Static analysis tools as the best friend of QA
Report
Share
•2 likes•1,734 views
Static analysis tools as the best friend of QA
•2 likes•1,734 views
Report
Share
We have spent many years testing our applications and systems manually and with test automation tools. During this time many bug root causes have been classified and could be detected automatically with special static analysis tools. Most of them could be applied at the early stages of development even before code is integrated into the main development branch. In this talk, I will go through available solutions and demonstrate what kinds of issues may be detected automatically reducing the time and effort of traditional testing.
Recommended
More Related Content
What's hot
What's hot(20)
Similar to Static analysis tools as the best friend of QA
Similar to Static analysis tools as the best friend of QA(20)
More from Mikalai Alimenkou
More from Mikalai Alimenkou(20)
![Hexagonal architecture with Spring Boot [EPAM Java online conference]](https://cdn.slidesharecdn.com/ss_thumbnails/hexagonalarchitecturewithspringboot-180925151506-thumbnail.jpg?width=768&fit=bounds)
![Bro, manage test data like a pro! [QA Fest 2018]](https://cdn.slidesharecdn.com/ss_thumbnails/bromanagetestdatalikeapro-180922193659-thumbnail.jpg?width=768&fit=bounds)
Recently uploaded
Recently uploaded(20)
Static analysis tools as the best friend of QA
- 1. Static analysis tools as the best friend of QA Mikalai Alimenkou @xpinjection https://t.me/xpinjection_channel https://xpinjection.com
- 4. Disclaimer This talk is based on personal experience
- 6. C’mon, bro! Show us the pyramid!
- 9. Why most of test automation is too late? Quality has already degraded and testing just find it, preventing further propagation Long feedback cycle for all roles It is too late when work is done, so fixes cause rework and additional efforts Root cause analysis is not easy and doesn’t prevent issues in the future Test automation is not cheap
- 10. Main focus on quality degradation
- 11. Shift left for defect prevention
- 12. Traditional static code analysis
- 13. Static code analysis evaluation Can find weaknesses in the code at the exact location Relatively fast if proper automated tools are used Automated tools can scan the entire code base and provide mitigation recommendations Issues are found earlier, reducing the cost to fix Automated tools produce false positives and negatives Rules require continuous attention and maintenance Does not find vulnerabilities introduced in the runtime environment
- 14. Dynamic code analysis evaluation Identifies vulnerabilities in a runtime environment Performs analysis without access to the actual code Identifies vulnerabilities that might have been false negatives in the static code analysis Can be conducted against any application Automated tools produce false positives and negatives Rules require continuous attention and maintenance Difficult to trace the vulnerability back to the exact location in the code, taking longer to fix the problem
- 19. Bring it closer to developer!
- 21. Configuration could also be validated
- 24. Dynamic persistence config analysis
- 26. Do you have any secrets? ;) https://github.com/michenriksen/gitrob https://github.com/dxa4481/truffleHog https://github.com/awslabs/git-secrets
- 27. Full repository history is scanned
- 29. Are your containers vulnerable? https://github.com/docker/docker-bench-security https://github.com/quay/clair https://github.com/aquasecurity/trivy
- 30. Very hot topic in containerization era
- 32. Summary and take aways Use static analysis to prevent defects Carefully choose toolset Shift left as much as possible Don’t stop on code level only Empower IDE for continuous QA Tune tools based on usage feedback Don’t forget about security, this is hot topic now Enjoy your life with less defects and better quality!