

Annotation natural keys for source code analysis

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating widened types for static analysis. One of the methods includes receiving an output generated by a program parser for a source code file, wherein the output identifies a respective original type for each of one or more source code elements in the source code file. A respective widened type name is generated for each of one or more source code elements in the output, the widened type name being different from an original type name of the original type of the source code element. Static analysis are generated results for the source code file, wherein the static analysis results reference each source code element of the one or more source code elements by a respective widened type name for the source code element instead of by a respective original type name of the source code element.

Growing community of inventors

Atlanta, GA, United States of America

Alexander Spoon