Exploring Platform Independent Code Linting

Introduction

Security code smells are complex and it is very time consuming to write linters for them. A linter is software that decides about the code, which must be highlighted in the editor view [1].

State of the art

Since almost every IDE maintains its own syntax tree implementation, there is currently no way to implement a linter once and for all major IDEs.

Task

Your task is to evolve the used syntax that is loosely based on SrcML [2] and, if possible, to implement a prototype that can provide such features. We will start with implementing an IntelliJ plug-in that supports generic linting declarations, e.g., which can highlight every Java String variable with the assigned value "Hello World".

An example declaration for such a linter could be:

<linter name="Issue 001: 'Hello World' in production releases" language="Java">
    <note>
        This linter highlights String variables with assigned "Hello World" values.
    </note>
    <matcher>
        <literal type="string">
            Hello World!
        </literal>
    </matcher>
</linter>

This should match the variable message in a code snippet like this:

String message = "Hello World!";

Requirements

You should have some knowledge of an Abstract Syntax Tree (AST) and its manipulation [3], and you should be able to read and parse XML data from disk. Some experience in working with IntelliJ is a plus.

References

[1] Linter examples for Android Studio (based on IntelliJ)
[2] Java declarations used by SrcML
[3] Navigating in the AST structure of IntelliJ


Contact

Pascal Gadient

Last changed by gadient on 8 September 2021