Semmle Limited

Microsoft Technology Licensing, LLC

Julian Tibble

Pavel Avgustinov

Arthur Baars

Anders Starcke Henriksen

Max Schaefer

Oege De Moor

Peter Cawley

Yorck Huenke

Alexander Spoon

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for how a build system uses import graphs to maintain a current compilation cache and determine when compilation targets should be recompiled. A request is received to compile a compilation target. A plurality of files are identified that are used to build the compilation target. An import graph that represents import dependencies among the files used the build the compilation target is generated for the compilation target. The import graph is traversed to assign a respective identifier to each node in the import graph. A cache key is generated from data representing import relationships represented by the import graph and data representing contents of files used to build the compilation target. If the cache key is invalid or does not exist, compiling the compilation target.

Compiler caching based on semantic structure

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating signatures for source code elements. One of the methods includes generating a respective signature for each source code element of the plurality of source code elements, including obtaining a name of the source code element, obtaining one or more of a location of a compilation unit containing the source code element and contents of the compilation unit containing the source code element, and generating the signature including combining a first representation of the name of the source code element and one or more of a second representation of the location of the compilation unit and a third representation of the contents of the compilation unit containing the source code element, wherein at least two of the plurality of source code elements have a same name and different respective signatures.

Source code element signatures

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for aggregating source code metric values. One of the methods includes obtaining data representing a directed graph, wherein one or more nodes of the graph are associated with a respective set of one or more metric instances, wherein each set of metric instances for each node includes all metric instances occurring in sets of any node descendant from the node in the graph, wherein each metric instance identifies a location in a source code base, and wherein each metric instance has a respective metric value, a respective identifier, and a respective attribute type. An attribute value is computed for a first node in the graph from the respective metric value of each metric instance in a first set of metric instances associated with the first node.

Aggregating source code metric values

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for extracting source code. One of the methods includes receiving, by a newly created process, a request to execute code of an executable file in the newly created process, wherein the request specifies a parameter. The newly created process loads a process interception library. Library initialization code of the process interception library determines whether the parameter should be intercepted. In response to determining that the parameter should be intercepted, the parameter is provided to another process.

Extracting source code

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for using a snapshot manifest when storing files in a data store. One of the methods includes computing first static analysis results for a current snapshot; requesting, from a data storage system, a manifest that includes a plurality of unique identifiers that each identify a corresponding second object of second static analysis results for a previous snapshot; determining, for each first object of the first static analysis results, a unique identifier for the first object; determining, for each first object of the first static analysis results, whether the unique identifier for the first object occurs in the manifest; generating a batch of first objects having unique identifiers that do not occur in the manifest; and providing, to the data storage system, the batch of first objects having unique identifiers that do not occur in the manifest.

Snapshot manifest for static analysis results

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating normalized analysis artifacts for a source code base. One of the methods includes receiving a request to perform an analysis of a collection of source code files in a particular file system, wherein each source code file in the particular file system has a respective associated original file path. One or more normalized analysis artifacts are generated for the collection of source code files, including applying a file path transformation function to the original file path of each source code file referenced by the analysis artifacts to generate a normalized file path for the source code file, wherein each reference in the normalized analysis artifacts to a particular source code file uses the normalized file path for the particular source code file instead of the original file path for the particular source code file.

Artifact normalization

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating natural keys for software annotations. One of the methods includes receiving a source code representation of a collection of source code, the source code having an annotation attached to a particular source code element in the source code. An index is generated for the annotation, the index representing a position of the annotation in an order of all annotations attached to the particular source code element. A natural key is generated for the annotation including combining a key of the particular source code element and the index for the annotation. A data entry is generated for the annotation, the data entry having the natural key for the annotation.

Annotation natural keys for source code analysis

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for matching and attributing code violations. One of the methods includes receiving a snapshot S of a code base of source code and a different snapshot T of the code base. Data representing first violations in the snapshot S and second violations in the snapshot T is received. Pairs of matching violations are determined using performing two or more matching processes, including performing a first matching process, the first matching process determining first pairs of matching violations according to a first matching algorithm and performing a second matching process, the second matching process determining second pairs of matching violations according to a second matching algorithm from violations not matched by the first matching process. The first pairs of matching violations and the second pairs of matching violations are included in the determined pairs of matching violations.

Growing community of inventors

Oxford, United Kingdom

Julian Tibble