CodeSonar and the Clang Static Analyzer

• Overview
• C/C++ Analysis
• Objective-C Analysis
• Example Command Lines
• Troubleshooting
• Example/Tutorial

Overview

When working with CodeSonar in conjunction with the Clang Static Analyzer, a typical workflow is to either use an IDE like Apple's Xcode^®, or a command line tool like scan-build to execute the Clang Static Analyzer while CodeSonar observes the build. The Clang Static Analyzer provides static analysis capabilities and executes the host compiler to perform an actual build of the source code. When executing the Clang Static Analyzer, you must specify that it output its results to the SARIF format (.sarif) so that these results may be imported into your project.

CodeSonar can load warning information from SARIF files and add those warnings to the set of analysis results recorded on the hub. The warnings can then be browsed alongside any warnings reported by CodeSonar.

Important: SARIF exports are supported in Clang Static Analyzer v8.0 and later. If a suitable version of Clang Static Analyzer is not already available on your local system, you will need to install and configure it to use the features described in this page.

Note

C/C++ Analysis

The following diagram provides an overview of a CodeSonar C/C++ build/analysis process based on Clang Static Analyzer results.

To build and analyze a C/C++ project based on the invocation of the Clang Static Analyzer scan-build command, do the following.

1. Run a codesonar build command to observe the execution of the scan-build command on your regular project build. The general form of the command is:
   codesonar build /path/to/pfiles-name [[protocol://]host:port] [other_options] \
   /path/to/clang/bin/scan-build -sarif -enable-checker core command
   Where command is your normal build command.
2. Run a codesonar analyze or codesonar build command to observe the execution of codesonar import_sarif.py on the SARIF results that were produced by the Clang Static Analyzer. The general form of the command is:
   codesonar analyze /path/to/pfiles-name [[protocol://]host:port] [other_options] \
   codesonar import_sarif.py /tmp/scan-build-datetime/*
   Where /tmp/scan-build-datetime is provided in the output of the scan-build command observed by the CodeSonar build command. CodeSonar will finalize and analyze the project, incorporating the SARIF results.
3. View the results in your hub.

Objective-C Analysis

The following diagram provides an overview of importing Objective-C analysis results into CodeSonar.

This section assumes that /path/to/clang/bin/ is in the PATH. To import CSA results into a CodeSonar project called ExampleTest, do the following.

1. Run the Clang Static Analyzer on your Objective-C source code. The general form of the command is:
   scan-build -sarif -o . command
   Where command is your normal build command.
2. Run a codesonar analyze command based on codesonar import_sarif.py to load the SARIF results that were produced by the Clang Static Analyzer into the project, along with the corresponding source files. The command will be something like the following.
   codesonar analyze ExampleTest [other codesonar options] \
   codesonar import_sarif.py /tmp/scan-build-datetime/* -include-sources /path/to/sourcefiles/**/*.[mh]
   Where
   • /tmp/scan-build-datetime is provided in the output of the scan-build command.
   • /path/to/sourcefiles/ is the directory tree containing your source files, and all your source files have extension .m or .h.
   CodeSonar will finalize the project and send the results to the hub.
3. View the results in your hub.

Example Command Lines

The following command lines display methods for importing results produced by the Clang Static Analyzer into CodeSonar.

This section assumes that /path/to/clang/bin/ is in the PATH.

Example 1 (C/C++)

Build and analyze a CodeSonar project based on the invocation of the Clang Static Analyzer.

• The build command observes the execution of Clang's scan-build command on your regular project build. The regular build command observed by Clang's scan-build, and thus by CodeSonar, is make.
• For the sake of this example, suppose that the result directory reported by Clang in the output from this command is tmp/scan-build-2019-03-20-112313-2843-1.
• CodeSonar imports the results of the Clang analysis into project cs-myproj, then finalizes and analyzes the project.

Example 2 (C/C++)

Exactly the same as Example 1, except that the SARIF output from Clang Static Analyzer is imported in a separate codesonar build invocation before the project is finalized and analyzed.

Example 3 (C/C++)

Observe the compilation of file1.c and file2.c and load their respective Clang analysis results from the directories reported in the Clang Static Analyzer output.

Example 4 (Objective-C)

Analyze Objective-C source file scratch.m with the Clang Static Analyzer, then import both the source file and the analysis results into a CodeSonar project.

• scan-build analyzes scratch.m, producing .sarif output.
• The CodeSonar imports the results of the Clang Static Analyzer analysis into project ExampleTest, along with corresponding source file scratch.m.
• CodeSonar finalizes the ExampleTest project and runs the CodeSonar analysis on all eligible components. Note that in this case there aren't any such eligible components: the only results in the analysis will be those imported from the Clang Static Analyzer output.

Troubleshooting

If the corresponding Analysis page on your hub is not showing any results from the Clang Static Analyzer, check the following.

A. Do you have a sufficiently recent version of Clang Static Analyzer?

The CodeSonar integration requires Clang Static Analyzer v8.0 or later.

B. Does your scan-build command run correctly in isolation?

1. Run make clean to ensure you will be fully rebuilding the project.
   make clean
2. Run the scan-build command in isolation.
   /path/to/clang/bin/scan-build -sarif -enable-checker core command
   Where command is your normal build command.
3. Check the following.
   • Did scan-build exit with success?
   • Did the scan-build output a line indicating where the analysis results are stored? It will look (something) like the following.
     
     scan-build: Analysis results (sarif files) deposited in /tmp/scan-build-datetime
   • Does directory /tmp/scan-build-datetime exist?
   • Does directory /tmp/scan-build-datetime contain one or more SARIF files?
   If the answer to any of these questions is "no", the problem is within scan-build and is independent of CodeSonar.
   1. Consult the scan-build documentation for help in diagnosing and resolving your problem.
   2. If you still cannot run scan-build in isolation, file a Clang Static Analyzer bug report.

C. Is your codesonar analyze command line free from typos?

Double-check to make sure your codesonar analyze command line contains all the required elements.

In particular, make sure you have specified the correct path to the directory where scan-build wrote its SARIF files. This will be different every time you run scan-build.

Example/Tutorial

An illustrated usage example for using the CodeSonar SARIF importer to incorporate results found by the Clang Static Analyzer is provided in section SARIF Importer for CodeSonar Using the Clang Static Analyzer: Example.