A tẹsiwaju lati jẹ ki lilo PVS-Studio rọrun diẹ sii. Oluyanju wa wa bayi ni Chocolatey, oluṣakoso package fun Windows. A gbagbọ pe eyi yoo dẹrọ imuṣiṣẹ ti PVS-Studio, ni pataki, ni awọn iṣẹ awọsanma. Ni ibere ki o má lọ jina, jẹ ki a ṣayẹwo koodu orisun ti Chocolatey kanna. Azure DevOps yoo ṣiṣẹ bi eto CI kan.
Eyi ni atokọ ti awọn nkan miiran wa lori koko ti iṣọpọ pẹlu awọn eto awọsanma:
Mo gba ọ ni imọran lati san ifojusi si nkan akọkọ nipa isọpọ pẹlu Azure DevOps, nitori ninu ọran yii diẹ ninu awọn aaye ti yọkuro ki o má ba ṣe pidánpidán.
Nitorinaa, awọn akọni ti nkan yii:
jẹ irinṣẹ itupalẹ koodu aimi ti a ṣe apẹrẹ lati ṣe idanimọ awọn aṣiṣe ati awọn ailagbara ti o pọju ninu awọn eto ti a kọ sinu C, C ++, C # ati Java. Ṣiṣẹ lori 64-bit Windows, Linux, ati awọn eto macOS, ati pe o le ṣe itupalẹ koodu ti a ṣe apẹrẹ fun 32-bit, 64-bit, ati awọn iru ẹrọ ARM ti a fi sii. Ti eyi ba jẹ igba akọkọ ti o n gbiyanju itupalẹ koodu aimi lati ṣayẹwo awọn iṣẹ akanṣe rẹ, a ṣeduro pe ki o mọ ararẹ pẹlu nipa bi o ṣe le yara wo awọn ikilọ PVS-Studio ti o nifẹ julọ ati ṣe iṣiro awọn agbara ti ọpa yii.
- eto awọn iṣẹ awọsanma ti o bo gbogbo ilana idagbasoke. Syeed yii pẹlu awọn irinṣẹ bii Azure Pipelines, Azure Boards, Azure Artifacts, Azure Repos, Awọn Eto Idanwo Azure, eyiti o gba ọ laaye lati ṣe iyara ilana ti ṣiṣẹda sọfitiwia ati ilọsiwaju didara rẹ.
jẹ oluṣakoso package orisun ṣiṣi fun Windows. Ibi-afẹde ti iṣẹ akanṣe ni lati ṣe adaṣe gbogbo igbesi aye sọfitiwia lati fifi sori ẹrọ si imudojuiwọn ati yiyọ kuro lori awọn ọna ṣiṣe Windows.
Nipa lilo Chocolatey
O le wo bii o ṣe le fi sori ẹrọ oluṣakoso package funrararẹ ni eyi . Iwe pipe fun fifi olutupalẹ sori ẹrọ wa ni Wo fifi sori ẹrọ ni lilo apakan oluṣakoso package Chocolatey. Mo ti yoo ni soki tun diẹ ninu awọn ojuami lati ibẹ.
Paṣẹ lati fi ẹya tuntun ti olutupalẹ sori ẹrọ:
choco install pvs-studioPaṣẹ lati fi ẹya kan pato ti package PVS-Studio sori ẹrọ:
choco install pvs-studio --version=7.05.35617.2075Nipa aiyipada, nikan mojuto ti olutupalẹ, paati Core, ti fi sori ẹrọ. Gbogbo awọn asia miiran (Standalone, JavaCore, IDEA, MSVS2010, MSVS2012, MSVS2013, MSVS2015, MSVS2017, MSVS2019) le ṣee kọja ni lilo --package-parameters.
Apeere ti aṣẹ ti yoo fi olutupalẹ sori ẹrọ pẹlu ohun itanna kan fun Studio Visual 2019:
choco install pvs-studio --package-parameters="'/MSVS2019'"Bayi jẹ ki a wo apẹẹrẹ ti lilo irọrun ti olutupalẹ labẹ Azure DevOps.
Ṣe akanṣe
Jẹ ki n leti pe apakan lọtọ wa nipa iru awọn ọran bii iforukọsilẹ akọọlẹ kan, ṣiṣẹda Pipeline Kọ ati mimuuṣiṣẹpọ akọọlẹ rẹ pẹlu iṣẹ akanṣe kan ti o wa ni ibi ipamọ GitHub. . Eto wa yoo bẹrẹ lẹsẹkẹsẹ pẹlu kikọ faili atunto kan.
Ni akọkọ, jẹ ki a ṣeto ifilọlẹ ifilọlẹ kan, nfihan pe a ṣe ifilọlẹ nikan fun awọn ayipada ninu titunto si ẹka:
trigger:
- masterNigbamii ti a nilo lati yan ẹrọ foju kan. Ni bayi o yoo jẹ aṣoju ti o gbalejo Microsoft pẹlu Windows Server 2019 ati Visual Studio 2019:
pool:
vmImage: 'windows-latest'Jẹ ki a lọ si ara ti faili iṣeto ni (block awọn igbesẹ). Paapaa otitọ pe o ko le fi sọfitiwia lainidii sori ẹrọ foju kan, Emi ko ṣafikun eiyan Docker kan. A le ṣafikun Chocolatey bi itẹsiwaju fun Azure DevOps. Lati ṣe eyi, jẹ ki a lọ si . Tẹ Gba ọfẹ. Nigbamii ti, ti o ba ti fun ni aṣẹ tẹlẹ, yan akọọlẹ rẹ nirọrun, ati bi ko ba ṣe bẹ, lẹhinna ṣe ohun kanna lẹhin aṣẹ.
Nibi o nilo lati yan ibiti a yoo ṣafikun itẹsiwaju ki o tẹ bọtini naa fi sori ẹrọ.
Lẹhin fifi sori aṣeyọri, tẹ Tẹsiwaju si iṣeto:
O le wo awoṣe fun iṣẹ-ṣiṣe Chocolatey ni window awọn iṣẹ-ṣiṣe nigba ṣiṣatunkọ faili iṣeto ni azure-pipelines.yml:
Tẹ Chocolatey ki o wo atokọ ti awọn aaye:
Nibi a nilo lati yan fi sori ẹrọ ni aaye pẹlu awọn ẹgbẹ. IN Nuspec Orukọ faili tọka orukọ ti package ti a beere - pvs-studio. Ti o ko ba ṣe pato ẹya naa, tuntun yoo fi sori ẹrọ, eyiti o baamu wa patapata. Jẹ ki a tẹ bọtini naa fi ati pe a yoo rii iṣẹ ti ipilẹṣẹ ni faili iṣeto ni.
steps:
- task: ChocolateyCommand@0
inputs:
command: 'install'
installPackageId: 'pvs-studio'Nigbamii, jẹ ki a lọ si apakan akọkọ ti faili wa:
- task: CmdLine@2
inputs:
script: Bayi a nilo lati ṣẹda faili pẹlu iwe-aṣẹ atunnkanka. Nibi PVSNAME и PVSKEY - awọn orukọ ti awọn oniyipada ti awọn iye wọn ti a pato ninu awọn eto. Wọn yoo tọju iwọle PVS-Studio ati bọtini iwe-aṣẹ. Lati ṣeto awọn iye wọn, ṣii akojọ aṣayan Variables-> New oniyipada. Jẹ ki a ṣẹda awọn oniyipada PVSNAME fun wiwọle ati PVSKEY fun bọtini itupale. Maṣe gbagbe lati ṣayẹwo apoti naa Pa yi iye ìkọkọ fun PVSKEY. Koodu aṣẹ:
сall "C:Program Files (x86)PVS-StudioPVS-Studio_Cmd.exe" credentials
–u $(PVSNAME) –n $(PVSKEY)Jẹ ki a kọ iṣẹ akanṣe nipa lilo faili adan ti o wa ni ibi ipamọ:
сall build.batJẹ ki a ṣẹda folda nibiti awọn faili pẹlu awọn abajade ti olutupalẹ yoo wa ni ipamọ:
сall mkdir PVSTestResultsJẹ ki a bẹrẹ itupalẹ iṣẹ naa:
сall "C:Program Files (x86)PVS-StudioPVS-Studio_Cmd.exe"
–t .srcchocolatey.sln –o .PVSTestResultsChoco.plog A ṣe iyipada ijabọ wa si ọna kika html nipa lilo ohun elo PlogConverter:
сall "C:Program Files (x86)PVS-StudioPlogConverter.exe"
–t html –o PVSTestResults .PVSTestResultsChoco.plogBayi o nilo lati ṣẹda iṣẹ-ṣiṣe ki o le gbejade iroyin naa.
- task: PublishBuildArtifacts@1
inputs:
pathToPublish: PVSTestResults
artifactName: PVSTestResults
condition: always()Faili iṣeto ni kikun dabi eyi:
trigger:
- master
pool:
vmImage: 'windows-latest'
steps:
- task: ChocolateyCommand@0
inputs:
command: 'install'
installPackageId: 'pvs-studio'
- task: CmdLine@2
inputs:
script: |
call "C:Program Files (x86)PVS-StudioPVS-Studio_Cmd.exe"
credentials –u $(PVSNAME) –n $(PVSKEY)
call build.bat
call mkdir PVSTestResults
call "C:Program Files (x86)PVS-StudioPVS-Studio_Cmd.exe"
–t .srcchocolatey.sln –o .PVSTestResultsChoco.plog
call "C:Program Files (x86)PVS-StudioPlogConverter.exe"
–t html –o .PVSTestResults .PVSTestResultsChoco.plog
- task: PublishBuildArtifacts@1
inputs:
pathToPublish: PVSTestResults
artifactName: PVSTestResults
condition: always()Jẹ ki a tẹ Fipamọ->Fipamọ->Ṣiṣe lati ṣiṣe awọn iṣẹ-ṣiṣe. Jẹ ki a ṣe igbasilẹ ijabọ naa nipa lilọ si taabu awọn iṣẹ-ṣiṣe.
Ise agbese Chocolatey ni awọn laini 37615 nikan ti koodu C #. Jẹ ki a wo diẹ ninu awọn aṣiṣe ti a rii.
Awọn abajade idanwo
Ikilo N1
Ikilọ Oluyanju: Oniyipada 'Olupese' ti wa ni sọtọ si ara rẹ. CrytpoHash OlupeseSpecs.cs 38
public abstract class CrytpoHashProviderSpecsBase : TinySpec
{
....
protected CryptoHashProvider Provider;
....
public override void Context()
{
Provider = Provider = new CryptoHashProvider(FileSystem.Object);
}
}Oluyanju ṣe awari iṣẹ iyansilẹ ti oniyipada si ararẹ, eyiti ko ni oye. O ṣeese julọ, ni aaye ọkan ninu awọn oniyipada wọnyi o yẹ ki o jẹ ọkan miiran. O dara, tabi eyi jẹ typo kan, ati pe iṣẹ iyansilẹ le ṣee yọkuro nirọrun.
Ikilo N2
Ikilọ Oluyanju: [CWE-480] Oniṣẹ '&' ṣe iṣiro awọn iṣẹ ṣiṣe mejeeji. Boya onišẹ ọna kukuru '&&' yẹ ki o lo dipo. Platform.cs 64
public static PlatformType get_platform()
{
switch (Environment.OSVersion.Platform)
{
case PlatformID.MacOSX:
{
....
}
case PlatformID.Unix:
if(file_system.directory_exists("/Applications")
& file_system.directory_exists("/System")
& file_system.directory_exists("/Users")
& file_system.directory_exists("/Volumes"))
{
return PlatformType.Mac;
}
else
return PlatformType.Linux;
default:
return PlatformType.Windows;
}
}Iyatọ onišẹ & lati onišẹ && ni wipe ti o ba ti apa osi ti awọn ikosile ni èké, lẹhinna apa ọtun yoo tun ṣe iṣiro, eyiti ninu ọran yii tumọ si awọn ipe ọna ti ko wulo eto.directory_exists.
Ninu abala ti a gbero, eyi jẹ abawọn kekere kan. Bẹẹni, ipo yii le jẹ iṣapeye nipasẹ rirọpo & oniṣẹ ẹrọ pẹlu && oniṣẹ ẹrọ, ṣugbọn lati oju iwoye ti o wulo, eyi ko kan ohunkohun. Sibẹsibẹ, ni awọn igba miiran, iporuru laarin & && le fa awọn iṣoro to ṣe pataki nigbati apa ọtun ti ikosile naa jẹ itọju pẹlu awọn iye ti ko tọ/aiṣedeede. Fun apẹẹrẹ, ninu ikojọpọ aṣiṣe wa, , ọran yii wa:
if ((k < nct) & (s[k] != 0.0))Paapa ti o ba Atọka k ti ko tọ, yoo ṣee lo lati wọle si ohun orun ano. Bi abajade, imukuro yoo da silẹ IndexOutOfRangeException.
Ikilo N3, N4
Ikilọ Oluyanju: [CWE-571] Ikosile 'shortPrompt' jẹ otitọ nigbagbogbo. InteractivePrompt.cs 101
Ikilọ Oluyanju: [CWE-571] Ikosile 'shortPrompt' jẹ otitọ nigbagbogbo. InteractivePrompt.cs 105
public static string
prompt_for_confirmation(.... bool shortPrompt = false, ....)
{
....
if (shortPrompt)
{
var choicePrompt = choice.is_equal_to(defaultChoice) //1
?
shortPrompt //2
?
"[[{0}]{1}]".format_with(choice.Substring(0, 1).ToUpperInvariant(), //3
choice.Substring(1,choice.Length - 1))
:
"[{0}]".format_with(choice.ToUpperInvariant()) //0
:
shortPrompt //4
?
"[{0}]{1}".format_with(choice.Substring(0,1).ToUpperInvariant(), //5
choice.Substring(1,choice.Length - 1))
:
choice; //0
....
}
....
}Ni idi eyi, imọran ajeji kan wa lẹhin iṣẹ ti oniṣẹ ternary. Jẹ ki a ṣe akiyesi diẹ sii: ti ipo ti Mo samisi pẹlu nọmba 1 ba pade, lẹhinna a yoo lọ si ipo 2, eyiti o jẹ nigbagbogbo. otitọ, eyi ti o tumọ si laini 3 yoo ṣiṣẹ. Ti ipo 1 ba yipada lati jẹ eke, lẹhinna a yoo lọ si ila ti a samisi pẹlu nọmba 4, ipo ti o tun wa nigbagbogbo. otitọ, eyi ti o tumọ si laini 5 yoo ṣiṣẹ. Bayi, awọn ipo ti o samisi pẹlu asọye 0 kii yoo ni imuse, eyiti o le ma jẹ otitọ gangan ti isẹ ti olutọpa nireti.
Ikilo N5
Ikilọ Oluyanju: [CWE-783] Boya oniṣẹ ẹrọ '?:' n ṣiṣẹ ni ọna ti o yatọ ju bi o ti ṣe yẹ lọ. Awọn oniwe- ayo ni kekere ju ayo ti miiran awọn oniṣẹ ninu awọn oniwe-majemu. Awọn aṣayan.cs 1019
private static string GetArgumentName (...., string description)
{
string[] nameStart;
if (maxIndex == 1)
{
nameStart = new string[]{"{0:", "{"};
}
else
{
nameStart = new string[]{"{" + index + ":"};
}
for (int i = 0; i < nameStart.Length; ++i)
{
int start, j = 0;
do
{
start = description.IndexOf (nameStart [i], j);
}
while (start >= 0 && j != 0 ? description [j++ - 1] == '{' : false);
....
return maxIndex == 1 ? "VALUE" : "VALUE" + (index + 1);
}
}Ayẹwo naa ṣiṣẹ fun laini:
while (start >= 0 && j != 0 ? description [j++ - 1] == '{' : false)Niwon oniyipada j awọn laini diẹ loke ti wa ni ibẹrẹ si odo, oniṣẹ ternary yoo da iye pada èké. Nitori ipo yii, ara ti lupu yoo ṣee ṣe ni ẹẹkan. O dabi fun mi pe nkan koodu yii ko ṣiṣẹ rara bi olupilẹṣẹ ti pinnu.
Ikilo N6
Ikilọ Oluyanju: [CWE-571] Ikosile 'installedPackageVersions.Count != 1' jẹ otitọ nigbagbogbo. NugetService.cs 1405
private void remove_nuget_cache_for_package(....)
{
if (!config.AllVersions && installedPackageVersions.Count > 1)
{
const string allVersionsChoice = "All versions";
if (installedPackageVersions.Count != 1)
{
choices.Add(allVersionsChoice);
}
....
}
....
}Ipo itẹ-ẹiyẹ ajeji kan wa nibi: installPackageVersions.Count != 1eyi ti yoo ma jẹ nigbagbogbo otitọ. Nigbagbogbo iru ikilọ bẹ tọka aṣiṣe ọgbọn kan ninu koodu naa, ati ni awọn ọran miiran o kan tọka si iṣayẹwo laiṣe.
Ikilo N7
Ikilọ Oluyanju: Awọn ikosile-ipin kanna wa 'commandArguments.contains("-apikey")' si apa osi ati si ọtun ti '||' onišẹ. ArgumentsUtility.cs 42
public static bool arguments_contain_sensitive_information(string
commandArguments)
{
return commandArguments.contains("-install-arguments-sensitive")
|| commandArguments.contains("-package-parameters-sensitive")
|| commandArguments.contains("apikey ")
|| commandArguments.contains("config ")
|| commandArguments.contains("push ")
|| commandArguments.contains("-p ")
|| commandArguments.contains("-p=")
|| commandArguments.contains("-password")
|| commandArguments.contains("-cp ")
|| commandArguments.contains("-cp=")
|| commandArguments.contains("-certpassword")
|| commandArguments.contains("-k ")
|| commandArguments.contains("-k=")
|| commandArguments.contains("-key ")
|| commandArguments.contains("-key=")
|| commandArguments.contains("-apikey")
|| commandArguments.contains("-api-key")
|| commandArguments.contains("-apikey")
|| commandArguments.contains("-api-key");
}Awọn pirogirama ti o kowe yi apakan ti koodu daakọ ati ki o lẹẹmọ awọn ti o kẹhin meji ila ati ki o gbagbe lati satunkọ wọn. Nitori eyi, awọn olumulo Chocolatey ko lagbara lati lo paramita naa apikey tọkọtaya diẹ sii awọn ọna. Iru si awọn paramita loke, Mo le pese awọn aṣayan wọnyi:
commandArguments.contains("-apikey=");
commandArguments.contains("-api-key=");Awọn aṣiṣe daakọ-lẹẹmọ ni aye giga lati han laipẹ tabi ya ni eyikeyi iṣẹ akanṣe pẹlu iye nla ti koodu orisun, ati ọkan ninu awọn irinṣẹ to dara julọ lati koju wọn jẹ itupalẹ aimi.
PS Ati bi nigbagbogbo, aṣiṣe yii duro lati han ni opin ipo ila-pupọ :). Wo atẹjade "".
Ikilo N8
Ikilọ Oluyanju: [CWE-476] Ohun 'installedPackage' ni a lo ṣaaju ki o to rii daju lodi si asan. Ṣayẹwo awọn ila: 910, 917. NugetService.cs 910
public virtual ConcurrentDictionary<string, PackageResult> get_outdated(....)
{
....
var pinnedPackageResult = outdatedPackages.GetOrAdd(
packageName,
new PackageResult(installedPackage,
_fileSystem.combine_paths(
ApplicationParameters.PackagesLocation,
installedPackage.Id)));
....
if ( installedPackage != null
&& !string.IsNullOrWhiteSpace(installedPackage.Version.SpecialVersion)
&& !config.UpgradeCommand.ExcludePrerelease)
{
....
}
....
}Aṣiṣe Ayebaye: ohun akọkọ fi sori ẹrọPackage ti lo ati lẹhinna ṣayẹwo fun asan. Aisan aisan yii sọ fun wa nipa ọkan ninu awọn iṣoro meji ninu eto: boya fi sori ẹrọPackage ko dogba asan, eyi ti o ṣiyemeji, ati lẹhinna ayẹwo jẹ laiṣe, tabi a le gba aṣiṣe pataki kan ninu koodu - igbiyanju lati wọle si itọkasi asan.
ipari
Nitorinaa a ti gbe igbesẹ kekere miiran - ni bayi lilo PVS-Studio ti di paapaa rọrun ati irọrun diẹ sii. Emi yoo tun fẹ lati sọ pe Chocolatey jẹ oluṣakoso package ti o dara pẹlu nọmba kekere ti awọn aṣiṣe ninu koodu, eyiti o le jẹ paapaa diẹ nigba lilo PVS-Studio.
A pe o ati ki o gbiyanju PVS-Studio. Lilo igbagbogbo ti olutupalẹ aimi yoo mu didara ati igbẹkẹle koodu ti ẹgbẹ rẹ ṣe idagbasoke ati iranlọwọ ṣe idiwọ ọpọlọpọ .
PS
Ṣaaju ki o to tẹjade, a firanṣẹ nkan naa si awọn olupilẹṣẹ Chocolatey, ati pe wọn gba daradara. A ko rii ohunkohun pataki, ṣugbọn wọn, fun apẹẹrẹ, fẹran kokoro ti a rii ni ibatan si bọtini “api-key”.
Ti o ba fẹ pin nkan yii pẹlu awọn olugbo ti o sọ Gẹẹsi, jọwọ lo ọna asopọ itumọ: Vladislav Stolyarov. .
orisun: www.habr.com