Semmle Limited

Other

Microsoft Technology Licensing, LLC

Pavel Avgustinov

Julian Tibble

Arthur Baars

Max Schaefer

Anders Starcke Henriksen

Oege De Moor

Peter Cawley

Yorck Huenke

Damien Sereni

Mathieu Verbaere

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for performing partial analysis of source code files in a code base. One of the methods includes receiving a request for analysis results for a subset of source code files in a project. A set of primary source code files is generated according to the request, wherein the set of primary source code files includes fewer than all source code files in the project. A set of secondary source code files is generated, the set comprising source code files upon which at least one of the primary source code files depends directly or transitively. A partial analysis of the code base is performed using all files included in the set of primary source code files or the set of secondary source code files. Analysis results for the files included in the set of primary source code files is provided in response to the request.

Performing partial analysis of a source code base

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for how a build system uses import graphs to maintain a current compilation cache and determine when compilation targets should be recompiled. A request is received to compile a compilation target. A plurality of files are identified that are used to build the compilation target. An import graph that represents import dependencies among the files used the build the compilation target is generated for the compilation target. The import graph is traversed to assign a respective identifier to each node in the import graph. A cache key is generated from data representing import relationships represented by the import graph and data representing contents of files used to build the compilation target. If the cache key is invalid or does not exist, compiling the compilation target.

Compiler caching based on semantic structure

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating signatures for source code elements. One of the methods includes generating a respective signature for each source code element of the plurality of source code elements, including obtaining a name of the source code element, obtaining one or more of a location of a compilation unit containing the source code element and contents of the compilation unit containing the source code element, and generating the signature including combining a first representation of the name of the source code element and one or more of a second representation of the location of the compilation unit and a third representation of the contents of the compilation unit containing the source code element, wherein at least two of the plurality of source code elements have a same name and different respective signatures.

Source code element signatures

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for aggregating source code metric values. One of the methods includes obtaining data representing a directed graph, wherein one or more nodes of the graph are associated with a respective set of one or more metric instances, wherein each set of metric instances for each node includes all metric instances occurring in sets of any node descendant from the node in the graph, wherein each metric instance identifies a location in a source code base, and wherein each metric instance has a respective metric value, a respective identifier, and a respective attribute type. An attribute value is computed for a first node in the graph from the respective metric value of each metric instance in a first set of metric instances associated with the first node.

Aggregating source code metric values

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for extracting source code. One of the methods includes receiving, by a newly created process, a request to execute code of an executable file in the newly created process, wherein the request specifies a parameter. The newly created process loads a process interception library. Library initialization code of the process interception library determines whether the parameter should be intercepted. In response to determining that the parameter should be intercepted, the parameter is provided to another process.

Extracting source code

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating normalized analysis artifacts for a source code base. One of the methods includes receiving a request to perform an analysis of a collection of source code files in a particular file system, wherein each source code file in the particular file system has a respective associated original file path. One or more normalized analysis artifacts are generated for the collection of source code files, including applying a file path transformation function to the original file path of each source code file referenced by the analysis artifacts to generate a normalized file path for the source code file, wherein each reference in the normalized analysis artifacts to a particular source code file uses the normalized file path for the particular source code file instead of the original file path for the particular source code file.

Artifact normalization

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for matching and attributing code violations. One of the methods includes receiving a snapshot S of a code base of source code and a different snapshot T of the code base. Data representing first violations in the snapshot S and second violations in the snapshot T is received. Pairs of matching violations are determined using performing two or more matching processes, including performing a first matching process, the first matching process determining first pairs of matching violations according to a first matching algorithm and performing a second matching process, the second matching process determining second pairs of matching violations according to a second matching algorithm from violations not matched by the first matching process. The first pairs of matching violations and the second pairs of matching violations are included in the determined pairs of matching violations.

Growing community of inventors

Oxford, United Kingdom

Pavel Avgustinov