Semmle Limited

Microsoft Technology Licensing, LLC

Arthur Baars

Julian Tibble

Pavel Avgustinov

Anders Starcke Henriksen

Max Schaefer

Oege De Moor

Yorck Huenke

Sebastiaan Johannes Van Schaik

Robin Neatherway

Sebastian Bauersfeld

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying system-generated code. One of the methods includes generating data representing a state of source code files of the snapshot before performing a build process for the snapshot. An instrumented build process is performed for the snapshot, including intercepting each compiler call of a plurality of compiler calls by the build process for the snapshot, and designating one or more respective source code files of each compiler call as source code files compiled during the build process for the snapshot. One or more source code files that are new or were modified after the build process was initiated are classified as source code files having system-generated source code.

Classifying system-generated code

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating a commit graph for a software project maintained in a version control system having a directory-based branching structure. One of the methods includes receiving data representing a commit history of a software project maintained in a version control system having a directory-based branching system in which each branch of the commit history has a respective branch directory and each revision is identified by a branch path and a revision number. The commit history is traced backward in time from a starting commit of a branch to identify an initial commit in which a branch directory for the branch was created. The commit history is then processed forward in time from the initial commit to generate a tree-structured commit graph.

Commit graph generation

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for aggregating source code metric values. One of the methods includes obtaining data representing a directed graph, wherein one or more nodes of the graph are associated with a respective set of one or more metric instances, wherein each set of metric instances for each node includes all metric instances occurring in sets of any node descendant from the node in the graph, wherein each metric instance identifies a location in a source code base, and wherein each metric instance has a respective metric value, a respective identifier, and a respective attribute type. An attribute value is computed for a first node in the graph from the respective metric value of each metric instance in a first set of metric instances associated with the first node.

Aggregating source code metric values

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for expressing inequality expressions as a bounded number of equality expressions. One of the methods includes receiving an original query having an inequality expression for an original attribute. A new query that replaces the inequality expression with a bounded number of equality expressions is generated, wherein each equality expression references a respective auxiliary attribute, each auxiliary attribute representing intervals of values for the original attribute. The new query having the bounded number of equality expressions is provided to a database system instead of the original query. Query results that satisfy the inequality expression for the original attribute are received from the database system.

Rewriting inequality queries

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating stable location identifiers. One of the methods includes generating, for each relevant location in an existing file, a signature for the relevant location using at most a predetermined quantity of characters surrounding the relevant location; obtaining, for a first file that includes location information for the existing file, data that identify one or more locatable strings in the existing file and, for each locatable string, a corresponding location within the existing file; determining, for each particular location associated with a locatable string from the one or more locatable strings in the existing file, a respective corresponding signature; and generating the first file that includes, for each locatable string from the one or more locatable strings, the respective corresponding signature that uniquely identifies the relevant location on which the locatable string occurs in the existing file.

Generating stable file location identifiers for reference to locations in a file

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for storing data in a version control system. One of the methods includes maintaining, in a data store, a tree-structured index of files in which each leaf node stores an entry for each file in a plurality of files for a snapshot that includes a unique file identifier for the respective file; receiving a request for a particular file; generating a hash of a particular file path for the particular file; identifying, using the hash of the particular file path, a leaf node in the tree-structured index that includes an entry for the particular file; identifying, in the leaf node, an entry for the particular file path; obtaining, from the entry, the unique file identifier for the particular file in the data store; and using the unique file identifier for the particular file in response to the request.

Content-addressable data storage

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for matching and attributing code violations. One of the methods includes receiving a snapshot S of a code base of source code and a different snapshot T of the code base. Data representing first violations in the snapshot S and second violations in the snapshot T is received. Pairs of matching violations are determined using performing two or more matching processes, including performing a first matching process, the first matching process determining first pairs of matching violations according to a first matching algorithm and performing a second matching process, the second matching process determining second pairs of matching violations according to a second matching algorithm from violations not matched by the first matching process. The first pairs of matching violations and the second pairs of matching violations are included in the determined pairs of matching violations.

Source code violation matching and attribution

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for distributing analysis tasks and attribution tasks. One of the methods includes receiving data representing a plurality of snapshots of a code base, wherein each snapshot comprises source code files, wherein one or more snapshots have a parent snapshot in the code base according to a revision graph of snapshots in the code base. An attribution set is generated from the plurality of snapshots, the attribution set having a target set of attributable snapshots to be attributed and a support set of all parent snapshots of all snapshots in the target set. An attribution task is distributed for the attribution set to a particular worker node of a plurality of worker nodes.

Growing community of inventors

Oxford, United Kingdom

Arthur Baars