Home/ Questions/Q 259243
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T22:14:52+00:00

Which static analysis tools for Java has easiest extension mechanism. I checked PMD But

  • 0

Which static analysis tools for Java has easiest extension mechanism. I checked PMD
But the process of writing custom rules appears to be very involved.
Specifically, I want to know whether there is any tools that offers AspectJ like syntax for picking out interesting areas of code? I am aware of AspectJ’s declare warning but it appears to be limited in what it can do.

I have found a related question:

Static Analysis tool recommendation for Java?
Static Analysis tool recommendation for Java?

The answers list many tools. But I want to find which one offers easiest option for writing custom rules.

Edit: So far PMD’s XPath expressions suggested by Guillaume appears to be closest to what I am looking for. I will be exploring it shortly.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The real problem with “extending” a static analysis tool is “static analysis” is such a broad topic that that you need lots of machinery to do it in general: parsing, tree building, control flow graph extraction, data flow extraction, points-to analysis, interprocedural analysis, range analysis, the list goes on and on, see the tons of compiler literature on analyzing programs.

    You might use pattern matching of surface syntax to focus the tool’s attention on some program code, but you’ll still have
    to explain to the tool what you want it to “statically analyze” at that point
    (and some analyses [such as points-to] require you do the analysis everywhere
    first, and then just pick out the part you want).

    Moral: don’t expect extending a tool to do arbitrary analysis to be easy.
    You should basically decide what kinds of analysis you care about in advance
    (tainted inputs? subscript range checks? API abuse?) and find a tool that
    already supports that kind of thing. At least then your “extensions” have
    a chance of being simple by virtue of being similar to what the tool already does.

    Our DMS Software Reengineering Toolkit is an attempt to amortize the cost of building all kinds of analysis machinery across many applications and langauges.
    It provides the parsing, control/dataflow analysis and points-to analysis
    to varying degrees for C, C++, Java and COBOL. And it has surface-syntax
    pattern matching to help you “point”.
    See http://www.semanticdesigns.com/Products/DMS/DMSToolkit.html

    • 0